Loading ...

Play interactive tourEdit tour

Analysis Report PC21-270421.exe

Overview

General Information

Sample Name:PC21-270421.exe
Analysis ID:430961
MD5:140733109e3a3b3de2ae1aaf164178da
SHA1:5f8685572c91386045a5f458b298ee8c6934277c
SHA256:4bb04df120eb27c3f5b3a46a54891b927fe4232fdaf75b9ecaddc2f24d61533c
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:57
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Potential malicious icon found
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Contains capabilities to detect virtual machines
Detected potential crypto function
Found large amount of non-executed APIs
PE file contains strange resources
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • PC21-270421.exe (PID: 6376 cmdline: 'C:\Users\user\Desktop\PC21-270421.exe' MD5: 140733109E3A3B3DE2AE1AAF164178DA)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1IyeIvFG2j6rM8MkH-OGyKJbMY3m1XbJ6"}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
PC21-270421.exeJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: PC21-270421.exeMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1IyeIvFG2j6rM8MkH-OGyKJbMY3m1XbJ6"}
    Multi AV Scanner detection for submitted fileShow sources
    Source: PC21-270421.exeVirustotal: Detection: 33%Perma Link
    Source: PC21-270421.exeReversingLabs: Detection: 17%
    Source: PC21-270421.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=download&id=1IyeIvFG2j6rM8MkH-OGyKJbMY3m1XbJ6

    System Summary:

    barindex
    Potential malicious icon foundShow sources
    Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_004014B80_2_004014B8
    Source: PC21-270421.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: PC21-270421.exe, 00000000.00000000.658336766.0000000000424000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameINDFRELSENS.exe vs PC21-270421.exe
    Source: PC21-270421.exe, 00000000.00000002.685380233.00000000021E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs PC21-270421.exe
    Source: PC21-270421.exeBinary or memory string: OriginalFilenameINDFRELSENS.exe vs PC21-270421.exe
    Source: PC21-270421.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: classification engineClassification label: mal57.rans.troj.winEXE@1/0@0/0
    Source: C:\Users\user\Desktop\PC21-270421.exeFile created: C:\Users\user\Desktop\BortdsledesJump to behavior
    Source: PC21-270421.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\PC21-270421.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: PC21-270421.exeVirustotal: Detection: 33%
    Source: PC21-270421.exeReversingLabs: Detection: 17%
    Source: C:\Users\user\Desktop\PC21-270421.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeAutomated click: OK
    Source: C:\Users\user\Desktop\PC21-270421.exeAutomated click: OK
    Source: C:\Users\user\Desktop\PC21-270421.exeAutomated click: OK
    Source: Window RecorderWindow detected: More than 3 window changes detected

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: PC21-270421.exe, type: SAMPLE
    Source: Yara matchFile source: 0.0.PC21-270421.exe.400000.0.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.PC21-270421.exe.400000.0.unpack, type: UNPACKEDPE
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00410040 push edx; iretd 0_2_0041004B
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040D844 push edx; iretd 0_2_0040D84F
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040F844 push edx; iretd 0_2_0040F84F
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040B04B push ebx; iretd 0_2_0040B00F
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0041004C push ebx; iretd 0_2_004100BF
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040E050 push edx; iretd 0_2_0040E0EB
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00415051 push edx; iretd 0_2_0041506B
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0041105B push edx; iretd 0_2_0041106B
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040785C push edx; iretd 0_2_00407863
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00410861 push edx; iretd 0_2_004108D7
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040F862 push edx; iretd 0_2_0040F86F
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040C066 push ebx; iretd 0_2_0040C073
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040D870 push edx; iretd 0_2_0040D887
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040B874 push ebx; iretd 0_2_0040B87F
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00408078 push ebx; iretd 0_2_00408093
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040A008 push edx; iretd 0_2_00409FFF
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040B809 push ebx; iretd 0_2_0040B873
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040900F push edx; iretd 0_2_00409027
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0041601A push edx; iretd 0_2_0041603B
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00406021 push edx; iretd 0_2_00406023
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0040F025 push edx; iretd 0_2_0040F027
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00414028 push edi; iretd 0_2_00414029
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_0041402A push edx; iretd 0_2_0041402B
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00407034 push edx; iretd 0_2_0040703F
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_00410038 push ebx; iretd 0_2_004100BF
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_004078D4 push edx; iretd 0_2_004078DB
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_004068D4 push edx; iretd 0_2_0040692B
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_004090DC push edx; iretd 0_2_004090E3
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_004090E4 push ebx; iretd 0_2_00409147
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_004080E9 push edx; iretd 0_2_004080F7
    Source: C:\Users\user\Desktop\PC21-270421.exeCode function: 0_2_004108ED push edx; iretd 0_2_004108D7
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
    Source: C:\Users\user\Desktop\PC21-270421.exeAPI coverage: 0.6 %
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\PC21-270421.exeQueries volume information: unknown VolumeInformationJump to behavior

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionMasquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsVirtualization/Sandbox Evasion1LSASS MemoryVirtualization/Sandbox Evasion1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerFile and Directory Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery11Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    PC21-270421.exe33%VirustotalBrowse
    PC21-270421.exe17%ReversingLabsWin32.Infostealer.VBodius

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:32.0.0 Black Diamond
    Analysis ID:430961
    Start date:08.06.2021
    Start time:09:38:59
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 3m 27s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:PC21-270421.exe
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:6
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal57.rans.troj.winEXE@1/0@0/0
    EGA Information:
    • Successful, ratio: 100%
    HDC Information:
    • Successful, ratio: 2.9% (good quality ratio 0.6%)
    • Quality average: 12.4%
    • Quality standard deviation: 25%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .exe
    • Stop behavior analysis, all processes terminated
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):4.5836210897416745
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:PC21-270421.exe
    File size:147456
    MD5:140733109e3a3b3de2ae1aaf164178da
    SHA1:5f8685572c91386045a5f458b298ee8c6934277c
    SHA256:4bb04df120eb27c3f5b3a46a54891b927fe4232fdaf75b9ecaddc2f24d61533c
    SHA512:4877a2f6b11143837daa69527b42307c1381e0aec14ada161157937ad4bed29dbf9e5c27734d976c11bc37d3caf901066e84d4f0d041092c71dace2010d613c7
    SSDEEP:1536:ELaMxQEBAFJaW5RmJjug+YbhRjurq7NxYZMvkastkn23U:EGOImpu5eRjurq7NuZM8aslk
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...`..`.....................0............... ....@................

    File Icon

    Icon Hash:20047c7c70f0e004

    Static PE Info

    General

    Entrypoint:0x4014b8
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x60BDFA60 [Mon Jun 7 10:52:16 2021 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:b1d5215cf0ff1abab4dacdc311d642d4

    Entrypoint Preview

    Instruction
    push 00401768h
    call 00007F7AF8997755h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    inc eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [edx], dl
    cmp eax, 5CE0EAF8h
    fisttp word ptr [eax-65h]
    mov ebx, 5C7651BAh
    cmpsb
    sub byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [ecx], al
    add byte ptr [eax], al
    add byte ptr [edx+00h], al
    xchg byte ptr [eax-7Dh], dl
    add dword ptr [ebp+64h], edx
    jnc 00007F7AF89977CDh
    jc 00007F7AF89977C3h
    bound ebp, dword ptr [esi+69h]
    outsb
    jnc 00007F7AF8997763h
    sub dword ptr [edx], edx
    add eax, dword ptr [eax]
    add byte ptr [eax], al
    add bh, bh
    int3
    xor dword ptr [eax], eax
    or byte ptr [ecx], dh
    hlt
    mov byte ptr [8C30EA80h], al
    inc esi
    mov edi, 55DE3260h
    mov esp, 829DFCC8h
    inc eax
    insd
    inc byte ptr [ecx-59h]
    dec esp
    mov seg?, cx
    outsd
    fsub dword ptr [ebx]
    mov ebx, 4F3AB413h
    lodsd
    xor ebx, dword ptr [ecx-48EE309Ah]
    or al, 00h
    stosb
    add byte ptr [eax-2Dh], ah
    xchg eax, ebx
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    movsd
    add dword ptr [eax], eax
    add byte ptr [esi+00h], dl
    add byte ptr [eax], al
    add byte ptr [eax+eax], cl
    inc esp
    popad
    outsb
    jnc 00007F7AF89977CDh
    jbe 00007F7AF89977C3h
    outsb
    jc 00007F7AF89977D7h
    add byte ptr [54000E01h], cl
    add byte ptr [bx+si], al

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x20c340x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x240000xa04.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000x154.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x201ac0x21000False0.324573863636data4.82414979296IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x220000x12340x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x240000xa040x1000False0.182373046875data2.19382824201IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    RT_ICON0x248d40x130data
    RT_ICON0x245ec0x2e8data
    RT_ICON0x244c40x128GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x244940x30data
    RT_VERSION0x241500x344dataSesotho (Sutu)South Africa

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaHresultCheck, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaR4Str, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaFileOpen, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

    Version Infos

    DescriptionData
    Translation0x0430 0x04b0
    LegalCopyrightYonyou Network
    InternalNameINDFRELSENS
    FileVersion1.00
    CompanyNameYonyou Network
    LegalTrademarksYonyou Network
    CommentsYonyou Network
    ProductNameYonyou Network
    ProductVersion1.00
    FileDescriptionYonyou Network
    OriginalFilenameINDFRELSENS.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    Sesotho (Sutu)South Africa

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    High Level Behavior Distribution

    Click to dive into process behavior distribution

    System Behavior

    General

    Start time:09:39:52
    Start date:08/06/2021
    Path:C:\Users\user\Desktop\PC21-270421.exe
    Wow64 process (32bit):true
    Commandline:'C:\Users\user\Desktop\PC21-270421.exe'
    Imagebase:0x400000
    File size:147456 bytes
    MD5 hash:140733109E3A3B3DE2AE1AAF164178DA
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Reputation:low

    Disassembly

    Code Analysis

    Reset < >

      Execution Graph

      Execution Coverage:0.4%
      Dynamic/Decrypted Code Coverage:100%
      Signature Coverage:100%
      Total number of Nodes:2
      Total number of Limit Nodes:0

      Graph

      execution_graph 2151 4014b8 #100 2152 4014f8 2151->2152

      Executed Functions

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 0 4014b8-4014f6 #100 1 401563-40156f 0->1 2 4014f8-401562 0->2 4 401571 1->4 5 4015dc-4015e7 1->5 2->1 8 401573-401574 4->8 9 4015d4-4015db 4->9 6 4015e9 5->6 10 4015eb-4015f6 6->10 8->10 11 401578-401582 8->11 9->5 12 4015f9-401601 10->12 11->6 13 401584 11->13 14 401602-40160f 12->14 13->12 15 401586-40159b 13->15 17 401612-401622 14->17 15->14 16 40159d 15->16 16->17 18 40159f-4015d2 16->18 19 401624-40163b 17->19 20 401656-401667 17->20 18->9 21 40163d 18->21 19->21 23 40166a-401684 20->23 24 4016dd-4016f3 20->24 28 401641-401652 21->28 29 4016b4 21->29 25 401685-4016b3 23->25 26 4016f5-401709 24->26 27 401726-40172d 24->27 25->29 31 40170b-401725 26->31 32 401730-4017a0 27->32 28->25 33 401654 28->33 29->27 30 4016b6 29->30 30->27 34 4016b8 30->34 31->27 33->20 34->32 35 4016ba-4016d7 34->35 35->31 36 4016d9-4016db 35->36 36->24
      C-Code - Quality: 85%
      			_entry_(signed int __eax, signed int* __ecx, intOrPtr __edx, signed int __esi, void* __fp0, char _a1, void* _a4, intOrPtr _a54, char _a100, char _a103, char _a458816) {
      				void* _v8;
      				void* _v18;
      				void* _v30;
      				void* _v34;
      				void* _v38;
      				void* _v44;
      				void* _v66;
      				void* _v100;
      				void* _v116;
      				void* _v122;
      				void* _v132;
      				void* _v138;
      				void* _v144;
      				void* _v154;
      				void* _v166;
      				void* _v836;
      				void* _v856;
      				void* _v858;
      				void* _v864;
      				void* _v868;
      				void* _v872;
      				void* _v876;
      				void* _v878;
      				void* _v880;
      				void* _v884;
      				void* _v886;
      				void* _v888;
      				void* _v890;
      				void* _v892;
      				void* _v894;
      				void* _v896;
      				void* _v898;
      				void* _v900;
      				void* _v902;
      				void* _v904;
      				void* _v906;
      				void* _v910;
      				void* _v912;
      				void* _v920;
      				void* _v926;
      				void* _v928;
      				void* _v936;
      				void* _v940;
      				void* _v942;
      				void* _v944;
      				void* _v948;
      				void* _v952;
      				void* _v956;
      				void* _v958;
      				void* _v964;
      				void* _v966;
      				void* _v972;
      				void* _v974;
      				void* _v980;
      				void* _v988;
      				void* _v990;
      				void* _v996;
      				void* _v1004;
      				void* _v1006;
      				void* _v1012;
      				void* _v1022;
      				void* _v1036;
      				void* _v1038;
      				void* _v1040;
      				void* _v1044;
      				void* _v1048;
      				void* _v1052;
      				void* _v1056;
      				void* _v1058;
      				void* _v1060;
      				void* _v1062;
      				void* _v1064;
      				void* _v1066;
      				void* _v1068;
      				void* _v1070;
      				void* _v1072;
      				void* _v1074;
      				void* _v1076;
      				void* _v1078;
      				void* _v1082;
      				void* _v1086;
      				void* _v1090;
      				void* _v1094;
      				void* _v1098;
      				void* _v1456;
      				void* _v1478;
      				void* _v1500;
      				intOrPtr _v1828716523;
      				signed char _t934;
      				signed char _t935;
      				intOrPtr* _t937;
      				void* _t938;
      				intOrPtr* _t939;
      				intOrPtr* _t940;
      				signed int _t941;
      				intOrPtr* _t942;
      				intOrPtr* _t943;
      				intOrPtr* _t944;
      				signed int _t945;
      				signed char _t946;
      				signed char _t947;
      				intOrPtr* _t948;
      				signed int _t950;
      				intOrPtr* _t951;
      				signed char _t952;
      				signed char _t953;
      				intOrPtr* _t954;
      				intOrPtr* _t955;
      				signed char _t956;
      				intOrPtr* _t958;
      				signed char _t960;
      				intOrPtr* _t961;
      				signed int _t963;
      				signed char _t964;
      				intOrPtr* _t965;
      				signed int _t966;
      				signed int _t967;
      				intOrPtr* _t968;
      				intOrPtr* _t969;
      				intOrPtr* _t972;
      				intOrPtr* _t973;
      				intOrPtr* _t974;
      				intOrPtr* _t975;
      				void* _t977;
      				intOrPtr* _t978;
      				intOrPtr* _t979;
      				intOrPtr* _t980;
      				intOrPtr* _t981;
      				intOrPtr* _t983;
      				intOrPtr* _t984;
      				intOrPtr* _t985;
      				intOrPtr* _t987;
      				intOrPtr* _t989;
      				intOrPtr* _t990;
      				signed char _t991;
      				intOrPtr* _t992;
      				intOrPtr* _t994;
      				signed int _t995;
      				intOrPtr* _t996;
      				intOrPtr* _t997;
      				intOrPtr* _t999;
      				intOrPtr* _t1000;
      				signed int _t1001;
      				signed int _t1003;
      				signed int _t1004;
      				intOrPtr* _t1005;
      				intOrPtr* _t1006;
      				void* _t1007;
      				signed int _t1023;
      				signed int _t1024;
      				signed int _t1481;
      				signed int _t1482;
      				signed char _t1484;
      				signed char _t1485;
      				intOrPtr* _t1486;
      				signed char _t1488;
      				intOrPtr* _t1490;
      				intOrPtr* _t1492;
      				intOrPtr* _t1495;
      				void* _t1496;
      				intOrPtr* _t1497;
      				intOrPtr* _t1498;
      				intOrPtr* _t1500;
      				intOrPtr* _t1502;
      				signed int _t1504;
      				signed int _t1505;
      				signed int _t1506;
      				signed int _t1507;
      				signed char _t1508;
      				signed char _t1510;
      				signed int _t1513;
      				intOrPtr* _t1515;
      				void* _t1518;
      				intOrPtr* _t1519;
      				void* _t1522;
      				intOrPtr* _t1523;
      				intOrPtr* _t1524;
      				void* _t1532;
      				signed int* _t1537;
      				signed char _t1538;
      				intOrPtr* _t1539;
      				signed char _t1784;
      				signed char _t1785;
      				signed char _t1788;
      				void* _t1789;
      				signed int* _t1978;
      				signed char _t2003;
      				char* _t2090;
      				void* _t2098;
      				void* _t2100;
      				intOrPtr* _t2101;
      				intOrPtr _t2145;
      				signed char _t2148;
      				intOrPtr _t2149;
      				intOrPtr _t2150;
      				intOrPtr _t2166;
      				intOrPtr _t2175;
      				intOrPtr _t2176;
      
      				_t2000 = __esi;
      				_t1537 = __ecx;
      				_push("VB5!6&*"); // executed
      				L004014B2(); // executed
      				 *__eax =  *__eax + __eax;
      				 *__eax =  *__eax + __eax;
      				 *__eax =  *__eax + __eax;
      				 *__eax =  *__eax ^ __eax;
      				 *__eax =  *__eax + __eax;
      				_t934 = __eax + 1;
      				 *_t934 =  *_t934 + _t934;
      				 *_t934 =  *_t934 + _t934;
      				 *_t934 =  *_t934 + _t934;
      				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + __edx;
      				asm("fisttp word [eax-0x65]");
      				_t1516 = 0x5c7651ba;
      				asm("cmpsb");
      				 *_t934 =  *_t934 - _t934;
      				 *_t934 =  *_t934 + _t934;
      				 *_t934 =  *_t934 + _t934;
      				 *__ecx =  *__ecx + _t934;
      				 *_t934 =  *_t934 + _t934;
      				 *((intOrPtr*)(__edx)) =  *((intOrPtr*)(__edx)) + _t934;
      				_t1 = _t934 - 0x7d;
      				_t1784 =  *_t1;
      				 *_t1 = __edx;
      				_t3 =  &_a100;
      				 *_t3 = _a100 + _t1784;
      				_t2145 =  *_t3;
      				if(_t2145 < 0) {
      					if(_t2145 >= 0) {
      						asm("bound ebp, [esi+0x69]");
      						asm("outsb");
      						asm("a16 jae 0x3");
      						 *_t1784 =  *_t1784 - _t1784;
      						_t1513 = _t934 +  *_t934;
      						 *_t1513 =  *_t1513 + _t1513;
      						asm("int3");
      						 *_t1513 =  *_t1513 ^ _t1513;
      						 *__ecx =  *__ecx | _t1784;
      						asm("hlt");
      						 *0x8c30ea80 = _t1513;
      						_t2000 = __esi + 1;
      						_t1978 = 0x55de3260;
      						asm("insd");
      						 *((char*)(__ecx - 0x59)) =  *((char*)(__ecx - 0x59)) + 1;
      						asm("invalid");
      						asm("outsd");
      						asm("lodsd");
      						_t1515 = _t1513 + 1;
      						asm("stosb");
      						 *((intOrPtr*)(_t1515 - 0x2d)) =  *((intOrPtr*)(_t1515 - 0x2d)) + _t1515;
      						_t934 = 0x4f3ab413 ^  *(__ecx - 0x48ee309a);
      						_t1516 = _t1515;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      						 *_t934 =  *_t934 + _t934;
      					}
      					 *_t934 =  *_t934 + _t934;
      					 *_t934 =  *_t934 + _t934;
      					 *_t934 =  *_t934 + _t934;
      					asm("movsd");
      					 *_t934 =  *_t934 + _t934;
      				}
      				 *_t934 =  *_t934 + _t934;
      				_push(_t2000);
      				 *_t934 =  *_t934 + _t934;
      				 *_t934 =  *_t934 + _t934;
      				_t935 = _t934;
      				_t2148 = _t935;
      				asm("popad");
      				asm("outsb");
      				if(_t2148 >= 0) {
      					L13:
      					 *_t1978 =  *_t1978 + 0x48;
      					_t1978 = _t1978 + _t1978[0x4407bc1];
      					_t935 = _t935 +  *_t935;
      					 *_t1516 =  *_t1516 + 1;
      					goto L14;
      				} else {
      					if(_t2148 <= 0) {
      						L12:
      						asm("arpl [edi+0x73], bp");
      						_t935 = (_t935 ^  *[fs:eax]) + 0x80;
      						goto L13;
      					} else {
      						asm("outsb");
      						if(_t2148 < 0) {
      							L15:
      							 *_t935 =  *_t935 + _t935;
      							_t1537 = _t1537 +  *_t935;
      							 *((intOrPtr*)(_t1516 + 0x6f)) =  *((intOrPtr*)(_t1516 + 0x6f)) + _t935;
      							asm("insd");
      							asm("insd");
      							asm("popad");
      							asm("outsb");
      							 *[fs:eax] =  *[fs:eax] ^ _t935;
      							goto L16;
      						} else {
      							 *0x54000e01 =  *0x54000e01 + _t1537;
      							_t2149 =  *0x54000e01;
      							asm("a16 gs outsb");
      							asm("outsd");
      							if(_t2149 <= 0) {
      								L14:
      								 *[cs:eax] =  *[cs:eax] + _t935;
      								goto L15;
      							} else {
      								if(_t2149 < 0) {
      									L16:
      									_t935 = _t935 + 1;
      									_t2000 = _t2000 + 1;
      									_push(_t1784);
      									_push(_t1516);
      									goto L17;
      								} else {
      									 *_t935 =  *_t935 + _t935;
      									_t1784 = _t1784 + 1;
      									 *_t1784 =  *_t1784 + _t935;
      									 *((intOrPtr*)(_t1537 + _t2000)) =  *((intOrPtr*)(_t1537 + _t2000)) + _t1978[0x1d] * 0x19006e65;
      									_t14 =  &_a103;
      									 *_t14 = _a103 + _t1784;
      									_t2150 =  *_t14;
      									asm("outsb");
      									asm("outsd");
      									if(_t2150 <= 0) {
      										L17:
      										_push(_t935);
      										_push(_t1784);
      										 *((intOrPtr*)(_t935 + (_t1978 - 1 + 1) * 2)) =  *((intOrPtr*)(_t935 + (_t1978 - 1 + 1) * 2)) + _t935;
      										 *((intOrPtr*)(_t935 + 3)) =  *((intOrPtr*)(_t935 + 3)) + _t1537;
      										goto L18;
      									} else {
      										if(_t2150 < 0) {
      											L18:
      											 *_t1537 =  *_t1537 + _t1784;
      											_t937 = _t935 +  *_t935;
      											 *_t1516 =  *_t1516 + 1;
      											asm("das");
      											 *_t937 =  *_t937 + _t937;
      											 *_t1516 =  *_t1516 + _t937;
      											_t938 = _t937 + 0x78655400;
      											if(_t938 == 0) {
      												goto L23;
      											} else {
      												 *_t1784 =  *_t1784 + _t938;
      												_t1508 = _t938 + 0xf8;
      												_pop(es);
      												if (_t1508 < 0) goto L20;
      												_t1978 = 0xb01ef04;
      												asm("adc [eax], al");
      												_push(_t1516);
      												asm("popad");
      												asm("insd");
      												asm("insd");
      												asm("gs outsb");
      												_push(0x6e);
      												goto L21;
      											}
      										} else {
      											asm("sbb [eax], al");
      											_v1828716523 = _v1828716523 + _t935;
      											_push(ds);
      											 *_t935 =  *_t935 + _t935;
      											 *((intOrPtr*)(_t2000 + 3)) =  *((intOrPtr*)(_t2000 + 3)) + _t935;
      											 *_t1537 =  *_t1537 + 1;
      											_t1510 = _t935;
      											 *_t1510 =  *_t1510 + _t1510;
      											 *_t1510 =  *_t1510 + _t1537;
      											 *((intOrPtr*)(_t1516 + 0x6f)) =  *((intOrPtr*)(_t1516 + 0x6f)) + _t1510;
      											asm("insd");
      											asm("insd");
      											asm("popad");
      											asm("outsb");
      											_t1508 = (_t1510 ^  *[fs:eax]) + 0x00000001 |  *((_t1510 ^  *[fs:eax]) + 1);
      											_push(_t2000);
      											asm("popad");
      											if(_t1508 < 0) {
      												L21:
      												asm("a16 jb 0x77");
      												_t1504 = _t1508 ^  *_t1508;
      												asm("adc al, [ecx]");
      												_t1516 = _t1516 + _t1516;
      												_t2000 = _t2000 +  *_t1504;
      												 *_t1504 =  *_t1504 + _t1504;
      												_t33 = _t1504 + 0x78655400;
      												 *_t33 =  *((intOrPtr*)(_t1504 + 0x78655400)) + _t1504;
      												if( *_t33 == 0) {
      													L25:
      													 *_t1504 =  *_t1504 ^ _t1504;
      													_t1505 = _t1504 +  *_t1537;
      													 *_t1505 =  *_t1505 | _t1505;
      													_push(0x6f);
      													_push(0x73727570);
      													 *0x78 =  *0x78 + _t1505;
      													asm("cmpsd");
      													_t1506 = _t1505 | 0x04120c3f;
      													_t1518 = _t1516 + _t1516;
      													 *_t1506 =  *_t1506 + _t1506;
      													 *_t2000 =  *_t2000 + _t1506;
      													_push(es);
      													 *((intOrPtr*)(_t2000 + 0x72)) =  *((intOrPtr*)(_t2000 + 0x72)) + _t1506;
      													asm("popad");
      													asm("insd");
      													_t941 = _t1506 ^ 0x0a010300;
      													_t38 = _t1518 + 0x70;
      													 *_t38 =  *((intOrPtr*)(_t1518 + 0x70)) + _t1784;
      													_t2166 =  *_t38;
      													if(_t2166 != 0) {
      														goto L32;
      													} else {
      														if(_t2166 < 0) {
      															asm("a16 gs outsb");
      															 *0x78 =  *0x78 + _t941;
      															asm("cmpsd");
      															_t1507 = _t941 | 0x05120c3f;
      															_t1518 = _t1518 + _t1518 +  *((intOrPtr*)(_t1518 + _t1518));
      															 *_t1507 =  *_t1507 + _t1507;
      															 *_t1978 =  *_t1978 + _t1507;
      															_t1498 = _t1507 + 0x73694c00;
      															if(_t1498 == 0) {
      																goto L31;
      															} else {
      																 *_t1498 =  *_t1498 + _t1537;
      																_t939 = _t1498 + 0x80;
      																goto L29;
      															}
      															goto L32;
      														}
      													}
      												} else {
      													 *_t1784 =  *_t1784 + _t1504;
      													L23:
      													_t939 = _t938 + 0xf0;
      													 *_t939 =  *_t939 + _t1516;
      													_t1978 = 0xb01ef04;
      													asm("adc [eax], eax");
      													asm("fs insd");
      													asm("popad");
      													asm("outsb");
      													if( *_t939 >= 0) {
      														L29:
      														_pop(es);
      														 *_t1978 =  *_t1978 + 0xbf;
      														_t940 = _t939 + 0xc2;
      														 *_t1537 =  *_t1537 + _t1784;
      														_pop(es);
      														_t1518 = _t1516 + _t1516 +  *((intOrPtr*)(_t1516 + _t1516));
      														 *_t940 =  *_t940 + _t940;
      														 *_t940 =  *_t940 + _t1537;
      														_t941 = _t940 + 0x73694c00;
      														if(_t941 != 0) {
      															 *_t941 =  *_t941 + _t1537;
      															_t1497 = _t941 + 0x68;
      															 *_t1497 =  *_t1497 + _t1537;
      															_pop(es);
      															_t1978 = 0x1101c204;
      															_push(es);
      															_t1518 = _t1518 + _t1518;
      															_t1498 = _t1497 +  *((intOrPtr*)(_t1497 + _t1497));
      															 *_t2000 =  *_t2000 + _t1498;
      															 *_t1498 =  *_t1498 + _t1498;
      															L31:
      															asm("das");
      															_t1500 = _t1498 + _t1784 + 1;
      															 *_t1978 =  *_t1978 + _t1500;
      															 *_t1500 =  *_t1500 + _t1500;
      															_t1502 = _t1500 + _t1784 -  *((intOrPtr*)(_t1500 + _t1784));
      															_pop(es);
      															 *_t1502 =  *_t1502 + _t1502;
      															 *((intOrPtr*)(_t1784 +  &_a458816)) =  *((intOrPtr*)(_t1784 +  &_a458816)) + _t1537;
      															 *_t1502 =  *_t1502 + _t1502;
      															_t941 = _t1502 - 1 -  *((intOrPtr*)(_t1502 - 1));
      														}
      														L32:
      														_t942 = _t941 + 1;
      														 *_t1978 =  *_t1978 + _t942;
      														 *_t942 =  *_t942 + _t942;
      														_t943 = _t942 + _t1784;
      														 *_t943 =  *_t943 - _t943;
      													} else {
      														asm("outsb");
      														 *[ss:edx] =  *[ss:edx] + _t1784;
      														 *_t939 =  *_t939 + _t939;
      														 *_t1516 =  *_t1516 + 1;
      														 *_t939 =  *_t939 - _t939;
      														 *_t939 =  *_t939 + _t939;
      														_t1504 = _t939 + 0x72460006;
      														asm("popad");
      														asm("insd");
      														 *[gs:eax] =  *[gs:eax] ^ _t1504;
      														goto L25;
      													}
      												}
      											} else {
      												goto L12;
      											}
      										}
      									}
      								}
      							}
      						}
      					}
      				}
      				_pop(es);
      				 *_t943 =  *_t943 + _t943;
      				 *((intOrPtr*)(_t943 + 0x7004029)) =  *((intOrPtr*)(_t943 + 0x7004029)) + _t1537;
      				 *_t943 =  *_t943 + _t943;
      				 *((intOrPtr*)(_t943 + 0x29)) =  *((intOrPtr*)(_t943 + 0x29)) + _t943;
      				_t944 = _t943 + 1;
      				 *_t1978 =  *_t1978 + _t944;
      				 *_t944 =  *_t944 + _t944;
      				_t945 = _t944 + _t1518;
      				 *_t945 =  *_t945 - _t945;
      				_pop(es);
      				 *_t945 =  *_t945 + _t945;
      				 *((intOrPtr*)(_t945 +  &_a458816)) =  *((intOrPtr*)(_t945 +  &_a458816)) + _t945;
      				 *_t945 =  *_t945 + _t945;
      				_pop(_t2098);
      				 *_t945 =  *_t945 - _t945;
      				_pop(es);
      				 *_t945 =  *_t945 + _t945;
      				 *_t945 =  *_t945 + _t1537;
      				 *_t945 =  *_t945 - _t945;
      				_pop(es);
      				 *_t945 =  *_t945 + _t945;
      				_t1978[0x10958010] = _t1537 + _t1978[0x10958010];
      				_t946 = _t945 ^ 0x2a263621;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t2000 =  *_t2000 + _t1518;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				 *_t946 =  *_t946 + _t946;
      				_t947 = _t946 |  *_t946;
      				 *(_t947 + _t947) =  *(_t947 + _t947) | _t947;
      				 *_t947 =  *_t947 + _t947;
      				 *_t947 =  *_t947 + _t947;
      				 *_t947 =  *_t947 + _t947;
      				 *_t947 =  *_t947 + _t947;
      				 *((intOrPtr*)(_t1784 + _t1518 + 0x40)) =  *((intOrPtr*)(_t1784 + _t1518 + 0x40)) + _t947;
      				 *((intOrPtr*)(_t1537 + _t2000 * 8)) =  *((intOrPtr*)(_t1537 + _t2000 * 8)) + _t1518;
      				 *_t947 =  *_t947 ^ _t947;
      				_t1519 = _t1518 + _t1518;
      				asm("invalid");
      				 *_t947 =  *_t947 | _t947;
      				 *_t947 =  *_t947 + _t947;
      				 *_t947 =  *_t947 + _t947;
      				 *_t947 =  *_t947 + _t947;
      				_t948 = _t947 +  *_t947;
      				 *_t948 =  *_t948 + _t948;
      				goto 0x44017b5;
      				asm("sbb [eax], al");
      				 *_t1978 =  *_t1978 | _t1784;
      				_t950 = _t948 + 1 + _t948 + 1;
      				asm("adc al, 0x40");
      				 *_t950 =  *_t950 + _t1519;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 = es;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				_t1538 = _t1537 - 1;
      				_push(_t1784);
      				_t2100 = _t2098 + 1 - 1;
      				_push(_t1519);
      				_t2090 =  &_a1;
      				_t2003 = _t2000 - 1 + 1 - 1;
      				_push(_t1519);
      				_t67 = _t1519 + 0x6b;
      				 *_t67 =  *((intOrPtr*)(_t1519 + 0x6b)) + _t1784;
      				_t2175 =  *_t67;
      				asm("insd");
      				if(_t2175 == 0) {
      					L39:
      					 *_t950 =  *_t950 + _t950;
      					_t1978 = 0x2144c043;
      					goto L40;
      				} else {
      					asm("outsb");
      					if (_t2175 >= 0) goto L36;
      					_t69 =  &_a100;
      					 *_t69 = _a100 + _t1784;
      					_t2176 =  *_t69;
      					if(_t2176 < 0) {
      						if(_t2176 >= 0) {
      							asm("bound ebp, [esi+0x69]");
      							asm("outsb");
      							asm("a16 jae 0x3");
      							 *_t950 =  *_t950 + _t950;
      							_push(_t950);
      							 *_t950 =  *_t950 + _t950;
      							 *_t1538 =  *_t1538 + _t1784;
      							asm("hlt");
      							 *0x8c30ea80 = _t950;
      							_t2003 = _t2003 + 1;
      							_t2100 = 0xfcc8;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							asm("adc [eax+eax], al");
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							_t1784 = _t1784 + _t1519;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t950;
      							 *_t950 =  *_t950 + _t1538;
      							asm("adc eax, 0x4c0040");
      							 *_t950 =  *_t950 + _t950;
      							_push(_t950);
      							 *_t950 =  *_t950 + _t950;
      							goto L39;
      						}
      						L40:
      						_t1519 = 0;
      						_t71 = _t2003;
      						_t2003 = _t1538;
      						_t1538 = _t71;
      					}
      				}
      				asm("sbb eax, 0x944204");
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t1538 =  *_t1538 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				 *((intOrPtr*)(_t1784 + 0x191)) =  *((intOrPtr*)(_t1784 + 0x191)) + _t1538;
      				 *_t950 =  *_t950 + _t950;
      				 *((intOrPtr*)(_t1784 + _t2003 + 0x40)) =  *((intOrPtr*)(_t1784 + _t2003 + 0x40)) + _t1519;
      				 *((intOrPtr*)(_t950 + _t950 + 0x10000)) =  *((intOrPtr*)(_t950 + _t950 + 0x10000)) + _t1519;
      				 *_t950 =  *_t950 + _t950;
      				asm("enter 0x4023, 0x0");
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				_push(_t950);
      				 *_t1538 = 0xff;
      				asm("invalid");
      				 *_t950 =  *_t950 + 1;
      				 *_t950 =  *_t950 + _t950;
      				_a54 = _a54 + _t1538;
      				 *_t950 =  *_t950 + _t1519;
      				_t1785 = _t1784 + 1;
      				 *_t950 =  *_t950 + _t950;
      				 *_t950 =  *_t950 + _t950;
      				_t951 = _t950 + _t1785;
      				asm("int 0x78");
      				 *_t951 =  *_t951 + _t951;
      				 *_t951 =  *_t951 + _t951;
      				 *_t951 =  *_t951 + _t951;
      				 *_t951 =  *_t951 + _t951;
      				 *_t951 =  *_t951 + _t951;
      				 *_t951 =  *_t951 + _t951;
      				 *((intOrPtr*)(_t1538 + _t1519)) =  *((intOrPtr*)(_t1538 + _t1519)) + _t1519;
      				_t952 = _t951 + 1;
      				 *_t1538 =  *_t1538 + _t952;
      				 *_t952 =  *_t952 + _t952;
      				 *_t952 =  *_t952 + _t1785;
      				_t953 = _t952 ^  *_t952;
      				 *_t953 =  *_t953 + _t953;
      				 *_t953 =  *_t953 + _t953;
      				asm("sbb al, 0x19");
      				_t954 = _t953 + 1;
      				 *_t1538 =  *_t1538 + _t954;
      				 *_t954 =  *_t954 + _t954;
      				 *((intOrPtr*)(_t1538 + _t1519)) =  *((intOrPtr*)(_t1538 + _t1519)) + _t954;
      				_t955 = _t954 + 1;
      				 *_t955 =  *_t955 + _t955;
      				 *_t955 =  *_t955 + _t955;
      				 *_t955 =  *_t955 + _t955;
      				asm("sbb [eax], eax");
      				_t956 = _t955 +  *_t955;
      				 *_t956 =  *_t956 + _t956;
      				_t958 = (_t956 & 0x00000019) + 1;
      				 *_t958 =  *_t958 + _t958;
      				_t1978[0x1b001a00] = _t1978[0x1b001a00] + _t1785;
      				 *((intOrPtr*)(_t1538 + _t1519 + 0x40)) =  *((intOrPtr*)(_t1538 + _t1519 + 0x40)) + _t1785;
      				_t960 = _t958 + _t1519 &  *_t1785;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				asm("int3");
      				if( *_t960 < 0) {
      					 *_t960 =  *_t960 + _t960;
      					 *_t1785 =  *_t1785 ^ _t1785;
      					_t1484 = (_t960 ^  *_t960) + 1;
      					 *_t1484 =  *_t1484 + _t1484;
      					asm("adc [eax], eax");
      					_t1485 = _t1484 ^ 0x00000000;
      					 *_t1485 =  *_t1485 + _t1485;
      					 *_t2003 =  *_t2003 << 1;
      					_t1486 = _t1485 + 1;
      					 *_t1538 =  *_t1538 + _t1486;
      					 *_t1519 =  *_t1519 + _t1486;
      					 *_t1486 =  *_t1486 + _t1486;
      					 *_t1486 =  *_t1486 + _t1486;
      					 *_t1486 =  *_t1486 + _t1486;
      					 *_t1486 =  *_t1486 + _t1486;
      					 *((intOrPtr*)(_t1538 + _t1519 + 0x40)) =  *((intOrPtr*)(_t1538 + _t1519 + 0x40)) + _t1785;
      					 *_t1486 =  *_t1486 + _t1486;
      					_push(_t1519);
      					if ( *_t1486 >= 0) goto L43;
      					_t1488 = _t1486 + 0x00000001 ^  *(_t1486 + 1);
      					 *_t1488 =  *_t1488 + _t1488;
      					_t1490 = _t1488 +  *_t1488 + 1;
      					 *_t1978 =  *_t1978 + _t1519;
      					 *_t1490 =  *_t1490 + _t1519;
      					 *_t1490 =  *_t1490 + _t1490;
      					_t1492 = _t1490 + _t1538 + 1;
      					_t1532 = _t1519 + _t1519;
      					asm("invalid");
      					 *_t1492 =  *_t1492 + 1;
      					 *_t1492 =  *_t1492 + _t1492;
      					 *_t1492 =  *_t1492 + _t1492;
      					 *_t1492 =  *_t1492 + _t1492;
      					asm("sbb [eax], eax");
      					asm("adc [ebx+0x79], dl");
      					_t1495 = _t1492 + _t1785 + _t1532 + 1;
      					_t1519 = _t1532 + _t1532;
      					asm("invalid");
      					 *_t1495 =  *_t1495 + 1;
      					 *_t1495 =  *_t1495 + _t1495;
      					 *((intOrPtr*)(_t1538 + _t1519)) =  *((intOrPtr*)(_t1538 + _t1519)) + _t1495;
      					_t1496 = _t1495 + 1;
      					 *((intOrPtr*)(_t1496 + _t1519 + 0x14a00040)) =  *((intOrPtr*)(_t1496 + _t1519 + 0x14a00040)) + _t1496;
      					_t960 = _t1496 + 1;
      					 *((intOrPtr*)(_t2003 - 0x53ffbfec)) =  *((intOrPtr*)(_t2003 - 0x53ffbfec)) + _t960;
      					asm("adc al, 0x40");
      					 *_t960 =  *_t960 + _t960;
      					 *_t960 =  *_t960 + _t960;
      					 *_t960 =  *_t960 + _t960;
      					 *_t960 =  *_t960 + _t960;
      					 *_t960 =  *_t960 + _t960;
      					 *_t960 =  *_t960 + _t960;
      				}
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				 *_t960 =  *_t960 + _t960;
      				_t2101 = _t2100 - 1;
      				asm("sbb [eax], eax");
      				asm("movsb");
      				asm("sbb [eax], al");
      				_t961 =  *0xa6004014;
      				asm("adc al, 0x40");
      				 *((intOrPtr*)(_t2101 + _t1785 + 0x40)) =  *((intOrPtr*)(_t2101 + _t1785 + 0x40)) + _t1538;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				 *_t961 =  *_t961 + _t961;
      				asm("hlt");
      				 *_t961 =  *_t961 + _t961;
      				_t963 = _t961 + _t1538 &  *(_t961 + _t1538);
      				 *_t963 =  *_t963 + _t963;
      				 *_t963 =  *_t963 + _t963;
      				_t964 = _t963 + 1;
      				asm("retf 0x41");
      				 *(_t1785 + _t964 * 2) =  *(_t1785 + _t964 * 2) ^ _t1538;
      				 *((intOrPtr*)(_t1785 + _t1785)) =  *((intOrPtr*)(_t1785 + _t1785)) + _t1538;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 | _t964;
      				asm("adc al, [eax]");
      				 *_t964 =  *_t964 + _t964;
      				_t1788 = _t1785 + 1 + _t964 + 1;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t964;
      				 *_t964 =  *_t964 + _t1538;
      				_pop(ss);
      				_t965 = _t964 + 1;
      				 *((intOrPtr*)(_t965 + _t965)) =  *((intOrPtr*)(_t965 + _t965)) + _t1538;
      				 *_t965 =  *_t965 + _t965;
      				 *_t965 =  *_t965 + _t965;
      				 *_t965 =  *_t965 + _t965;
      				asm("enter 0x4023, 0x0");
      				 *_t965 =  *_t965 + _t965;
      				 *_t965 =  *_t965 + _t965;
      				 *_t1538 = 0xff;
      				asm("invalid");
      				 *_t965 =  *_t965 + 1;
      				 *_t965 =  *_t965 + _t965;
      				 *_t2101 =  *_t2101 + _t1519;
      				_t966 = _t965 + 1;
      				 *_t966 =  *_t966 + _t1538;
      				 *_t1788 =  *_t1788 & _t966;
      				_t967 = _t966 |  *_t966;
      				 *_t967 =  *_t967 + _t967;
      				asm("sbb [0x40], bl");
      				 *_t967 =  *_t967 + _t967;
      				 *_t967 =  *_t967 + _t967;
      				 *_t967 =  *_t967 + _t967;
      				 *_t967 =  *_t967 + _t967;
      				 *_t967 =  *_t967 + _t967;
      				asm("sbb [0x10040], bl");
      				 *_t967 =  *_t967 + _t967;
      				asm("adc [esi], ah");
      				_t968 = _t967 + 1;
      				 *_t968 =  *_t968 + _t968;
      				 *_t968 =  *_t968 + _t968;
      				 *((intOrPtr*)(_t2090 + _t1519 + 0x40)) =  *((intOrPtr*)(_t2090 + _t1519 + 0x40)) + _t968;
      				 *_t1538 =  *_t1538 + _t968;
      				 *_t968 =  *_t968 + _t968;
      				 *((intOrPtr*)(_t2090 + _t1519 + 0x40)) =  *((intOrPtr*)(_t2090 + _t1519 + 0x40)) + _t1538;
      				 *_t968 =  *_t968 + _t968;
      				 *_t968 =  *_t968 + _t968;
      				 *((intOrPtr*)(_t968 + 0x1d)) =  *((intOrPtr*)(_t968 + 0x1d)) + _t1538;
      				_t969 = _t968 + 1;
      				 *_t1538 =  *_t1538 + _t1538;
      				 *_t969 =  *_t969 + _t969;
      				 *((intOrPtr*)(_t2090 + _t1519 + 0x40)) =  *((intOrPtr*)(_t2090 + _t1519 + 0x40)) + _t1538;
      				 *0x6801b700 =  *0x6801b700 + _t1788;
      				 *((intOrPtr*)(_t969 + _t969 - 0x4c)) =  *((intOrPtr*)(_t969 + _t969 - 0x4c)) + _t1538;
      				_t972 = _t969 + 1 + _t1519 -  *_t1788;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *((intOrPtr*)(_t972 + 0x79)) =  *((intOrPtr*)(_t972 + 0x79)) + _t1788;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				 *_t972 =  *_t972 + _t972;
      				_t973 = _t972 + 1;
      				 *_t973 =  *_t973 + _t1788;
      				_t974 = _t973 + 1;
      				 *_t974 =  *_t974 + _t974;
      				asm("adc eax, 0x3400");
      				 *((intOrPtr*)(_t974 + 0x26)) =  *((intOrPtr*)(_t974 + 0x26)) + _t974;
      				_t975 = _t974 + 1;
      				 *_t975 =  *_t975 + _t1538;
      				 *_t1519 =  *_t1519 + _t975;
      				 *_t975 =  *_t975 + _t975;
      				 *_t975 =  *_t975 + _t975;
      				 *_t975 =  *_t975 + _t975;
      				 *_t975 =  *_t975 + _t975;
      				 *_t975 =  *_t975 + _t1538;
      				ds = ds;
      				_t977 = _t975 + 1 + _t1788;
      				_push(_t1788);
      				if (_t977 >= 0) goto L45;
      				_t978 = _t977 + 1;
      				 *_t978 =  *_t978 + _t1538;
      				 *_t1519 =  *_t1519 + _t978;
      				 *_t978 =  *_t978 + _t978;
      				asm("adc [eax], eax");
      				 *_t978 =  *_t978 + _t978;
      				 *_t2003 =  *_t2003 << 1;
      				_t979 = _t978 + 1;
      				 *_t1788 =  *_t1788 + _t979;
      				 *_t1519 =  *_t1519 + _t979;
      				 *_t979 =  *_t979 + _t979;
      				 *_t979 =  *_t979 + _t979;
      				 *_t979 =  *_t979 + _t979;
      				 *_t979 =  *_t979 + _t979;
      				 *((intOrPtr*)(_t1978 + _t1519 + 0x40)) =  *((intOrPtr*)(_t1978 + _t1519 + 0x40)) + _t1788;
      				 *_t979 =  *_t979 + _t979;
      				if ( *_t979 >= 0) goto L46;
      				asm("loopne 0x28");
      				_t980 = _t979 + 1;
      				 *_t1788 =  *_t1788 + _t980;
      				 *_t1519 =  *_t1519 + _t980;
      				 *_t980 =  *_t980 + _t980;
      				ds = _t1519;
      				 *((intOrPtr*)(_t980 + _t980)) =  *((intOrPtr*)(_t980 + _t980)) + _t1519;
      				 *_t980 =  *_t980 + _t980;
      				asm("in al, dx");
      				_t981 = _t980 + 1;
      				_t1522 = _t1519 + _t1519;
      				asm("invalid");
      				 *_t981 =  *_t981 + 1;
      				 *_t981 =  *_t981 + _t981;
      				 *_t981 =  *_t981 + _t981;
      				 *_t981 =  *_t981 + _t981;
      				ds = _t977;
      				_t983 = _t981 + _t1788 + 1;
      				 *_t983 =  *_t983 + _t1788;
      				_push(_t1522);
      				if ( *_t983 >= 0) goto L47;
      				asm("cld");
      				_t984 = _t983 + 1;
      				_t1523 = _t1522 + _t1522;
      				asm("invalid");
      				 *_t984 =  *_t984 + 1;
      				asm("adc [eax], eax");
      				_t985 = _t984 + 1;
      				 *_t985 =  *_t985 + _t985;
      				_t987 = _t985 + _t1788 + 1;
      				 *_t1538 =  *_t1538 + _t987;
      				 *_t1523 =  *_t1523 + _t987;
      				 *_t987 =  *_t987 + _t987;
      				 *_t987 =  *_t987 + _t987;
      				 *_t987 =  *_t987 + _t987;
      				 *_t987 =  *_t987 + _t987;
      				 *((intOrPtr*)(_t987 + 0x40)) =  *((intOrPtr*)(_t987 + 0x40)) + _t987;
      				 *_t987 =  *_t987 + _t987;
      				_push(_t1523);
      				if ( *_t987 >= 0) goto L48;
      				_t989 = _t987 + 0x28;
      				 *_t1538 =  *_t1538 + _t989;
      				 *_t1523 =  *_t1523 + _t989;
      				 *_t989 =  *_t989 + _t989;
      				asm("sbb [eax], al");
      				 *_t989 =  *_t989 + _t989;
      				 *_t989 =  *_t989 + _t1788;
      				asm("daa");
      				_t990 = _t989 + 1;
      				 *((intOrPtr*)(_t990 + _t990)) =  *((intOrPtr*)(_t990 + _t990)) + _t990;
      				_t991 = _t990 +  *_t990;
      				 *_t991 =  *_t991 + _t991;
      				 *_t991 =  *_t991 + _t991;
      				 *_t991 =  *_t991 + _t991;
      				 *_t991 =  *_t991 + _t991;
      				 *_t991 =  *_t991 << 0x40;
      				 *_t991 =  *_t991 + _t991;
      				_push(_t1523);
      				if ( *_t991 >= 0) goto L49;
      				 *_t1978 =  *_t1978 & _t991;
      				_t992 = _t991 + 1;
      				 *((intOrPtr*)(_t992 + _t992)) =  *((intOrPtr*)(_t992 + _t992)) + _t992;
      				_t994 = _t992 +  *_t992 + 1;
      				 *0x4800 =  *0x4800 + _t1538;
      				 *_t994 =  *_t994 + _t1538;
      				asm("daa");
      				_t995 = _t994 + 1;
      				 *0x300 =  *0x300 + _t995;
      				 *_t995 =  *_t995 + _t995;
      				 *_t995 =  *_t995 + _t995;
      				 *_t995 =  *_t995 + _t995;
      				 *_t995 =  *_t995 + _t1523;
      				 *_t995 =  *_t995 & _t995;
      				 *(_t1523 + 0x79) =  *(_t1523 + 0x79) ^ _t1788;
      				 *_t995 =  *_t995 + _t1523;
      				asm("daa");
      				_t996 = _t995 + 1;
      				 *0x40000300 =  *0x40000300 + _t996;
      				 *_t996 =  *_t996 + _t1523;
      				 *((intOrPtr*)(_t996 + _t996)) =  *((intOrPtr*)(_t996 + _t996)) + _t1538;
      				 *_t996 =  *_t996 + _t1788;
      				asm("daa");
      				_t997 = _t996 + 1;
      				 *_t1523 =  *_t1523 + _t997;
      				 *_t1523 =  *_t1523 + _t997;
      				 *_t997 =  *_t997 + _t997;
      				 *_t997 =  *_t997 + _t997;
      				 *_t997 =  *_t997 + _t997;
      				 *_t997 =  *_t997 + _t997;
      				_t156 = _t1538 + 0x53200040;
      				 *_t156 =  *((intOrPtr*)(_t1538 + 0x53200040)) + _t997;
      				if ( *_t156 >= 0) goto L50;
      				asm("daa");
      				_t999 = _t997 + 2;
      				 *_t1523 =  *_t1523 + _t999;
      				 *_t1523 =  *_t1523 + _t999;
      				 *_t999 =  *_t999 + _t999;
      				asm("adc eax, 0x5000");
      				 *((intOrPtr*)(_t999 + 0x26)) =  *((intOrPtr*)(_t999 + 0x26)) + _t999;
      				_t1000 = _t999 + 1;
      				 *_t1978 =  *_t1978 + _t1000;
      				 *_t1523 =  *_t1523 + _t1000;
      				 *_t1000 =  *_t1000 + _t1000;
      				 *_t1000 =  *_t1000 + _t1000;
      				 *_t1000 =  *_t1000 + _t1000;
      				 *_t1000 =  *_t1000 + _t1000;
      				_t1001 = _t1000 + _t1523;
      				 *_t1001 =  *_t1001 & _t1001;
      				asm("lock push edx");
      				if ( *_t1001 >= 0) goto L51;
      				asm("daa");
      				_t1003 = _t1001 - 1 + 1;
      				 *_t1978 =  *_t1978 + _t1003;
      				 *_t1523 =  *_t1523 + _t1003;
      				 *_t1003 =  *_t1003 + _t1003;
      				_t1004 = _t1003 | 0x00005400;
      				 *_t1004 =  *_t1004 + _t1538;
      				asm("daa");
      				_t1005 = _t1004 + 1;
      				 *_t2003 =  *_t2003 + _t1005;
      				 *_t1523 =  *_t1523 + _t1005;
      				 *_t1005 =  *_t1005 + _t1005;
      				 *_t1005 =  *_t1005 + _t1005;
      				 *_t1005 =  *_t1005 + _t1005;
      				 *_t1005 =  *_t1005 + _t1005;
      				 *((intOrPtr*)(_t1005 + 0x22)) =  *((intOrPtr*)(_t1005 + 0x22)) + _t1538;
      				_t1006 = _t1005 + 1;
      				 *_t1006 =  *_t1006 + _t1788;
      				if ( *_t1006 >= 0) goto L52;
      				asm("daa");
      				_t1007 = _t1006 + 1;
      				 *_t2003 =  *_t2003 + _t1007;
      				 *_t1523 =  *_t1523 + _t1007;
      				_t1789 = _t1788 + _t1788;
      				asm("lock and al, [eax]");
      				ss = _t1006;
      				 *_t2003 =  *_t2003 + _t1523;
      				_t1524 = _t1523 - 1;
      				 *_t1524 = fs;
      				 *((intOrPtr*)(_t1538 - 0x4cffbfdd)) =  *((intOrPtr*)(_t1538 - 0x4cffbfdd)) + _t1524;
      				asm("jecxz 0x24");
      				_t1539 = _t1538 + _t1524;
      				 *_t1539 =  *_t1539 + _t1789;
      				_t1023 = _t1523;
      				_t1024 = _t1023 &  *_t1023;
      				if(_t1024 >= 0) {
      					_t1978[8] = _t1978[8] + _t1524;
      					_t1481 = _t1024 + 2;
      					 *((intOrPtr*)(_t2003 - 0x3fffbfdd)) =  *((intOrPtr*)(_t2003 - 0x3fffbfdd)) + _t1481;
      					_t1482 = _t1481 &  *_t1481;
      					 *_t1482 =  *_t1482 + _t1482;
      					 *_t1482 =  *_t1482 + _t1482;
      					_t2103 = 0xffffffffc9004021;
      					asm("sbb eax, 0x1ca00040");
      					_t1024 = _t1482 + 1;
      					 *((intOrPtr*)(_t1024 - 0x59ffbfec)) =  *((intOrPtr*)(_t1024 - 0x59ffbfec)) + _t1024;
      					asm("adc al, 0x40");
      					 *((intOrPtr*)(0xc9004022 + _t1789 + 0x40)) =  *((intOrPtr*)(0xc9004022 + _t1789 + 0x40)) + _t1539;
      				}
      				asm("adc al, 0x40");
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *_t1024 =  *_t1024 + _t1024;
      				 *((intOrPtr*)(_t2090 + _t1524 + 0x40)) =  *((intOrPtr*)(_t2090 + _t1524 + 0x40)) + _t1789;
      			}









































































































































































































      0x004014b8
      0x004014b8
      0x004014b8
      0x004014bd
      0x004014c2
      0x004014c4
      0x004014c6
      0x004014c8
      0x004014ca
      0x004014cc
      0x004014cd
      0x004014cf
      0x004014d1
      0x004014d3
      0x004014da
      0x004014dd
      0x004014e2
      0x004014e3
      0x004014e5
      0x004014e7
      0x004014e9
      0x004014eb
      0x004014ed
      0x004014f0
      0x004014f0
      0x004014f0
      0x004014f3
      0x004014f3
      0x004014f3
      0x004014f6
      0x004014f8
      0x004014fa
      0x004014fd
      0x004014fe
      0x00401501
      0x00401503
      0x00401505
      0x00401509
      0x0040150a
      0x0040150c
      0x0040150e
      0x0040150f
      0x00401514
      0x00401515
      0x00401520
      0x00401521
      0x00401525
      0x00401527
      0x0040152f
      0x00401536
      0x00401538
      0x00401539
      0x0040153c
      0x0040153c
      0x0040153d
      0x0040153f
      0x00401541
      0x00401543
      0x00401545
      0x00401547
      0x00401549
      0x0040154b
      0x0040154d
      0x0040154f
      0x00401551
      0x00401553
      0x00401555
      0x00401557
      0x00401559
      0x00401559
      0x0040155b
      0x0040155d
      0x0040155f
      0x00401561
      0x00401562
      0x00401562
      0x00401563
      0x00401565
      0x00401566
      0x00401568
      0x0040156a
      0x0040156a
      0x0040156d
      0x0040156e
      0x0040156f
      0x004015dc
      0x004015dc
      0x004015df
      0x004015e5
      0x004015e7
      0x00000000
      0x00401571
      0x00401571
      0x004015d4
      0x004015d4
      0x004015db
      0x00000000
      0x00401573
      0x00401573
      0x00401574
      0x004015eb
      0x004015eb
      0x004015ed
      0x004015ef
      0x004015f2
      0x004015f3
      0x004015f4
      0x004015f5
      0x004015f6
      0x00000000
      0x00401578
      0x00401578
      0x00401578
      0x0040157e
      0x00401581
      0x00401582
      0x004015e9
      0x004015e9
      0x00000000
      0x00401584
      0x00401584
      0x004015f9
      0x004015fb
      0x004015fd
      0x00401600
      0x00401601
      0x00000000
      0x00401586
      0x0040158d
      0x0040158f
      0x00401590
      0x00401592
      0x00401595
      0x00401595
      0x00401595
      0x00401599
      0x0040159a
      0x0040159b
      0x00401602
      0x00401602
      0x00401603
      0x00401609
      0x0040160c
      0x00000000
      0x0040159d
      0x0040159d
      0x00401612
      0x00401612
      0x00401614
      0x00401616
      0x00401618
      0x00401619
      0x0040161b
      0x0040161d
      0x00401622
      0x00000000
      0x00401624
      0x00401624
      0x00401626
      0x00401628
      0x00401629
      0x0040162b
      0x00401630
      0x00401632
      0x00401633
      0x00401634
      0x00401635
      0x00401636
      0x00401638
      0x00000000
      0x0040163b
      0x0040159f
      0x004015ab
      0x004015ad
      0x004015b3
      0x004015b4
      0x004015b7
      0x004015ba
      0x004015bc
      0x004015be
      0x004015c0
      0x004015c2
      0x004015c5
      0x004015c6
      0x004015c7
      0x004015c8
      0x004015ce
      0x004015d0
      0x004015d1
      0x004015d2
      0x0040163d
      0x0040163d
      0x00401641
      0x00401643
      0x00401645
      0x00401647
      0x00401649
      0x0040164b
      0x0040164b
      0x00401652
      0x00401685
      0x00401685
      0x00401687
      0x00401689
      0x0040168b
      0x0040168d
      0x00401693
      0x00401699
      0x0040169a
      0x0040169f
      0x004016a3
      0x004016a5
      0x004016a7
      0x004016a8
      0x004016ab
      0x004016ac
      0x004016ad
      0x004016b3
      0x004016b3
      0x004016b3
      0x004016b6
      0x00000000
      0x004016b8
      0x004016b8
      0x004016ba
      0x004016be
      0x004016c4
      0x004016c5
      0x004016cc
      0x004016ce
      0x004016d0
      0x004016d2
      0x004016d7
      0x00000000
      0x004016d9
      0x004016d9
      0x004016db
      0x00000000
      0x004016db
      0x00000000
      0x004016d7
      0x004016b8
      0x00401654
      0x00401654
      0x00401656
      0x00401656
      0x00401658
      0x0040165b
      0x00401660
      0x00401663
      0x00401665
      0x00401666
      0x00401667
      0x004016dd
      0x004016dd
      0x004016de
      0x004016e1
      0x004016e3
      0x004016e5
      0x004016e8
      0x004016ea
      0x004016ec
      0x004016ee
      0x004016f3
      0x004016f5
      0x004016f7
      0x004016f9
      0x004016fb
      0x004016fc
      0x00401701
      0x00401702
      0x00401704
      0x00401707
      0x00401709
      0x0040170b
      0x0040170d
      0x0040170e
      0x0040170f
      0x00401711
      0x00401715
      0x00401718
      0x00401719
      0x0040171b
      0x00401722
      0x00401725
      0x00401725
      0x00401726
      0x00401726
      0x00401727
      0x00401729
      0x0040172b
      0x0040172d
      0x0040166a
      0x00401671
      0x00401672
      0x00401675
      0x00401677
      0x00401679
      0x0040167b
      0x0040167d
      0x00401682
      0x00401683
      0x00401684
      0x00000000
      0x00401684
      0x00401667
      0x00000000
      0x00000000
      0x00000000
      0x004015d2
      0x0040159d
      0x0040159b
      0x00401584
      0x00401582
      0x00401574
      0x00401571
      0x00401730
      0x00401731
      0x00401733
      0x00401739
      0x0040173b
      0x0040173e
      0x0040173f
      0x00401741
      0x00401743
      0x00401745
      0x00401748
      0x00401749
      0x0040174b
      0x00401752
      0x00401754
      0x00401755
      0x00401758
      0x00401759
      0x0040175b
      0x0040175d
      0x00401760
      0x00401761
      0x00401763
      0x0040176a
      0x0040176f
      0x00401771
      0x00401773
      0x00401775
      0x00401777
      0x00401779
      0x0040177b
      0x0040177e
      0x00401780
      0x00401782
      0x00401784
      0x00401786
      0x00401788
      0x0040178a
      0x0040178c
      0x0040178f
      0x00401791
      0x00401793
      0x00401795
      0x00401797
      0x0040179b
      0x0040179e
      0x004017a0
      0x004017a2
      0x004017a4
      0x004017a6
      0x004017a8
      0x004017aa
      0x004017ac
      0x004017ae
      0x004017b0
      0x004017b5
      0x004017b8
      0x004017bb
      0x004017bd
      0x004017bf
      0x004017c2
      0x004017c6
      0x004017c8
      0x004017ca
      0x004017ce
      0x004017d0
      0x004017d2
      0x004017d4
      0x004017d6
      0x004017d8
      0x004017da
      0x004017dc
      0x004017de
      0x004017e0
      0x004017e4
      0x004017e6
      0x004017e7
      0x004017e8
      0x004017e9
      0x004017ea
      0x004017eb
      0x004017eb
      0x004017eb
      0x004017ee
      0x004017ef
      0x00401856
      0x00401856
      0x00401858
      0x00000000
      0x004017f1
      0x004017f1
      0x004017f2
      0x004017f4
      0x004017f4
      0x004017f4
      0x004017f7
      0x004017f9
      0x004017fb
      0x004017fe
      0x004017ff
      0x00401802
      0x00401804
      0x00401805
      0x00401807
      0x00401809
      0x0040180a
      0x0040180f
      0x00401815
      0x0040181a
      0x0040181c
      0x0040181e
      0x00401820
      0x00401822
      0x00401824
      0x00401826
      0x00401828
      0x0040182a
      0x0040182c
      0x0040182f
      0x00401831
      0x00401833
      0x00401835
      0x00401837
      0x00401839
      0x0040183b
      0x0040183d
      0x0040183f
      0x00401841
      0x00401843
      0x00401845
      0x00401847
      0x00401849
      0x0040184b
      0x0040184d
      0x00401852
      0x00401854
      0x00401855
      0x00000000
      0x00401855
      0x0040185c
      0x00401860
      0x00401862
      0x00401862
      0x00401862
      0x00401862
      0x004017f7
      0x00401864
      0x00401869
      0x0040186b
      0x0040186d
      0x0040186f
      0x00401871
      0x00401873
      0x00401875
      0x00401877
      0x00401879
      0x0040187b
      0x00401881
      0x00401883
      0x00401885
      0x00401887
      0x00401889
      0x0040188b
      0x0040188d
      0x0040188f
      0x00401891
      0x00401893
      0x00401899
      0x0040189b
      0x0040189f
      0x004018a6
      0x004018a8
      0x004018ac
      0x004018ae
      0x004018b0
      0x004018b1
      0x004018b5
      0x004018b7
      0x004018b9
      0x004018bb
      0x004018bf
      0x004018c2
      0x004018c3
      0x004018c5
      0x004018c7
      0x004018c9
      0x004018cb
      0x004018cd
      0x004018cf
      0x004018d1
      0x004018d3
      0x004018d5
      0x004018d7
      0x004018da
      0x004018db
      0x004018dd
      0x004018df
      0x004018e1
      0x004018e4
      0x004018e6
      0x004018e8
      0x004018ea
      0x004018eb
      0x004018ed
      0x004018ef
      0x004018f2
      0x004018f3
      0x004018f5
      0x004018f7
      0x004018f9
      0x004018fc
      0x004018fe
      0x00401902
      0x00401903
      0x00401905
      0x0040190b
      0x00401911
      0x00401914
      0x00401916
      0x00401918
      0x00401919
      0x0040191b
      0x00401920
      0x00401922
      0x00401923
      0x00401926
      0x00401928
      0x0040192a
      0x0040192c
      0x0040192e
      0x0040192f
      0x00401931
      0x00401933
      0x00401935
      0x00401937
      0x00401939
      0x0040193b
      0x0040193f
      0x00401941
      0x00401942
      0x00401945
      0x00401948
      0x0040194c
      0x0040194d
      0x0040194f
      0x00401951
      0x00401955
      0x00401957
      0x00401959
      0x0040195b
      0x0040195d
      0x0040195f
      0x00401961
      0x00401965
      0x00401968
      0x0040196d
      0x0040196f
      0x00401971
      0x00401973
      0x00401975
      0x00401977
      0x0040197a
      0x0040197b
      0x00401982
      0x00401983
      0x00401989
      0x0040198b
      0x0040198d
      0x0040198f
      0x00401991
      0x00401993
      0x00401995
      0x00401995
      0x00401996
      0x00401998
      0x0040199a
      0x0040199c
      0x0040199e
      0x004019a0
      0x004019a2
      0x004019a4
      0x004019a6
      0x004019a8
      0x004019aa
      0x004019ac
      0x004019ae
      0x004019b0
      0x004019b2
      0x004019b4
      0x004019b6
      0x004019b8
      0x004019ba
      0x004019bc
      0x004019be
      0x004019c0
      0x004019c2
      0x004019c4
      0x004019c6
      0x004019c8
      0x004019ca
      0x004019cc
      0x004019ce
      0x004019d0
      0x004019d2
      0x004019d4
      0x004019d5
      0x004019d8
      0x004019d9
      0x004019dc
      0x004019e1
      0x004019e3
      0x004019ea
      0x004019ec
      0x004019ee
      0x004019f0
      0x004019f2
      0x004019f4
      0x004019f6
      0x004019f8
      0x004019fa
      0x004019fc
      0x004019fe
      0x00401a00
      0x00401a02
      0x00401a04
      0x00401a06
      0x00401a08
      0x00401a0a
      0x00401a0c
      0x00401a0e
      0x00401a10
      0x00401a12
      0x00401a14
      0x00401a16
      0x00401a18
      0x00401a1a
      0x00401a1c
      0x00401a1e
      0x00401a20
      0x00401a22
      0x00401a24
      0x00401a26
      0x00401a28
      0x00401a2a
      0x00401a2c
      0x00401a2e
      0x00401a30
      0x00401a32
      0x00401a34
      0x00401a36
      0x00401a38
      0x00401a3a
      0x00401a3c
      0x00401a3e
      0x00401a40
      0x00401a42
      0x00401a44
      0x00401a46
      0x00401a48
      0x00401a4a
      0x00401a4c
      0x00401a4e
      0x00401a50
      0x00401a52
      0x00401a54
      0x00401a56
      0x00401a58
      0x00401a5a
      0x00401a5c
      0x00401a5e
      0x00401a60
      0x00401a62
      0x00401a64
      0x00401a65
      0x00401a69
      0x00401a6c
      0x00401a6e
      0x00401a70
      0x00401a71
      0x00401a74
      0x00401a77
      0x00401a7a
      0x00401a7c
      0x00401a81
      0x00401a84
      0x00401a86
      0x00401a87
      0x00401a89
      0x00401a8b
      0x00401a8d
      0x00401a8f
      0x00401a91
      0x00401a93
      0x00401a95
      0x00401a97
      0x00401a99
      0x00401a9b
      0x00401a9d
      0x00401a9f
      0x00401aa1
      0x00401aa3
      0x00401aa5
      0x00401aa7
      0x00401aa9
      0x00401aab
      0x00401aad
      0x00401aaf
      0x00401ab1
      0x00401ab3
      0x00401ab5
      0x00401ab7
      0x00401ab9
      0x00401abb
      0x00401abd
      0x00401abf
      0x00401ac1
      0x00401ac3
      0x00401ac5
      0x00401ac7
      0x00401ac9
      0x00401acb
      0x00401acd
      0x00401acf
      0x00401ad1
      0x00401ad3
      0x00401ad5
      0x00401ad7
      0x00401ad9
      0x00401adb
      0x00401add
      0x00401adf
      0x00401ae1
      0x00401ae3
      0x00401ae5
      0x00401ae7
      0x00401ae9
      0x00401aeb
      0x00401aed
      0x00401aef
      0x00401af1
      0x00401af3
      0x00401af5
      0x00401af7
      0x00401af9
      0x00401afb
      0x00401afd
      0x00401aff
      0x00401b01
      0x00401b03
      0x00401b05
      0x00401b07
      0x00401b09
      0x00401b0b
      0x00401b0d
      0x00401b0f
      0x00401b11
      0x00401b13
      0x00401b15
      0x00401b17
      0x00401b19
      0x00401b1b
      0x00401b1d
      0x00401b1f
      0x00401b21
      0x00401b23
      0x00401b25
      0x00401b27
      0x00401b29
      0x00401b2b
      0x00401b2d
      0x00401b2f
      0x00401b31
      0x00401b33
      0x00401b35
      0x00401b37
      0x00401b39
      0x00401b3b
      0x00401b3d
      0x00401b3f
      0x00401b41
      0x00401b43
      0x00401b45
      0x00401b47
      0x00401b49
      0x00401b4b
      0x00401b4d
      0x00401b4f
      0x00401b51
      0x00401b53
      0x00401b55
      0x00401b57
      0x00401b59
      0x00401b5b
      0x00401b5d
      0x00401b5f
      0x00401b61
      0x00401b63
      0x00401b65
      0x00401b67
      0x00401b69
      0x00401b6b
      0x00401b6d
      0x00401b6f
      0x00401b71
      0x00401b73
      0x00401b75
      0x00401b77
      0x00401b79
      0x00401b7b
      0x00401b7d
      0x00401b7f
      0x00401b81
      0x00401b83
      0x00401b85
      0x00401b87
      0x00401b89
      0x00401b8b
      0x00401b8d
      0x00401b8f
      0x00401b91
      0x00401b93
      0x00401b95
      0x00401b97
      0x00401b99
      0x00401b9b
      0x00401b9d
      0x00401b9f
      0x00401ba1
      0x00401ba3
      0x00401ba5
      0x00401ba7
      0x00401ba9
      0x00401bab
      0x00401bad
      0x00401baf
      0x00401bb1
      0x00401bb3
      0x00401bb5
      0x00401bb7
      0x00401bb9
      0x00401bbb
      0x00401bbd
      0x00401bbf
      0x00401bc1
      0x00401bc3
      0x00401bc5
      0x00401bc7
      0x00401bc9
      0x00401bcb
      0x00401bcd
      0x00401bcf
      0x00401bd1
      0x00401bd3
      0x00401bd5
      0x00401bd7
      0x00401bd9
      0x00401bdb
      0x00401bdd
      0x00401bdf
      0x00401be1
      0x00401be3
      0x00401be5
      0x00401be7
      0x00401be9
      0x00401beb
      0x00401bed
      0x00401bef
      0x00401bf1
      0x00401bf3
      0x00401bf5
      0x00401bf7
      0x00401bf9
      0x00401bfb
      0x00401bfd
      0x00401bff
      0x00401c01
      0x00401c03
      0x00401c05
      0x00401c07
      0x00401c09
      0x00401c0b
      0x00401c0d
      0x00401c0f
      0x00401c11
      0x00401c13
      0x00401c15
      0x00401c17
      0x00401c19
      0x00401c1b
      0x00401c1d
      0x00401c1f
      0x00401c21
      0x00401c23
      0x00401c25
      0x00401c27
      0x00401c29
      0x00401c2b
      0x00401c2d
      0x00401c2f
      0x00401c31
      0x00401c33
      0x00401c35
      0x00401c37
      0x00401c39
      0x00401c3b
      0x00401c3d
      0x00401c3f
      0x00401c41
      0x00401c43
      0x00401c45
      0x00401c47
      0x00401c49
      0x00401c4b
      0x00401c4d
      0x00401c4f
      0x00401c51
      0x00401c53
      0x00401c55
      0x00401c57
      0x00401c59
      0x00401c5b
      0x00401c5d
      0x00401c5f
      0x00401c61
      0x00401c63
      0x00401c65
      0x00401c67
      0x00401c69
      0x00401c6b
      0x00401c6d
      0x00401c6f
      0x00401c71
      0x00401c73
      0x00401c75
      0x00401c77
      0x00401c79
      0x00401c7b
      0x00401c7d
      0x00401c7f
      0x00401c81
      0x00401c83
      0x00401c85
      0x00401c87
      0x00401c89
      0x00401c8b
      0x00401c8d
      0x00401c8f
      0x00401c91
      0x00401c93
      0x00401c95
      0x00401c97
      0x00401c99
      0x00401c9a
      0x00401c9b
      0x00401c9e
      0x00401ca0
      0x00401ca2
      0x00401ca4
      0x00401ca8
      0x00401caa
      0x00401cad
      0x00401cb1
      0x00401cb3
      0x00401cb5
      0x00401cb7
      0x00401cba
      0x00401cbb
      0x00401cbd
      0x00401cc0
      0x00401cc2
      0x00401cc4
      0x00401cca
      0x00401ccc
      0x00401cce
      0x00401cd0
      0x00401cd2
      0x00401cd4
      0x00401cda
      0x00401cdc
      0x00401cde
      0x00401cdf
      0x00401ce1
      0x00401ce3
      0x00401ce7
      0x00401ce9
      0x00401ceb
      0x00401cef
      0x00401cf1
      0x00401cf3
      0x00401cf6
      0x00401cf7
      0x00401cf9
      0x00401cfb
      0x00401cff
      0x00401d05
      0x00401d0d
      0x00401d10
      0x00401d12
      0x00401d14
      0x00401d17
      0x00401d19
      0x00401d1b
      0x00401d1d
      0x00401d1f
      0x00401d21
      0x00401d23
      0x00401d25
      0x00401d27
      0x00401d29
      0x00401d2b
      0x00401d2d
      0x00401d2f
      0x00401d31
      0x00401d33
      0x00401d35
      0x00401d37
      0x00401d39
      0x00401d3b
      0x00401d3d
      0x00401d3f
      0x00401d41
      0x00401d43
      0x00401d45
      0x00401d47
      0x00401d49
      0x00401d4b
      0x00401d4e
      0x00401d53
      0x00401d56
      0x00401d57
      0x00401d59
      0x00401d5b
      0x00401d5d
      0x00401d5f
      0x00401d61
      0x00401d63
      0x00401d65
      0x00401d67
      0x00401d69
      0x00401d6a
      0x00401d6d
      0x00401d6f
      0x00401d71
      0x00401d73
      0x00401d76
      0x00401d7a
      0x00401d7c
      0x00401d7e
      0x00401d7f
      0x00401d81
      0x00401d83
      0x00401d85
      0x00401d87
      0x00401d89
      0x00401d8b
      0x00401d8f
      0x00401d92
      0x00401d94
      0x00401d96
      0x00401d97
      0x00401d99
      0x00401d9b
      0x00401d9e
      0x00401d9f
      0x00401da2
      0x00401da4
      0x00401da5
      0x00401da7
      0x00401da9
      0x00401dab
      0x00401dad
      0x00401daf
      0x00401db1
      0x00401db5
      0x00401db6
      0x00401db7
      0x00401db9
      0x00401dba
      0x00401dbc
      0x00401dbd
      0x00401dbf
      0x00401dc1
      0x00401dc3
      0x00401dc6
      0x00401dc8
      0x00401dc9
      0x00401dcd
      0x00401dcf
      0x00401dd1
      0x00401dd3
      0x00401dd5
      0x00401dd7
      0x00401dd9
      0x00401ddb
      0x00401ddf
      0x00401de1
      0x00401de2
      0x00401de6
      0x00401de7
      0x00401de9
      0x00401deb
      0x00401dee
      0x00401df1
      0x00401df3
      0x00401df5
      0x00401df6
      0x00401df7
      0x00401dfa
      0x00401dfc
      0x00401dfe
      0x00401e00
      0x00401e02
      0x00401e04
      0x00401e07
      0x00401e09
      0x00401e0a
      0x00401e0c
      0x00401e0e
      0x00401e0f
      0x00401e14
      0x00401e15
      0x00401e1b
      0x00401e1d
      0x00401e1e
      0x00401e1f
      0x00401e25
      0x00401e27
      0x00401e29
      0x00401e2b
      0x00401e2d
      0x00401e30
      0x00401e33
      0x00401e35
      0x00401e36
      0x00401e37
      0x00401e3d
      0x00401e3f
      0x00401e43
      0x00401e45
      0x00401e46
      0x00401e47
      0x00401e49
      0x00401e4b
      0x00401e4d
      0x00401e4f
      0x00401e51
      0x00401e53
      0x00401e53
      0x00401e5a
      0x00401e5d
      0x00401e5e
      0x00401e5f
      0x00401e61
      0x00401e63
      0x00401e66
      0x00401e6b
      0x00401e6e
      0x00401e6f
      0x00401e71
      0x00401e73
      0x00401e75
      0x00401e77
      0x00401e79
      0x00401e7b
      0x00401e7d
      0x00401e80
      0x00401e82
      0x00401e85
      0x00401e86
      0x00401e87
      0x00401e89
      0x00401e8b
      0x00401e8e
      0x00401e93
      0x00401e95
      0x00401e96
      0x00401e97
      0x00401e99
      0x00401e9b
      0x00401e9d
      0x00401e9f
      0x00401ea1
      0x00401ea3
      0x00401ea6
      0x00401ea7
      0x00401eaa
      0x00401ead
      0x00401eae
      0x00401eaf
      0x00401eb1
      0x00401eb3
      0x00401eb8
      0x00401ebc
      0x00401ec3
      0x00401ec8
      0x00401ed0
      0x00401ed3
      0x00401ee4
      0x00401ee7
      0x00401eef
      0x00401ef4
      0x00401ef5
      0x00401ef8
      0x00401efb
      0x00401efe
      0x00401eff
      0x00401f05
      0x00401f08
      0x00401f0a
      0x00401f0c
      0x00401f0d
      0x00401f12
      0x00401f13
      0x00401f19
      0x00401f1b
      0x00401f1b
      0x00401f1d
      0x00401f1f
      0x00401f21
      0x00401f23
      0x00401f25
      0x00401f27
      0x00401f29
      0x00401f2b
      0x00401f2d
      0x00401f2f
      0x00401f31
      0x00401f33
      0x00401f35
      0x00401f37
      0x00401f39
      0x00401f3b
      0x00401f3d
      0x00401f3f
      0x00401f41
      0x00401f43
      0x00401f45
      0x00401f47
      0x00401f49
      0x00401f4b
      0x00401f4d
      0x00401f4f
      0x00401f51
      0x00401f53
      0x00401f55
      0x00401f57
      0x00401f59
      0x00401f5b
      0x00401f5d
      0x00401f5f
      0x00401f61
      0x00401f63
      0x00401f65
      0x00401f67
      0x00401f69
      0x00401f6b
      0x00401f6d
      0x00401f6f
      0x00401f71
      0x00401f73
      0x00401f75
      0x00401f77

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: #100
      • String ID: VB5!6&*
      • API String ID: 1341478452-3593831657
      • Opcode ID: 3525f9314be483cf7a3c4dc7fb4498066ee7b0a1868c454c80646606196fac33
      • Instruction ID: e910d88c6739f6068575334aa74ea62a2106ed0146d942afcc05dbad25008c5a
      • Opcode Fuzzy Hash: 3525f9314be483cf7a3c4dc7fb4498066ee7b0a1868c454c80646606196fac33
      • Instruction Fuzzy Hash: F5B1472244E3C19FC7138BB49EAA1A57FB0AE1321071E06DBC8C1CF5B3D22C591AD766
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      Control-flow Graph

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 004200E5
      • __vbaStrCopy.MSVBVM60 ref: 004200EF
      • #515.MSVBVM60(?,?,00000002), ref: 00420108
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 00420124
      • __vbaFreeVar.MSVBVM60 ref: 00420130
      • __vbaNew2.MSVBVM60(00402BE0,004223C0), ref: 00420151
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BD0,0000004C), ref: 00420176
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402F48,00000024), ref: 004201A4
      • __vbaStrMove.MSVBVM60 ref: 004201B3
      • __vbaFreeObj.MSVBVM60 ref: 004201BC
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 004201D5
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004201EE
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C48,00000068), ref: 0042020F
      • __vbaFreeObj.MSVBVM60 ref: 0042021E
      • __vbaFreeStr.MSVBVM60(00420267), ref: 0042025A
      • __vbaFreeStr.MSVBVM60 ref: 0042025F
      • __vbaFreeStr.MSVBVM60 ref: 00420264
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$CheckHresult$CopyNew2$#515Move
      • String ID: CAREENING$Monascidian$var
      • API String ID: 860825397-1736873049
      • Opcode ID: fb960912091c929b66dfde118a11176bbe466d068f2555cf804dc3d41748e688
      • Instruction ID: 2cbbaeb7a9d59d41bd9c0ba5d33752174a3dad07566c5e5803b5c26fb94bc657
      • Opcode Fuzzy Hash: fb960912091c929b66dfde118a11176bbe466d068f2555cf804dc3d41748e688
      • Instruction Fuzzy Hash: 6E513C71940219ABCB14DF94DE88AEEBBF8FF58701F20452AE501B72A0D7B85945CF68
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • __vbaVarDup.MSVBVM60 ref: 00420490
      • #522.MSVBVM60(?,?), ref: 0042049E
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 004204BA
      • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004204CD
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402600,00000160), ref: 00420501
      • __vbaNew2.MSVBVM60(00402BE0,004223C0), ref: 00420519
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 00420538
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00420551
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C48,00000120), ref: 00420578
      • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00420596
      • __vbaStrVarMove.MSVBVM60(00000000), ref: 004205A0
      • __vbaStrMove.MSVBVM60 ref: 004205AB
      • __vbaObjSet.MSVBVM60(?,?,00000000), ref: 004205B7
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BD0,00000040), ref: 004205D9
      • __vbaFreeStr.MSVBVM60 ref: 004205E2
      • __vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 004205F6
      • __vbaFreeVar.MSVBVM60 ref: 00420602
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0042061B
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00420634
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C48,000000E8), ref: 0042065B
      • __vbaFreeObj.MSVBVM60 ref: 0042066A
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$CheckHresult$New2$ListMove$#522CallLate
      • String ID:
      • API String ID: 3206667697-0
      • Opcode ID: fc28c8b0528bfeb91c390756a970a3c4f7da7d077f5b9220449d93422e5ba7c6
      • Instruction ID: b70f4b1ffabac8c817c8e590b77984703c67062c6539edd49cc2ffa39514a1a9
      • Opcode Fuzzy Hash: fc28c8b0528bfeb91c390756a970a3c4f7da7d077f5b9220449d93422e5ba7c6
      • Instruction Fuzzy Hash: 93611AB1900219AFCB10DFA5DD88EDEBBB8FB48300F50452AF646B72A1D7785585CF68
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 0041F9B2
      • __vbaI4Str.MSVBVM60(00402E98), ref: 0041F9BD
      • #697.MSVBVM60(00000000), ref: 0041F9C4
      • __vbaStrMove.MSVBVM60 ref: 0041F9CF
      • __vbaStrCmp.MSVBVM60(00402B90,00000000), ref: 0041F9DB
      • __vbaFreeStr.MSVBVM60 ref: 0041F9EE
      • __vbaNew2.MSVBVM60(00402BE0,004223C0), ref: 0041FA0F
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BD0,0000001C), ref: 0041FA34
      • __vbaCastObj.MSVBVM60(?,00402D74), ref: 0041FA68
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FA73
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402EB8,00000058), ref: 0041FA8D
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041FA9D
      • __vbaFreeObj.MSVBVM60(0041FAE4), ref: 0041FAD4
      • __vbaFreeStr.MSVBVM60 ref: 0041FADD
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$CheckHresult$#697CastCopyListMoveNew2
      • String ID:
      • API String ID: 1550409211-0
      • Opcode ID: 05987b28638f787618742dbbccfa736ec1f53a59140d840a184dae054206846b
      • Instruction ID: cb723a670a0a2cd8de54968e428c134e72a5afce3bef72d423e4418fe0f95ade
      • Opcode Fuzzy Hash: 05987b28638f787618742dbbccfa736ec1f53a59140d840a184dae054206846b
      • Instruction Fuzzy Hash: 7D415E71D00205ABCB04DFA5DA49ADEBBB8FF58701F10812AF546F72A0D7785985CFA8
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • #591.MSVBVM60(?), ref: 0041F869
      • __vbaStrMove.MSVBVM60 ref: 0041F874
      • __vbaStrCmp.MSVBVM60(Integer,00000000), ref: 0041F880
      • __vbaFreeStr.MSVBVM60 ref: 0041F893
      • __vbaFreeVar.MSVBVM60 ref: 0041F89C
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0041F8BA
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041F8D3
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C38,00000080), ref: 0041F8FA
      • __vbaFreeObj.MSVBVM60 ref: 0041F909
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$#591CheckHresultMoveNew2
      • String ID: Integer$KK
      • API String ID: 609433361-2898439456
      • Opcode ID: 9377c1a04747f917535759865d158975187e5c5f1b1c01a5d6ea78bbeb86c30a
      • Instruction ID: dd07fa5ec8c1c50ac1b08ff4934201b170d325ad083cda1a279e4049be3d8257
      • Opcode Fuzzy Hash: 9377c1a04747f917535759865d158975187e5c5f1b1c01a5d6ea78bbeb86c30a
      • Instruction Fuzzy Hash: B1217375940115ABCB10DFA4DE49FEEBBB8FB58701F204126E542F32A0D7785946CBA8
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • #606.MSVBVM60(00000001,?), ref: 0041FFB4
      • __vbaStrMove.MSVBVM60 ref: 0041FFBF
      • __vbaStrCmp.MSVBVM60(00402BBC,00000000), ref: 0041FFCB
      • __vbaFreeStr.MSVBVM60 ref: 0041FFDE
      • __vbaFreeVar.MSVBVM60 ref: 0041FFE7
      • __vbaNew2.MSVBVM60(00402BE0,004223C0), ref: 00420004
      • __vbaObjSetAddref.MSVBVM60(?,00401218), ref: 0042001A
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BD0,00000010), ref: 00420037
      • __vbaFreeObj.MSVBVM60 ref: 00420040
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$#606AddrefCheckHresultMoveNew2
      • String ID:
      • API String ID: 2885364696-3916222277
      • Opcode ID: 2f82c60b1764ab8b1f16873b12b6ae0cb24aa341db890317e9a0da7a0a59beb1
      • Instruction ID: 4ac2dde09c321f09e4f150c9ea65db57a84ea903549d31fa731ff983e7f33ac1
      • Opcode Fuzzy Hash: 2f82c60b1764ab8b1f16873b12b6ae0cb24aa341db890317e9a0da7a0a59beb1
      • Instruction Fuzzy Hash: AC218271900254AFCB10DFA5EE89BEEBBB4FB08704F50402AE541F31A0D7781945CF99
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • #538.MSVBVM60(?,000007DB,0000000B,0000000B), ref: 0041F711
      • #557.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F71B
      • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F738
      • #570.MSVBVM60(0000004F,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F741
      • __vbaNew2.MSVBVM60(00401CA0,00422010,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F75A
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F773
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C14,00000158), ref: 0041F79A
      • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041F7AA
      • __vbaI4Var.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F7B4
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041F7C7
      • __vbaFreeVar.MSVBVM60 ref: 0041F7D3
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$#538#557#570CallCheckHresultLateListNew2
      • String ID:
      • API String ID: 729259385-0
      • Opcode ID: 5d822ed3f6711ad9662dd4cd0a4bdb40f3c8ddf1872210169606400d5653efcc
      • Instruction ID: d08bb00182f4520d29fb08df49e4ac49d248302f35cabf10f88d44743dd01126
      • Opcode Fuzzy Hash: 5d822ed3f6711ad9662dd4cd0a4bdb40f3c8ddf1872210169606400d5653efcc
      • Instruction Fuzzy Hash: 6E318F74940244AFCB10DBA5DE89EEEB7B8FF88B00F54442AF546F71A0D7785446CB68
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 00420722
      • __vbaVarDup.MSVBVM60 ref: 0042073C
      • #528.MSVBVM60(?,?), ref: 0042074A
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 00420766
      • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00420779
      • __vbaNew2.MSVBVM60(00402BE0,004223C0), ref: 00420799
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BD0,0000001C), ref: 004207BE
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402EB8,00000050), ref: 004207DE
      • __vbaFreeObj.MSVBVM60 ref: 004207E7
      • __vbaFreeStr.MSVBVM60(0042081F), ref: 00420818
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$CheckHresult$#528CopyListNew2
      • String ID:
      • API String ID: 1123914322-0
      • Opcode ID: 772c076fd53264e6c56f338c7a98ab750987d3f508974769565aca0dc793a82d
      • Instruction ID: 00a0bbeb222e30657d83be63e4562ca13cb2f134c685671b563003c379da67a8
      • Opcode Fuzzy Hash: 772c076fd53264e6c56f338c7a98ab750987d3f508974769565aca0dc793a82d
      • Instruction Fuzzy Hash: 78313970D00249EBCB04DFA5D949ADEFBB8FF58704F10802AE511B72A0D7B86505CFA8
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 0041F4FD
      • __vbaI4Str.MSVBVM60(00402E98), ref: 0041F508
      • #698.MSVBVM60(?,00000000), ref: 0041F513
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041F52F
      • __vbaFreeVar.MSVBVM60 ref: 0041F53A
      • #569.MSVBVM60(00000068), ref: 0041F547
      • __vbaFreeStr.MSVBVM60(0041F579), ref: 0041F572
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$#569#698Copy
      • String ID: G*
      • API String ID: 3581547392-626655979
      • Opcode ID: d7927d9f80db7a035ea6a1ec7f349958bbe66e5237e0b15a43e6675ec38f88ba
      • Instruction ID: 0c557ccbd38533b07076eb7bea01fc25111cb5afb774b4eebbf25f21757565b5
      • Opcode Fuzzy Hash: d7927d9f80db7a035ea6a1ec7f349958bbe66e5237e0b15a43e6675ec38f88ba
      • Instruction Fuzzy Hash: 13114FB5C00249EBCB10DFA5CA49ADEFBB8AF48700F00C12AE512B36A0D778154ACF65
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 159 41f310-41f36f #693 161 41f462-41f495 159->161 162 41f375-41f3b3 #685 __vbaObjSet 159->162 164 41f3b5-41f3c5 __vbaNew2 162->164 165 41f3ca-41f3f0 __vbaObjSet 162->165 164->165 168 41f3f2-41f3fe __vbaHresultCheckObj 165->168 169 41f404-41f426 165->169 168->169 171 41f437-41f45f __vbaFreeObjList __vbaFreeVarList 169->171 172 41f428-41f431 __vbaHresultCheckObj 169->172 171->161 172->171
      APIs
      • #693.MSVBVM60(00402B90), ref: 0041F367
      • #685.MSVBVM60 ref: 0041F375
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041F386
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0041F3BF
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041F3D8
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,000001A8), ref: 0041F3FE
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402E84,00000044), ref: 0041F431
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041F441
      • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 0041F459
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresultList$#685#693New2
      • String ID:
      • API String ID: 587155547-0
      • Opcode ID: 8b8e16c28e6a27cf6cd747f2c5c8c2cee78beee23fb3d08a506e475cbcb79a7f
      • Instruction ID: 92a79b68bef017f3e7f9b15f6734937f8e6a9ea2238c279c37729f374f17eb8b
      • Opcode Fuzzy Hash: 8b8e16c28e6a27cf6cd747f2c5c8c2cee78beee23fb3d08a506e475cbcb79a7f
      • Instruction Fuzzy Hash: 2D4107B1D00208AFCB14DFD9C989AEEBBB8FB48700F50842AF655F7290D6785946CF65
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0041FE03
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FE1C
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C38,00000224), ref: 0041FEA3
      • __vbaFreeObj.MSVBVM60 ref: 0041FEB2
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0041FEC7
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FEE0
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,000000D0), ref: 0041FF07
      • __vbaFreeObj.MSVBVM60 ref: 0041FF16
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresultNew2
      • String ID:
      • API String ID: 1645334062-0
      • Opcode ID: 6633429b6c1d0e91bdb14259d5b5c9f0b4ef8a0ed6c4f505760edf3da248da1c
      • Instruction ID: b3975cebd18c8d2692c0a7e4e1032f1b31eebdd62b9a131ba2a1d31576707e28
      • Opcode Fuzzy Hash: 6633429b6c1d0e91bdb14259d5b5c9f0b4ef8a0ed6c4f505760edf3da248da1c
      • Instruction Fuzzy Hash: 07413D74A00214AFCB14DFA9C988E9ABBF9FF48700F10856AE945F7361D7789846CF94
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 00420893
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004208B2
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 004208CE
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004208E7
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C38,000000E8), ref: 0042090A
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,000001EC), ref: 0042094A
      • __vbaFreeStr.MSVBVM60 ref: 00420953
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00420963
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresultNew2$List
      • String ID:
      • API String ID: 2509323985-0
      • Opcode ID: 3246d6cfc775720a8fc65c9199f43a8c6781d49b8a6f206f485c3202c6a5b170
      • Instruction ID: 7b45c17897db27b4b401dac3ecdce71fbe7dde56faf159dc222690f66b0820bf
      • Opcode Fuzzy Hash: 3246d6cfc775720a8fc65c9199f43a8c6781d49b8a6f206f485c3202c6a5b170
      • Instruction Fuzzy Hash: 6E316FB0A00214AFC710DFA8DD49F9A7BF8FB48700F50856AF945F7251D6789942CBA8
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0041FC77
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FC96
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0041FCB2
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FCCB
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402C38,00000198), ref: 0041FCEE
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,000001EC), ref: 0041FD2E
      • __vbaFreeStr.MSVBVM60 ref: 0041FD37
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041FD47
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresultNew2$List
      • String ID:
      • API String ID: 2509323985-0
      • Opcode ID: 29cb3ef416d0e2b03e43cf9bbbc1add076bb5593927f0632ce3038e626cc341c
      • Instruction ID: 9b70fe1e96003b9e44419c47d771bdea6414ec941aaab590bc4141f0bffdd75f
      • Opcode Fuzzy Hash: 29cb3ef416d0e2b03e43cf9bbbc1add076bb5593927f0632ce3038e626cc341c
      • Instruction Fuzzy Hash: 02314FB4A40204ABC700DFA4DE49FDA7BB8FB48704F50442AF945F7251D6789946CBA8
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • #713.MSVBVM60(00402EA4,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F5E5
      • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F5F0
      • __vbaStrCmp.MSVBVM60(00402EB0,00000000,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F5FC
      • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F60F
      • __vbaNew2.MSVBVM60(00402BE0,004223C0,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F62C
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BD0,0000001C,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F651
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402EB8,00000050,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F671
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041F67A
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresult$#713MoveNew2
      • String ID:
      • API String ID: 1476637831-0
      • Opcode ID: 04b9cd652afe81fa44d224da4b6b90a37afe6d6a6f4f7f480536d1c0abd35bed
      • Instruction ID: 12b792d855b40e403b005202d19ca16755c66d277e0ab18d5d3170db77262008
      • Opcode Fuzzy Hash: 04b9cd652afe81fa44d224da4b6b90a37afe6d6a6f4f7f480536d1c0abd35bed
      • Instruction Fuzzy Hash: 8E21A374940214ABCB10DFA1DE49AEEBBB8FF48701F104026F541F72A0C7BC5846CB98
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • #592.MSVBVM60(?), ref: 00420362
      • __vbaFreeVar.MSVBVM60 ref: 00420379
      • __vbaNew2.MSVBVM60(00402BE0,004223C0), ref: 00420397
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BD0,0000001C), ref: 004203BC
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402EB8,00000050), ref: 004203DC
      • __vbaFreeObj.MSVBVM60 ref: 004203E5
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresult$#592New2
      • String ID:
      • API String ID: 3172800638-0
      • Opcode ID: 521d7da1b4fc35ba2a72b86468624c62b7fe03f49f6e8fbbc83c181013f0d3f9
      • Instruction ID: 6690171592b8882148dfed2da6a8c46d223ed2b5ef6b86b52d2e31a0dee83612
      • Opcode Fuzzy Hash: 521d7da1b4fc35ba2a72b86468624c62b7fe03f49f6e8fbbc83c181013f0d3f9
      • Instruction Fuzzy Hash: FA218070640264ABDB10DFA4DE49F9E7BB8AF04B04F500129E941F3291D7B85805CAA8
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaVarDup.MSVBVM60 ref: 00420ADA
      • #564.MSVBVM60(?,?), ref: 00420AE8
      • __vbaHresultCheck.MSVBVM60(00000000), ref: 00420AF3
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 00420B0F
      • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00420B21
      • #568.MSVBVM60(00000093), ref: 00420B34
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$#564#568CheckFreeHresultList
      • String ID:
      • API String ID: 1114338403-0
      • Opcode ID: d7e092af05263f1021113fc656e81b31d414b9aadbb8a0c4b0f247342e75a7b6
      • Instruction ID: 4da9e4db600a991572433c699716dc2feee13e997dede2e1d65f3ede33264ef2
      • Opcode Fuzzy Hash: d7e092af05263f1021113fc656e81b31d414b9aadbb8a0c4b0f247342e75a7b6
      • Instruction Fuzzy Hash: 492124B5800258EFDB00DFD4DA89ADDBFB8FB48B04F10811AF506BB250D7B85589CBA4
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,004012C6), ref: 004209E7
      • __vbaNew2.MSVBVM60(00401CA0,00422010,?,?,?,?,?,?,?,004012C6), ref: 00420A00
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,004012C6), ref: 00420A19
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,00000208,?,?,?,?,?,?,?,004012C6), ref: 00420A3C
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,004012C6), ref: 00420A45
      • __vbaFreeStr.MSVBVM60(00420A66,?,?,?,?,?,?,?,004012C6), ref: 00420A5F
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$Free$CheckCopyHresultNew2
      • String ID:
      • API String ID: 4138333463-0
      • Opcode ID: f50124c19ed61ff18e85c1c1f75d1ad4ad22bc78df4d88144ab3469f9e1d499e
      • Instruction ID: b5622d27c4359677797ada33c8bf4c5ff48155787cca2ff02e66c2f4dae83ebd
      • Opcode Fuzzy Hash: f50124c19ed61ff18e85c1c1f75d1ad4ad22bc78df4d88144ab3469f9e1d499e
      • Instruction Fuzzy Hash: 96119174A40204ABC710DF94DE89FAF7BB8FB58701FA04426F542F32A1D7785941CBA9
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 17%
      			E0041FB10(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				char _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v28;
      				char _v32;
      				char _v36;
      				intOrPtr _v40;
      				intOrPtr _v48;
      				intOrPtr* _t21;
      				intOrPtr* _t23;
      				intOrPtr* _t25;
      				void* _t28;
      				intOrPtr* _t30;
      				intOrPtr* _t40;
      				void* _t41;
      				void* _t43;
      				intOrPtr _t44;
      				intOrPtr _t45;
      
      				_t44 = _t43 - 0xc;
      				 *[fs:0x0] = _t44;
      				_t45 = _t44 - 0x2c;
      				_v16 = _t45;
      				_v12 = 0x4011e8;
      				_v8 = 0;
      				_t21 = _a4;
      				 *((intOrPtr*)( *_t21 + 4))(_t21, __edi, __esi, __ebx,  *[fs:0x0], 0x4012c6, _t41);
      				_t23 =  *0x422010; // 0x0
      				_v32 = 0;
      				_v28 = 0;
      				_v36 = 0;
      				if(_t23 == 0) {
      					__imp____vbaNew2(0x401ca0, 0x422010);
      					_t23 =  *0x422010; // 0x0
      				}
      				_t25 =  &_v36;
      				__imp____vbaObjSet(_t25,  *((intOrPtr*)( *_t23 + 0x318))(_t23));
      				_t30 = _t45 - 0x10;
      				 *_t30 = 0xa;
      				_t40 = _t25;
      				 *((intOrPtr*)(_t30 + 4)) = _v48;
      				 *((intOrPtr*)(_t30 + 8)) = 0x80020004;
      				 *((intOrPtr*)(_t30 + 0xc)) = _v40;
      				_t28 =  *((intOrPtr*)( *_t40 + 0x1ec))(_t40, L"Skottehistorien");
      				asm("fclex");
      				if(_t28 < 0) {
      					__imp____vbaHresultCheckObj(_t28, _t40, 0x402bf0, 0x1ec);
      				}
      				__imp____vbaFreeObj();
      				_v32 = 0x99500000;
      				_v28 = 0x4202a36b;
      				asm("wait");
      				_push(0x41fbf4);
      				return _t28;
      			}





















      0x0041fb13
      0x0041fb22
      0x0041fb29
      0x0041fb2f
      0x0041fb32
      0x0041fb3b
      0x0041fb3e
      0x0041fb44
      0x0041fb47
      0x0041fb4e
      0x0041fb51
      0x0041fb54
      0x0041fb57
      0x0041fb63
      0x0041fb69
      0x0041fb69
      0x0041fb78
      0x0041fb7c
      0x0041fb85
      0x0041fb8c
      0x0041fb91
      0x0041fb95
      0x0041fb9d
      0x0041fba9
      0x0041fbac
      0x0041fbb2
      0x0041fbb6
      0x0041fbc4
      0x0041fbc4
      0x0041fbcd
      0x0041fbd3
      0x0041fbda
      0x0041fbe1
      0x0041fbe2
      0x00000000

      APIs
      • __vbaNew2.MSVBVM60(00401CA0,00422010,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041FB63
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041FB7C
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,000001EC), ref: 0041FBC4
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041FBCD
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresultNew2
      • String ID: Skottehistorien
      • API String ID: 1645334062-3067532313
      • Opcode ID: d45a9d1b45dedcd1ed8875457b16aee8e9c3cc1d40bf0a591b8ff90b0ee9a4f6
      • Instruction ID: a326122fc203e91f7eac13fb23e2bd8e4ed6def4bfc4d5c3ffb96c3a6b3be782
      • Opcode Fuzzy Hash: d45a9d1b45dedcd1ed8875457b16aee8e9c3cc1d40bf0a591b8ff90b0ee9a4f6
      • Instruction Fuzzy Hash: 69211070A40244ABCB00DFA9C999B9EBBF9FF48700F24846AF505F7261D7789941CF98
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(00401CA0,00422010), ref: 0041F263
      • __vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041F27C
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,000001EC), ref: 0041F2C4
      • __vbaFreeObj.MSVBVM60 ref: 0041F2CD
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$CheckFreeHresultNew2
      • String ID: weet
      • API String ID: 1645334062-3595723829
      • Opcode ID: 3a87ee447952aecd24341bfff455abf8ec64acb7f408807b5c9abe5af59dae30
      • Instruction ID: 518f38394381dedc030a7db84a686587e41cd76b33d649f792057a83d706ad8c
      • Opcode Fuzzy Hash: 3a87ee447952aecd24341bfff455abf8ec64acb7f408807b5c9abe5af59dae30
      • Instruction Fuzzy Hash: E9115474A40245AFC700DF68DA49F9ABBF8FB08700F20857AF545F7291D7789445CB99
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 20%
      			E00420290(intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				intOrPtr _v24;
      				intOrPtr* _t13;
      				signed char _t14;
      				intOrPtr* _t15;
      				void* _t18;
      				void* _t23;
      				void* _t25;
      				intOrPtr _t27;
      
      				 *[fs:0x0] = _t27;
      				_v16 = _t27 - 0x18;
      				_v12 = 0x401240;
      				_v8 = 0;
      				_t13 = _a4;
      				_t14 =  *((intOrPtr*)( *_t13 + 4))(_t13, _t23, _t25, _t18,  *[fs:0x0], 0x4012c6);
      				__imp____vbaR4Str(0x402f5c);
      				asm("fcomp dword [0x401238]");
      				asm("fnstsw ax");
      				if((_t14 & 0x00000040) == 0) {
      					__imp____vbaFileOpen(0x20, 0xffffffff, 0x30, L"imprejudice");
      				}
      				_t15 = _a4;
      				 *((intOrPtr*)( *_t15 + 8))(_t15);
      				 *[fs:0x0] = _v24;
      				return _v8;
      			}














      0x004202a2
      0x004202af
      0x004202b2
      0x004202b9
      0x004202c0
      0x004202c6
      0x004202ce
      0x004202d4
      0x004202da
      0x004202df
      0x004202ec
      0x004202ec
      0x004202f2
      0x004202f8
      0x00420303
      0x0042030e

      APIs
      • __vbaR4Str.MSVBVM60(00402F5C,?,?,?,?,?,?,?,?,004012C6), ref: 004202CE
      • __vbaFileOpen.MSVBVM60(00000020,000000FF,00000030,imprejudice,?,?,?,?,?,?,?,?,004012C6), ref: 004202EC
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: __vba$FileOpen
      • String ID: imprejudice
      • API String ID: 1444369698-3142114848
      • Opcode ID: b3f964a7d45bf348c0ac4490253c20f9e85fde70aec4beaa183f42c5007a7c95
      • Instruction ID: cde836fff988ed8fed6bb44412f72af72f060ad3a4b852a4277d6bbbe716f191
      • Opcode Fuzzy Hash: b3f964a7d45bf348c0ac4490253c20f9e85fde70aec4beaa183f42c5007a7c95
      • Instruction Fuzzy Hash: 46017C75A40304EBC700DF98DA49B4ABBB8FB49B50F1082AAF945B76D0C7785940CA99
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 00420BD4
      • #532.MSVBVM60(Emotionen3), ref: 00420BE4
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.685062951.000000000041C000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.685032897.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.685047034.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000000.00000002.685074826.0000000000422000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.685085388.0000000000424000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_PC21-270421.jbxd
      Similarity
      • API ID: #532__vba
      • String ID: Emotionen3
      • API String ID: 1414456671-3255538820
      • Opcode ID: 38ab0f98b1ca00c1245c13487fa68f3488d27badeff334db2d798ebb6b2b8b0b
      • Instruction ID: 77ef66478f9ab4fbd229894c2ec9eff4c7b26162c397788644a5880288724580
      • Opcode Fuzzy Hash: 38ab0f98b1ca00c1245c13487fa68f3488d27badeff334db2d798ebb6b2b8b0b
      • Instruction Fuzzy Hash: 6FF04FB4901208ABCB00DF95DA49B9DBBF8BB08705F60411AF50176290C7B82A09CB69
      Uniqueness

      Uniqueness Score: -1.00%