Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report mU9H96igb3

Overview

General Information

Sample Name:mU9H96igb3 (renamed file extension from none to exe)
Analysis ID:502656
MD5:8777020a37b6797241a489a707b9784b
SHA1:a1ed1029b967295f9ce5e9d219f41dc6c7fc4d1a
SHA256:8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90
Tags:32exetrojan
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Potential malicious icon found
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Program does not show much activity (idle)
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • mU9H96igb3.exe (PID: 5184 cmdline: 'C:\Users\user\Desktop\mU9H96igb3.exe' MD5: 8777020A37B6797241A489A707B9784B)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://implantecapilarpereira.com/NetGen"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "http://implantecapilarpereira.com/NetGen"}
    Multi AV Scanner detection for submitted fileShow sources
    Source: mU9H96igb3.exeVirustotal: Detection: 32%Perma Link
    Source: mU9H96igb3.exeMetadefender: Detection: 25%Perma Link
    Source: mU9H96igb3.exeReversingLabs: Detection: 24%
    Machine Learning detection for sampleShow sources
    Source: mU9H96igb3.exeJoe Sandbox ML: detected
    Source: mU9H96igb3.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: http://implantecapilarpereira.com/NetGen

    System Summary:

    barindex
    Potential malicious icon foundShow sources
    Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
    Source: mU9H96igb3.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: mU9H96igb3.exe, 00000000.00000000.665404546.0000000000431000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamePattes5.exe vs mU9H96igb3.exe
    Source: mU9H96igb3.exeBinary or memory string: OriginalFilenamePattes5.exe vs mU9H96igb3.exe
    Source: mU9H96igb3.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0557A0_2_04C0557A
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C1474A0_2_04C1474A
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C000C60_2_04C000C6
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0ECDD0_2_04C0ECDD
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C100B40_2_04C100B4
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0087E0_2_04C0087E
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0E4000_2_04C0E400
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C075740_2_04C07574
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04BF4AA20_2_04BF4AA2
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C11BCE0_2_04C11BCE
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C06BF60_2_04C06BF6
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C04B8B0_2_04C04B8B
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C1130A0_2_04C1130A
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0557A NtAllocateVirtualMemory,0_2_04C0557A
    Source: C:\Users\user\Desktop\mU9H96igb3.exeProcess Stats: CPU usage > 98%
    Source: mU9H96igb3.exeVirustotal: Detection: 32%
    Source: mU9H96igb3.exeMetadefender: Detection: 25%
    Source: mU9H96igb3.exeReversingLabs: Detection: 24%
    Source: mU9H96igb3.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\mU9H96igb3.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\mU9H96igb3.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: classification engineClassification label: mal88.rans.troj.evad.winEXE@1/0@0/0

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_0041A474 push ebp; ret 0_2_0041A4CD
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_0040E9CB push ecx; retf 0_2_0040E9CC
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_004191F0 push ecx; ret 0_2_004191F1
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_004131A3 push ecx; ret 0_2_004132DD
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_004086CE push eax; retf 0_2_004086CF
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_00411ACE push ecx; ret 0_2_00411B05
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_004132DE push ecx; ret 0_2_0041331D
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_0041729D push edx; retf 0_2_004172A6
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_0040DAAA push ecx; ret 0_2_0040DAD5
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_0040E6B3 push ecx; ret 0_2_0040E6C1
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_00417AB9 push eax; ret 0_2_00417AC3
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_0040A750 push ss; retf 0_2_0040A751
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_00411B06 push ecx; ret 0_2_00411B05
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_00407B81 push esi; retf 0_2_00407B83
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C14084 push FFFFFF94h; retf 0_2_04BF2B65
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04BF1611 push esi; iretd 0_2_04BF167D
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04BF2A10 push FFFFFF94h; retf 0_2_04BF2B65
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04BF465A push ebx; retf 0_2_04BF4661
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04BF67BC push es; ret 0_2_04BF67F4
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C06BF6 push FFFFFF94h; retf 0_2_04BF2B65
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04BF1327 push esi; iretd 0_2_04BF167D
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04BF1366 push esi; iretd 0_2_04BF167D
    Source: C:\Users\user\Desktop\mU9H96igb3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

    Malware Analysis System Evasion:

    barindex
    Tries to detect virtualization through RDTSC time measurementsShow sources
    Source: C:\Users\user\Desktop\mU9H96igb3.exeRDTSC instruction interceptor: First address: 0000000004C0F8E2 second address: 0000000004C0F8E2 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 3AB33088h 0x00000007 sub eax, 03336DF3h 0x0000000c xor eax, 78D04D3Fh 0x00000011 xor eax, 4FAF8FABh 0x00000016 cpuid 0x00000018 popad 0x00000019 jmp 00007FC97CF5E8D9h 0x0000001e cmp eax, edx 0x00000020 call 00007FC97CF5E7AAh 0x00000025 lfence 0x00000028 mov edx, 337D36F1h 0x0000002d xor edx, 66E5A0A3h 0x00000033 xor edx, 9D6B538Dh 0x00000039 xor edx, B70DC5CBh 0x0000003f mov edx, dword ptr [edx] 0x00000041 lfence 0x00000044 jmp 00007FC97CF5E8DDh 0x00000049 test cl, bl 0x0000004b ret 0x0000004c sub edx, esi 0x0000004e ret 0x0000004f add edi, edx 0x00000051 dec dword ptr [ebp+000000F8h] 0x00000057 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000005e jne 00007FC97CF5E78Ch 0x00000060 call 00007FC97CF5E91Fh 0x00000065 call 00007FC97CF5E906h 0x0000006a lfence 0x0000006d mov edx, 337D36F1h 0x00000072 xor edx, 66E5A0A3h 0x00000078 xor edx, 9D6B538Dh 0x0000007e xor edx, B70DC5CBh 0x00000084 mov edx, dword ptr [edx] 0x00000086 lfence 0x00000089 jmp 00007FC97CF5E8DDh 0x0000008e test cl, bl 0x00000090 ret 0x00000091 mov esi, edx 0x00000093 pushad 0x00000094 rdtsc
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0F8DA rdtsc 0_2_04C0F8DA

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\mU9H96igb3.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0C054 mov eax, dword ptr fs:[00000030h]0_2_04C0C054
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0E990 mov eax, dword ptr fs:[00000030h]0_2_04C0E990
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C046A0 mov eax, dword ptr fs:[00000030h]0_2_04C046A0
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C11BCE mov eax, dword ptr fs:[00000030h]0_2_04C11BCE
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C0F8DA rdtsc 0_2_04C0F8DA
    Source: C:\Users\user\Desktop\mU9H96igb3.exeCode function: 0_2_04C1474A RtlAddVectoredExceptionHandler,0_2_04C1474A
    Source: mU9H96igb3.exe, 00000000.00000002.1192442091.0000000000DC0000.00000002.00020000.sdmpBinary or memory string: Program Manager
    Source: mU9H96igb3.exe, 00000000.00000002.1192442091.0000000000DC0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: mU9H96igb3.exe, 00000000.00000002.1192442091.0000000000DC0000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: mU9H96igb3.exe, 00000000.00000002.1192442091.0000000000DC0000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery21Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery11Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    mU9H96igb3.exe33%VirustotalBrowse
    mU9H96igb3.exe26%MetadefenderBrowse
    mU9H96igb3.exe24%ReversingLabsWin32.Trojan.Mucc
    mU9H96igb3.exe100%Joe Sandbox ML

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://implantecapilarpereira.com/NetGen0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://implantecapilarpereira.com/NetGentrue
    • Avira URL Cloud: safe
    		unknown

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:33.0.0 White Diamond
    Analysis ID:502656
    Start date:14.10.2021
    Start time:08:27:11
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 7m 50s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:mU9H96igb3 (renamed file extension from none to exe)
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:1
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal88.rans.troj.evad.winEXE@1/0@0/0
    EGA Information:Failed
    HDC Information:
    • Successful, ratio: 24.7% (good quality ratio 7.7%)
    • Quality average: 19.5%
    • Quality standard deviation: 31.3%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Override analysis time to 240s for sample files taking high CPU consumption
    Warnings:
    Show All
    • Excluded IPs from analysis (whitelisted): 13.107.4.50
    • Excluded domains from analysis (whitelisted): wu-shim.trafficmanager.net, ctldl.windowsupdate.com, c-0001.c-msedge.net, b1ns.c-0001.c-msedge.net, b1ns.au-msedge.net

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):4.14906794472717
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:mU9H96igb3.exe
    File size:208896
    MD5:8777020a37b6797241a489a707b9784b
    SHA1:a1ed1029b967295f9ce5e9d219f41dc6c7fc4d1a
    SHA256:8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90
    SHA512:0a9d13ca582dd72b4cdce8c91a5226aeb8c70ac7a73fa5f9775c6d03753bf7ec856371f55bf5f5e38f0a1d84e375c80916e5508f89d91e7100a82c4e544174d8
    SSDEEP:1536:tTEDegofhrRAnvzYFBWigYcgkOwijQkwY+EhBKDID:tQeZpR47YeigqVX+SK8
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L......R.....................P......|.............@........

    File Icon

    Icon Hash:20047c7c70f0e004

    Static PE Info

    General

    Entrypoint:0x40137c
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x52EAF782 [Fri Jan 31 01:08:18 2014 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:5daabd92eded5d2026efd3adb9b442c0

    Entrypoint Preview

    Instruction
    push 0040171Ch
    call 00007FC97CC9FA15h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    dec eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [ebx+79h], cl
    adc eax, EE6C2F36h
    inc ecx
    mov bh, byte ptr [ecx-19h]
    and al, 3Dh
    pop eax
    xchg eax, edi
    push 00000000h
    add byte ptr [eax], al
    add dword ptr [eax], eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    nop
    stosb
    xlatb
    add cl, byte ptr [eax+69h]
    insb
    bound esi, dword ptr fs:[edx+61h]
    outsb
    jnc 00007FC97CC9FA8Fh
    imul esp, dword ptr [ebp+64h], 41070036h
    add ah, al
    stosb
    xlatb
    add al, byte ptr [eax]
    add byte ptr [eax], al
    add bh, bh
    int3
    xor dword ptr [eax], eax
    add al, 2Ch
    xor dword ptr [esi+20h], ebp
    fcom st(0), st(0)
    movsd
    inc esi
    mov byte ptr [esi-18h], dh
    dec ebp
    adc dword ptr [edx+esi*2], 3433C456h
    cmc
    mov esi, DC9142B1h
    inc esp
    mov edx, 960E1019h
    cmp cl, byte ptr [edi-53h]
    xor ebx, dword ptr [ecx-48EE309Ah]
    or al, 00h
    stosb
    add byte ptr [eax-2Dh], ah
    xchg eax, ebx
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    test dword ptr [eax], 00510000h
    add byte ptr [eax], al
    add byte ptr [edi], al
    add byte ptr [edi+ecx*2+57h], dl
    dec ebp
    dec edi
    dec esi
    push esp
    add byte ptr [00000F01h], cl

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x2e0240x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x310000x2526.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2300x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000x10c.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x2d4840x2e000False0.23853069803data4.22024266439IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x2f0000x13ec0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x310000x25260x3000False0.168375651042data2.83539382363IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    CUSTOM0x32c680x8beMS Windows icon resource - 1 icon, 32x32EnglishUnited States
    CUSTOM0x323aa0x8beMS Windows icon resource - 1 icon, 32x32EnglishUnited States
    CUSTOM0x320ac0x2feMS Windows icon resource - 1 icon, 32x32, 4 colorsEnglishUnited States
    CUSTOM0x31dae0x2feMS Windows icon resource - 1 icon, 32x32, 4 colorsEnglishUnited States
    CUSTOM0x31ab00x2feMS Windows icon resource - 1 icon, 32x32, 4 colorsEnglishUnited States
    RT_ICON0x319800x130data
    RT_ICON0x316980x2e8data
    RT_ICON0x315700x128GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x315400x30data
    RT_VERSION0x312600x2e0dataEnglishUnited States

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaVarIdiv, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaBoolStr, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

    Version Infos

    DescriptionData
    Translation0x0409 0x04b0
    LegalCopyrightSoftware Inc.
    InternalNamePattes5
    FileVersion1.00
    CompanyNameUnions Inc.
    LegalTrademarksUnions Software
    ProductNameUnions Inc.
    ProductVersion1.00
    FileDescriptionUnions Inc.
    OriginalFilenamePattes5.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    EnglishUnited States

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    Analysis Process: mU9H96igb3.exe PID: 5184 Parent PID: 5372

    General

    Start time:08:28:08
    Start date:14/10/2021
    Path:C:\Users\user\Desktop\mU9H96igb3.exe
    Wow64 process (32bit):true
    Commandline:'C:\Users\user\Desktop\mU9H96igb3.exe'
    Imagebase:0x400000
    File size:208896 bytes
    MD5 hash:8777020A37B6797241A489A707B9784B
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Yara matches:
    • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Author: Joe Security
    Reputation:low

    Chronological Activities

    Disassembly

    Code Analysis

    Reset < >

      Analysis Process: mU9H96igb3.exe PID: 5184 Parent PID: 5372 mU9H96igb3.exeCOMMON

      Executed Functions

      Function 04C0557A, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 260memorynativeCOMMON
      Download Yara Rule
      APIs
      • NtAllocateVirtualMemory.NTDLL ref: 04C05BAE
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: _
      • API String ID: 2167126740-701932520
      • Opcode ID: 0a951bf2a667fc2ffffe84a5f486d5a5026bcc7952e377380f4c3f2a527b1682
      • Instruction ID: e1d59a970d1f66fa49fd7f29a8e79fe74f9870f216b9b31e1ee1a74f02d02e2f
      • Opcode Fuzzy Hash: 0a951bf2a667fc2ffffe84a5f486d5a5026bcc7952e377380f4c3f2a527b1682
      • Instruction Fuzzy Hash: 83A1FC31E086869FDB16EF3CDCCCEE677A6AF41724F45828C98835B04AE3715516C752
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C1474A, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 186COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: 1bU
      • API String ID: 0-1111237263
      • Opcode ID: 5d26eeb61cba4eb7f5cae6757a1faeb0780fc9a9d562307f876b6119f16c2d66
      • Instruction ID: 26ca5d8c7f02c69010b59f92b51e69c495cbbe28a7a4d8e43bbefd4f019be7e1
      • Opcode Fuzzy Hash: 5d26eeb61cba4eb7f5cae6757a1faeb0780fc9a9d562307f876b6119f16c2d66
      • Instruction Fuzzy Hash: 6D712571A04648CFDF39CE25C9987EA37B3AF86310F15411ACC4A9F264D331AB85EB46
      Uniqueness

      Uniqueness Score: -1.00%

      Function 0042AC3E, Relevance: 75.7, APIs: 42, Strings: 1, Instructions: 403COMMON
      Download Yara Rule
      C-Code - Quality: 61%
      			E0042AC3E(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				intOrPtr _v8;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v52;
				short _v56;
				void* _v60;
				void* _v64;
				short _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				char _v96;
				char _v112;
				intOrPtr _v136;
				char _v144;
				void* _v148;
				char _v152;
				signed int _v156;
				signed int _v160;
				void* _v164;
				signed int _v168;
				signed int _v192;
				intOrPtr* _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr* _v208;
				signed int _v212;
				intOrPtr* _v216;
				signed int _v220;
				signed int _v224;
				intOrPtr* _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _t239;
				signed int _t240;
				signed int _t243;
				signed int _t252;
				signed int _t259;
				char* _t263;
				void* _t266;
				signed int _t272;
				signed int _t277;
				signed int _t284;
				signed int _t288;
				signed int _t291;
				signed int _t297;
				signed int _t302;
				signed int _t309;
				void* _t338;
				void* _t340;
				intOrPtr _t341;

				_t341 = _t340 - 0x18;
				 *[fs:0x0] = _t341;
				L004011F0();
				_v28 = _t341;
				_v24 = 0x401128;
				_v20 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4011f6, _t338);
				_v8 = 1;
				_v8 = 2;
				_push(1);
				_push( &_v112);
				L00401358();
				_v136 = 0x402368;
				_v144 = 0x8008;
				_push( &_v112);
				_t239 =  &_v144;
				_push(_t239);
				L0040135E();
				_v156 = _t239;
				L00401352();
				_t240 = _v156;
				if(_t240 != 0) {
					_v8 = 3;
					if( *0x42f5b4 != 0) {
						_v196 = 0x42f5b4;
					} else {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
						_v196 = 0x42f5b4;
					}
					_v156 =  *_v196;
					_t297 =  *((intOrPtr*)( *_v156 + 0x14))(_v156,  &_v96);
					asm("fclex");
					_v160 = _t297;
					if(_v160 >= 0) {
						_v200 = _v200 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x40237c);
						_push(_v156);
						_push(_v160);
						L00401346();
						_v200 = _t297;
					}
					_v164 = _v96;
					_t302 =  *((intOrPtr*)( *_v164 + 0xb8))(_v164,  &_v148);
					asm("fclex");
					_v168 = _t302;
					if(_v168 >= 0) {
						_v204 = _v204 & 0x00000000;
					} else {
						_push(0xb8);
						_push(0x40239c);
						_push(_v164);
						_push(_v168);
						L00401346();
						_v204 = _t302;
					}
					_v68 = _v148;
					L00401340();
					_v8 = 4;
					_push(1);
					_push(1);
					_push(1);
					_push( &_v112);
					L0040132E();
					_push( &_v112);
					L00401334();
					L0040133A();
					L00401352();
					_v8 = 5;
					if( *0x42f010 != 0) {
						_v208 = 0x42f010;
					} else {
						_push(0x42f010);
						_push(0x401bac);
						L0040134C();
						_v208 = 0x42f010;
					}
					_t309 =  &_v96;
					L00401322();
					_v156 = _t309;
					_t240 =  *((intOrPtr*)( *_v156 + 0x110))(_v156,  &_v92, _t309,  *((intOrPtr*)( *((intOrPtr*)( *_v208)) + 0x304))( *_v208));
					asm("fclex");
					_v160 = _t240;
					if(_v160 >= 0) {
						_v212 = _v212 & 0x00000000;
					} else {
						_push(0x110);
						_push(0x4023ac);
						_push(_v156);
						_push(_v160);
						L00401346();
						_v212 = _t240;
					}
					_push(_v92);
					L00401328();
					L0040131C();
					L00401340();
				}
				_v8 = 7;
				_push(L"True");
				L00401316();
				if(_t240 != 0xffff) {
					_v8 = 8;
					if( *0x42f5b4 != 0) {
						_v216 = 0x42f5b4;
					} else {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
						_v216 = 0x42f5b4;
					}
					_v156 =  *_v216;
					_t272 =  *((intOrPtr*)( *_v156 + 0x14))(_v156,  &_v96);
					asm("fclex");
					_v160 = _t272;
					if(_v160 >= 0) {
						_v220 = _v220 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x40237c);
						_push(_v156);
						_push(_v160);
						L00401346();
						_v220 = _t272;
					}
					_v164 = _v96;
					_t277 =  *((intOrPtr*)( *_v164 + 0xe8))(_v164,  &_v92);
					asm("fclex");
					_v168 = _t277;
					if(_v168 >= 0) {
						_v224 = _v224 & 0x00000000;
					} else {
						_push(0xe8);
						_push(0x40239c);
						_push(_v164);
						_push(_v168);
						L00401346();
						_v224 = _t277;
					}
					_v192 = _v92;
					_v92 = _v92 & 0x00000000;
					L0040133A();
					L00401340();
					_v8 = 9;
					if( *0x42f5b4 != 0) {
						_v228 = 0x42f5b4;
					} else {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
						_v228 = 0x42f5b4;
					}
					_v156 =  *_v228;
					_t284 =  *((intOrPtr*)( *_v156 + 0x4c))(_v156,  &_v96);
					asm("fclex");
					_v160 = _t284;
					if(_v160 >= 0) {
						_v232 = _v232 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x40237c);
						_push(_v156);
						_push(_v160);
						L00401346();
						_v232 = _t284;
					}
					_v164 = _v96;
					_t288 =  *((intOrPtr*)( *_v164 + 0x28))(_v164);
					asm("fclex");
					_v168 = _t288;
					if(_v168 >= 0) {
						_v236 = _v236 & 0x00000000;
					} else {
						_push(0x28);
						_push(0x4023cc);
						_push(_v164);
						_push(_v168);
						L00401346();
						_v236 = _t288;
					}
					L00401340();
					_v8 = 0xa;
					L00401310();
					_t291 =  *((intOrPtr*)( *_a4 + 0x64))(_a4, _t288);
					asm("fclex");
					_v156 = _t291;
					if(_v156 >= 0) {
						_v240 = _v240 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x402228);
						_push(_a4);
						_push(_v156);
						L00401346();
						_v240 = _t291;
					}
				}
				_v8 = 0xc;
				_t243 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
				asm("fclex");
				_v156 = _t243;
				if(_v156 >= 0) {
					_v244 = _v244 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x402228);
					_push(_a4);
					_push(_v156);
					L00401346();
					_v244 = _t243;
				}
				_v8 = 0xd;
				 *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v148);
				_v56 = _v148;
				_v8 = 0xe;
				_t252 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v152);
				_v156 = _t252;
				if(_v156 >= 0) {
					_v248 = _v248 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x402258);
					_push(_a4);
					_push(_v156);
					L00401346();
					_v248 = _t252;
				}
				_v88 = _v152;
				_v8 = 0xf;
				 *((intOrPtr*)( *_a4 + 0x70c))(_a4);
				_v8 = 0x10;
				_t259 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4);
				_v156 = _t259;
				if(_v156 >= 0) {
					_v252 = _v252 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x402258);
					_push(_a4);
					_push(_v156);
					L00401346();
					_v252 = _t259;
				}
				_v8 = 0x11;
				L00401304();
				_v8 = 0x12;
				E0042DFA7(_t259);
				_v8 = 0x13;
				_v136 = 2;
				_v144 = 2;
				L004012FE();
				_v8 = 0x14;
				_v136 = 0x805254;
				_v144 = 3;
				L004012FE();
				_v8 = 0x15;
				_t263 =  &_v112;
				L004012F2();
				L004012F8();
				_t266 =  *((intOrPtr*)( *_a4 + 0x710))(_a4, _t263, _t263, _t263,  &_v52,  &_v84, 0xffffffff);
				_v20 = 0;
				asm("wait");
				_push(0x42b36b);
				L00401352();
				L0040131C();
				L0040131C();
				L00401352();
				return _t266;
			}




























































      0x0042ac41
      0x0042ac50
      0x0042ac5c
      0x0042ac64
      0x0042ac67
      0x0042ac74
      0x0042ac7d
      0x0042ac80
      0x0042ac8f
      0x0042ac92
      0x0042ac99
      0x0042aca0
      0x0042aca5
      0x0042aca6
      0x0042acab
      0x0042acb5
      0x0042acc2
      0x0042acc3
      0x0042acc9
      0x0042acca
      0x0042accf
      0x0042acd9
      0x0042acde
      0x0042ace7
      0x0042aced
      0x0042acfb
      0x0042ad18
      0x0042acfd
      0x0042acfd
      0x0042ad02
      0x0042ad07
      0x0042ad0c
      0x0042ad0c
      0x0042ad2a
      0x0042ad42
      0x0042ad45
      0x0042ad47
      0x0042ad54
      0x0042ad76
      0x0042ad56
      0x0042ad56
      0x0042ad58
      0x0042ad5d
      0x0042ad63
      0x0042ad69
      0x0042ad6e
      0x0042ad6e
      0x0042ad80
      0x0042ad9b
      0x0042ada1
      0x0042ada3
      0x0042adb0
      0x0042add5
      0x0042adb2
      0x0042adb2
      0x0042adb7
      0x0042adbc
      0x0042adc2
      0x0042adc8
      0x0042adcd
      0x0042adcd
      0x0042ade3
      0x0042adea
      0x0042adef
      0x0042adf6
      0x0042adf8
      0x0042adfa
      0x0042adff
      0x0042ae00
      0x0042ae08
      0x0042ae09
      0x0042ae13
      0x0042ae1b
      0x0042ae20
      0x0042ae2e
      0x0042ae4b
      0x0042ae30
      0x0042ae30
      0x0042ae35
      0x0042ae3a
      0x0042ae3f
      0x0042ae3f
      0x0042ae6f
      0x0042ae73
      0x0042ae78
      0x0042ae90
      0x0042ae96
      0x0042ae98
      0x0042aea5
      0x0042aeca
      0x0042aea7
      0x0042aea7
      0x0042aeac
      0x0042aeb1
      0x0042aeb7
      0x0042aebd
      0x0042aec2
      0x0042aec2
      0x0042aed1
      0x0042aed4
      0x0042aedc
      0x0042aee4
      0x0042aee4
      0x0042aee9
      0x0042aef0
      0x0042aef5
      0x0042aefe
      0x0042af04
      0x0042af12
      0x0042af2f
      0x0042af14
      0x0042af14
      0x0042af19
      0x0042af1e
      0x0042af23
      0x0042af23
      0x0042af41
      0x0042af59
      0x0042af5c
      0x0042af5e
      0x0042af6b
      0x0042af8d
      0x0042af6d
      0x0042af6d
      0x0042af6f
      0x0042af74
      0x0042af7a
      0x0042af80
      0x0042af85
      0x0042af85
      0x0042af97
      0x0042afaf
      0x0042afb5
      0x0042afb7
      0x0042afc4
      0x0042afe9
      0x0042afc6
      0x0042afc6
      0x0042afcb
      0x0042afd0
      0x0042afd6
      0x0042afdc
      0x0042afe1
      0x0042afe1
      0x0042aff3
      0x0042aff9
      0x0042b006
      0x0042b00e
      0x0042b013
      0x0042b021
      0x0042b03e
      0x0042b023
      0x0042b023
      0x0042b028
      0x0042b02d
      0x0042b032
      0x0042b032
      0x0042b050
      0x0042b068
      0x0042b06b
      0x0042b06d
      0x0042b07a
      0x0042b09c
      0x0042b07c
      0x0042b07c
      0x0042b07e
      0x0042b083
      0x0042b089
      0x0042b08f
      0x0042b094
      0x0042b094
      0x0042b0a6
      0x0042b0ba
      0x0042b0bd
      0x0042b0bf
      0x0042b0cc
      0x0042b0ee
      0x0042b0ce
      0x0042b0ce
      0x0042b0d0
      0x0042b0d5
      0x0042b0db
      0x0042b0e1
      0x0042b0e6
      0x0042b0e6
      0x0042b0f8
      0x0042b0fd
      0x0042b10a
      0x0042b118
      0x0042b11b
      0x0042b11d
      0x0042b12a
      0x0042b149
      0x0042b12c
      0x0042b12c
      0x0042b12e
      0x0042b133
      0x0042b136
      0x0042b13c
      0x0042b141
      0x0042b141
      0x0042b12a
      0x0042b150
      0x0042b15f
      0x0042b165
      0x0042b167
      0x0042b174
      0x0042b196
      0x0042b176
      0x0042b176
      0x0042b17b
      0x0042b180
      0x0042b183
      0x0042b189
      0x0042b18e
      0x0042b18e
      0x0042b19d
      0x0042b1b3
      0x0042b1c0
      0x0042b1c4
      0x0042b1da
      0x0042b1e0
      0x0042b1ed
      0x0042b20f
      0x0042b1ef
      0x0042b1ef
      0x0042b1f4
      0x0042b1f9
      0x0042b1fc
      0x0042b202
      0x0042b207
      0x0042b207
      0x0042b21c
      0x0042b21f
      0x0042b22e
      0x0042b234
      0x0042b243
      0x0042b249
      0x0042b256
      0x0042b278
      0x0042b258
      0x0042b258
      0x0042b25d
      0x0042b262
      0x0042b265
      0x0042b26b
      0x0042b270
      0x0042b270
      0x0042b27f
      0x0042b288
      0x0042b28d
      0x0042b294
      0x0042b299
      0x0042b2a0
      0x0042b2aa
      0x0042b2bd
      0x0042b2c2
      0x0042b2c9
      0x0042b2d3
      0x0042b2e6
      0x0042b2eb
      0x0042b2fa
      0x0042b2fe
      0x0042b304
      0x0042b312
      0x0042b318
      0x0042b31f
      0x0042b320
      0x0042b34d
      0x0042b355
      0x0042b35d
      0x0042b365
      0x0042b36a

      APIs
      • __vbaChkstk.MSVBVM60(?,004011F6), ref: 0042AC5C
      • #526.MSVBVM60(?,00000001,?,?,?,?,004011F6), ref: 0042ACA6
      • __vbaVarTstNe.MSVBVM60(00008008,?), ref: 0042ACCA
      • __vbaFreeVar.MSVBVM60(00008008,?), ref: 0042ACD9
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4,00008008,?), ref: 0042AD07
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040237C,00000014,?,?,?,?,?,?,?,?,?,?,?,00008008), ref: 0042AD69
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040239C,000000B8,?,?,?,?,?,?,?,?,?,?,?,00008008), ref: 0042ADC8
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0042ADEA
      • #539.MSVBVM60(?,00000001,00000001,00000001), ref: 0042AE00
      • __vbaStrVarMove.MSVBVM60(?,?,00000001,00000001,00000001), ref: 0042AE09
      • __vbaStrMove.MSVBVM60(?,?,00000001,00000001,00000001), ref: 0042AE13
      • __vbaFreeVar.MSVBVM60(?,?,00000001,00000001,00000001), ref: 0042AE1B
      • __vbaNew2.MSVBVM60(00401BAC,0042F010,?,?,00000001,00000001,00000001), ref: 0042AE3A
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00008008), ref: 0042AE73
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004023AC,00000110), ref: 0042AEBD
      • #532.MSVBVM60(?), ref: 0042AED4
      • __vbaFreeStr.MSVBVM60(?), ref: 0042AEDC
      • __vbaFreeObj.MSVBVM60(?), ref: 0042AEE4
      • __vbaBoolStr.MSVBVM60(True,00008008,?), ref: 0042AEF5
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4,True,00008008,?), ref: 0042AF1E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040237C,00000014), ref: 0042AF80
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040239C,000000E8), ref: 0042AFDC
      • __vbaStrMove.MSVBVM60(00000000,?,0040239C,000000E8), ref: 0042B006
      • __vbaFreeObj.MSVBVM60(00000000,?,0040239C,000000E8), ref: 0042B00E
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4), ref: 0042B02D
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040237C,0000004C), ref: 0042B08F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004023CC,00000028), ref: 0042B0E1
      • __vbaFreeObj.MSVBVM60(00000000,?,004023CC,00000028), ref: 0042B0F8
      • __vbaFpI4.MSVBVM60(00000000,?,004023CC,00000028), ref: 0042B10A
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402228,00000064), ref: 0042B13C
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402228,000002B4), ref: 0042B189
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402258,000006F8), ref: 0042B202
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402258,000006FC), ref: 0042B26B
      • __vbaOnError.MSVBVM60(000000FF), ref: 0042B288
      • __vbaVarMove.MSVBVM60(000000FF), ref: 0042B2BD
      • __vbaVarMove.MSVBVM60(000000FF), ref: 0042B2E6
      • __vbaVarIdiv.MSVBVM60(?,00000001,?,000000FF), ref: 0042B2FE
      • __vbaI4Var.MSVBVM60(00000000,?,00000001,?,000000FF), ref: 0042B304
      • __vbaFreeVar.MSVBVM60(0042B36B), ref: 0042B34D
      • __vbaFreeStr.MSVBVM60(0042B36B), ref: 0042B355
      • __vbaFreeStr.MSVBVM60(0042B36B), ref: 0042B35D
      • __vbaFreeVar.MSVBVM60(0042B36B), ref: 0042B365
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1191724406.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1191719786.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191812090.000000000042F000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191818167.0000000000431000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckFreeHresult$Move$New2$#526#532#539BoolChkstkErrorIdiv
      • String ID: True
      • API String ID: 184932235-1573839795
      • Opcode ID: 341ca83123d38b726386d7389c190aaa7447f3007f861a4ac4cbfcb76b49abc8
      • Instruction ID: 69da50e412ea75792312df9287793d50fe00ff02032f5454a44a827cca003f6d
      • Opcode Fuzzy Hash: 341ca83123d38b726386d7389c190aaa7447f3007f861a4ac4cbfcb76b49abc8
      • Instruction Fuzzy Hash: 1D12E670A00228EFDB20DFA0DD45B9DBBB4BF05304F5080EAE509BB2A1D7785A99DF55
      Uniqueness

      Uniqueness Score: -1.00%

      Function 0042B56A, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 93COMMON
      Download Yara Rule
      C-Code - Quality: 60%
      			E0042B56A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v36;
				void* _v44;
				char _v60;
				char* _v68;
				char _v76;
				char _v80;
				intOrPtr* _t30;
				char* _t32;
				void* _t34;
				intOrPtr* _t35;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;
				void* _t59;
				intOrPtr _t60;
				intOrPtr _t64;

				_t60 = _t59 - 0xc;
				 *[fs:0x0] = _t60;
				_v16 = _t60 - 0x50;
				_v12 = 0x4011b0;
				_v8 = 0;
				_t30 = _a4;
				 *((intOrPtr*)( *_t30 + 4))(_t30, __edi, __esi, __ebx,  *[fs:0x0], 0x4011f6, _t57);
				_v76 = 0;
				_v28 = 0;
				_v36 = 0;
				_v44 = 0;
				_v60 = 0;
				_v80 = 0;
				_v68 = L"6/6/6";
				_v76 = 8;
				L004012CE();
				_t32 =  &_v60;
				_push(_t32);
				L004012D4(); // executed
				L00401352();
				if( ~(0 | _t32 != 0x0000ffff) != 0) {
					_push(0);
					_push(0);
					_push(1);
					L004012C8();
					L0040133A();
					_t64 =  *0x42f5b4; // 0x223eda4
					if(_t64 == 0) {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
					}
					_t55 =  *0x42f5b4; // 0x223eda4
					_t34 =  *((intOrPtr*)( *_t55 + 0x14))(_t55,  &_v44);
					asm("fclex");
					if(_t34 < 0) {
						_push(0x14);
						_push(0x40237c);
						_push(_t55);
						_push(_t34);
						L00401346();
					}
					_t35 = _v44;
					_t56 = _t35;
					_t32 =  *((intOrPtr*)( *_t35 + 0x70))(_t35,  &_v80);
					asm("fclex");
					if(_t32 < 0) {
						_push(0x70);
						_push(0x40239c);
						_push(_t56);
						_push(_t32);
						L00401346();
					}
					L00401340();
					_push(0x50);
					L004012C2();
				}
				_v36 = 0x6c82cc;
				_push(0x42b69c);
				L0040131C();
				return _t32;
			}























      0x0042b56d
      0x0042b57c
      0x0042b589
      0x0042b58c
      0x0042b595
      0x0042b598
      0x0042b59e
      0x0042b5a1
      0x0042b5aa
      0x0042b5ad
      0x0042b5b0
      0x0042b5b3
      0x0042b5b6
      0x0042b5b9
      0x0042b5c0
      0x0042b5c7
      0x0042b5cc
      0x0042b5cf
      0x0042b5d0
      0x0042b5e6
      0x0042b5ee
      0x0042b5f4
      0x0042b5f5
      0x0042b5f6
      0x0042b5f8
      0x0042b602
      0x0042b607
      0x0042b60d
      0x0042b60f
      0x0042b614
      0x0042b619
      0x0042b619
      0x0042b61e
      0x0042b62b
      0x0042b62e
      0x0042b632
      0x0042b634
      0x0042b636
      0x0042b63b
      0x0042b63c
      0x0042b63d
      0x0042b63d
      0x0042b642
      0x0042b64c
      0x0042b64e
      0x0042b651
      0x0042b655
      0x0042b657
      0x0042b659
      0x0042b65e
      0x0042b65f
      0x0042b660
      0x0042b660
      0x0042b668
      0x0042b66d
      0x0042b66f
      0x0042b66f
      0x0042b674
      0x0042b67b
      0x0042b696
      0x0042b69b

      APIs
      • __vbaVarDup.MSVBVM60 ref: 0042B5C7
      • #557.MSVBVM60(?), ref: 0042B5D0
      • __vbaFreeVar.MSVBVM60(?), ref: 0042B5E6
      • #706.MSVBVM60(00000001,00000000,00000000,?), ref: 0042B5F8
      • __vbaStrMove.MSVBVM60(00000001,00000000,00000000,?), ref: 0042B602
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4,00000001,00000000,00000000,?), ref: 0042B619
      • __vbaHresultCheckObj.MSVBVM60(00000000,0223EDA4,0040237C,00000014), ref: 0042B63D
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040239C,00000070), ref: 0042B660
      • __vbaFreeObj.MSVBVM60(00000000,?,0040239C,00000070), ref: 0042B668
      • #568.MSVBVM60(00000050), ref: 0042B66F
      • __vbaFreeStr.MSVBVM60(0042B69C,?), ref: 0042B696
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1191724406.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1191719786.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191812090.000000000042F000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191818167.0000000000431000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresult$#557#568#706MoveNew2
      • String ID: 6/6/6
      • API String ID: 2852487234-3981586821
      • Opcode ID: fe552b38c71a01a0ad5f5299f35e47a8982bf7555799bb975f3d1df285c53d6d
      • Instruction ID: 712bf853cff5dfd8145d8f0bfec23aa8ccb555fdc4f873a6ce82290e0030f978
      • Opcode Fuzzy Hash: fe552b38c71a01a0ad5f5299f35e47a8982bf7555799bb975f3d1df285c53d6d
      • Instruction Fuzzy Hash: 78316F70900208ABCB10EFA5C946EDEBBB8EF54704F54412FF500B72E1DBB854458A59
      Uniqueness

      Uniqueness Score: -1.00%

      Function 0042DDBB, Relevance: 10.6, APIs: 7, Instructions: 91COMMON
      Download Yara Rule
      C-Code - Quality: 47%
      			E0042DDBB(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				char _v72;
				void* _t25;
				void* _t28;
				intOrPtr _t32;
				void* _t34;
				intOrPtr* _t36;
				void* _t50;
				intOrPtr _t52;

				 *[fs:0x0] = _t52;
				_v12 = _t52 - 0x3c;
				_v8 = 0x4011e0;
				_t36 = _a4;
				_v24 = 0;
				_v36 = 0;
				_v72 = 0;
				L00401286();
				_t25 =  *((intOrPtr*)( *_t36 + 0x58))(_t36,  &_v72,  &_v24, _t36, __edi, __esi, __ebx,  *[fs:0x0], 0x4011f6, __ecx, __ecx, _t50);
				asm("fclex");
				if(_t25 < 0) {
					_push(0x58);
					_push(0x402228);
					_push(_t36);
					_push(_t25);
					L00401346();
				}
				L00401286();
				L00401280();
				_t28 = E0042DF16( &_v36);
				L00401340();
				E0042DF64(E0042DF16(_t28) + 0x2b0, _a8);
				_t32 = 0xa;
				_v68 = _t32;
				_v60 = 0x80020004;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v52 = _t32;
				_v44 = 0x80020004;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd"); // executed
				_t34 =  *((intOrPtr*)( *_t36 + 0x2b0))(_t36,  &_v36,  &_v36, _t36);
				asm("fclex");
				if(_t34 < 0) {
					_push(0x2b0);
					_push(0x402228);
					_push(_t36);
					_push(_t34);
					L00401346();
				}
				_push(0x42deb5);
				L00401340();
				return _t34;
			}



















      0x0042ddcc
      0x0042ddd9
      0x0042dddc
      0x0042dde3
      0x0042dded
      0x0042ddf0
      0x0042ddf3
      0x0042ddf6
      0x0042de02
      0x0042de05
      0x0042de09
      0x0042de0b
      0x0042de0d
      0x0042de12
      0x0042de13
      0x0042de14
      0x0042de14
      0x0042de1e
      0x0042de27
      0x0042de2d
      0x0042de37
      0x0042de4b
      0x0042de52
      0x0042de56
      0x0042de5e
      0x0042de66
      0x0042de67
      0x0042de68
      0x0042de69
      0x0042de6a
      0x0042de72
      0x0042de7a
      0x0042de7b
      0x0042de7c
      0x0042de7e
      0x0042de7f
      0x0042de87
      0x0042de89
      0x0042de8b
      0x0042de90
      0x0042de95
      0x0042de96
      0x0042de97
      0x0042de97
      0x0042de9c
      0x0042deaf
      0x0042deb4

      APIs
      • __vbaObjSetAddref.MSVBVM60(?,?), ref: 0042DDF6
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402228,00000058), ref: 0042DE14
      • __vbaObjSetAddref.MSVBVM60(?,?), ref: 0042DE1E
      • #644.MSVBVM60(?,?,?), ref: 0042DE27
      • __vbaFreeObj.MSVBVM60(00000000,?,?,?), ref: 0042DE37
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402228,000002B0), ref: 0042DE97
      • __vbaFreeObj.MSVBVM60(0042DEB5), ref: 0042DEAF
      Memory Dump Source
      • Source File: 00000000.00000002.1191724406.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1191719786.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191812090.000000000042F000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191818167.0000000000431000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$AddrefCheckFreeHresult$#644
      • String ID:
      • API String ID: 2435434276-0
      • Opcode ID: 53607bf75bc99b23afeb9da8c1bc90f2403e677190e0153709e265634757d4bb
      • Instruction ID: 90da51dd7aceaa3823aed1aeb58183574e6596ec788cb56faabdec89c21cb11b
      • Opcode Fuzzy Hash: 53607bf75bc99b23afeb9da8c1bc90f2403e677190e0153709e265634757d4bb
      • Instruction Fuzzy Hash: AF218FB1D00628ABCB01EFA9DD86E9F77BCEF08704F10051EF800BB191D778A90486A9
      Uniqueness

      Uniqueness Score: -1.00%

      Function 0040137C, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 196COMMON
      Download Yara Rule
      C-Code - Quality: 87%
      			_entry_(signed int __eax, void* __ebx, void* __ecx, char __edx, signed char __edi, void* __esi, void* __fp0, intOrPtr* _a8, signed int _a89, signed int _a100, char _a120, intOrPtr _a1409302559) {
				char _v1;
				char _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				void* _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				void* _v44;
				char _v56;
				char* _v64;
				char _v72;
				char _v76;
				char _v80;
				signed char _v394885050;
				intOrPtr* _t306;
				intOrPtr* _t308;
				signed char _t311;
				intOrPtr* _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				intOrPtr* _t317;
				intOrPtr* _t321;
				intOrPtr* _t323;
				intOrPtr* _t325;
				intOrPtr* _t328;
				intOrPtr* _t329;
				intOrPtr* _t330;
				signed char _t331;
				signed char _t332;
				intOrPtr* _t333;
				signed char _t335;
				intOrPtr* _t336;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed char _t340;
				signed int _t341;
				signed char _t342;
				intOrPtr* _t343;
				void* _t344;
				intOrPtr* _t345;
				intOrPtr* _t346;
				signed int _t349;
				signed int _t350;
				signed int _t351;
				signed int _t352;
				intOrPtr* _t353;
				intOrPtr* _t367;
				intOrPtr* _t368;
				intOrPtr* _t369;
				intOrPtr* _t370;
				intOrPtr* _t372;
				signed char _t373;
				signed char _t374;
				intOrPtr* _t376;
				intOrPtr* _t377;
				intOrPtr* _t379;
				void* _t380;
				signed char _t381;
				signed int _t382;
				signed char _t383;
				signed int _t386;
				signed int _t387;
				signed int _t389;
				signed int _t390;
				void* _t392;
				intOrPtr* _t396;
				signed int _t397;
				intOrPtr* _t400;
				void* _t402;
				intOrPtr* _t403;
				void* _t405;
				intOrPtr* _t406;
				void* _t408;
				intOrPtr* _t409;
				void* _t410;
				void* _t411;
				intOrPtr* _t412;
				intOrPtr* _t413;
				void* _t416;
				signed char _t417;
				signed char _t418;
				intOrPtr* _t419;
				intOrPtr* _t423;
				char* _t425;
				void* _t427;
				intOrPtr* _t428;
				void* _t430;
				void* _t432;
				intOrPtr* _t434;
				signed char _t438;
				void* _t439;
				signed char _t441;
				signed int _t443;
				signed char _t445;
				signed char _t447;
				void* _t450;
				void* _t451;
				void* _t452;
				void* _t453;
				signed char _t455;
				intOrPtr* _t456;
				void* _t458;
				signed int _t459;
				void* _t460;
				void* _t464;
				signed int _t465;
				void* _t481;
				void* _t482;
				intOrPtr* _t483;
				void* _t484;
				void* _t486;
				void* _t487;
				void* _t488;
				intOrPtr* _t489;
				intOrPtr* _t494;
				intOrPtr* _t495;
				signed int _t498;
				intOrPtr* _t500;
				intOrPtr* _t501;
				signed int _t503;
				signed int _t504;
				signed int _t505;
				void* _t508;
				signed int _t510;
				intOrPtr* _t511;
				intOrPtr _t512;
				intOrPtr _t518;
				signed int _t519;
				signed char _t522;
				intOrPtr _t534;
				intOrPtr _t550;

				_t497 = __esi;
				_t480 = __edx;
				_push("VB5!6&*"); // executed
				L00401376(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t306 = __eax - 1;
				 *_t306 =  *_t306 + _t306;
				 *_t306 =  *_t306 + _t306;
				 *_t306 =  *_t306 + _t306;
				 *((intOrPtr*)(__ebx + 0x79)) =  *((intOrPtr*)(__ebx + 0x79)) + __ecx;
				asm("adc eax, 0xee6c2f36");
				_t464 = __ecx + 1;
				_t447 =  *((intOrPtr*)(_t464 - 0x19));
				_pop(_t308);
				_t309 = __edi;
				_t494 = _t308;
				_push(0);
				 *((intOrPtr*)(__edi)) =  *((intOrPtr*)(__edi)) + __edi;
				 *((intOrPtr*)(__edi)) =  *((intOrPtr*)(__edi)) + __edi;
				 *((intOrPtr*)(__edi)) =  *((intOrPtr*)(__edi)) + __edi;
				 *((intOrPtr*)(__edi)) =  *((intOrPtr*)(__edi)) + __edi;
				asm("stosb");
				asm("xlatb");
				_t465 = _t464 +  *((intOrPtr*)(__edi + 0x69));
				asm("insb");
				asm("bound esi, [gs:edx+0x61]");
				asm("outsb");
				if(_t465 < 0) {
					asm("stosb");
					asm("xlatb");
					_t443 = __edi + __edi +  *((intOrPtr*)(__edi + __edi));
					 *_t443 =  *_t443 + _t443;
					asm("int3");
					 *_t443 =  *_t443 ^ _t443;
					 *(__esi + 0x20) =  *(__esi + 0x20) ^ _t503;
					asm("fcom st0, st0");
					asm("movsd");
					 *((char*)(__esi + 1 - 0x18)) = __edx;
					asm("adc dword [edx+esi*2], 0x3433c456");
					asm("cmc");
					_t497 = 0xdc9142b1;
					_t508 = 1 + _a100 * 0x41070036;
					_t480 = 0x960e1019;
					_t445 = _t443 + 0x2c;
					asm("stosb");
					 *((intOrPtr*)(_t445 - 0x2d)) =  *((intOrPtr*)(_t445 - 0x2d)) + _t445;
					_t309 = _t447 + _t447 ^  *(_t465 - 0x48ee309a);
					_t447 = _t445;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
					 *_t309 =  *_t309 + _t309;
				}
				 *_t465 =  *_t465 + _t480;
				 *_t309 =  *_t309 + _t309;
				 *_t494 =  *_t494 + _t309;
				 *((intOrPtr*)(_t494 + 0x57 + _t465 * 2)) =  *((intOrPtr*)(_t494 + 0x57 + _t465 * 2)) + _t480;
				_t504 =  &_v1;
				_t495 = _t494 - 1;
				_t498 = _t497 - 1;
				_push(_t508);
				 *0x41000f01 =  *0x41000f01 + _t465;
				_t518 =  *0x41000f01;
				if(_t518 != 0 || _t518 == 0) {
					L11:
					if(_t522 == 0) {
						goto L20;
					} else {
						 *_t480 =  *_t480 + _t309;
						_t309 = _t309 + 0x58 +  *((intOrPtr*)(_t309 + 0x58 - 0x10fb40f9));
						goto L13;
					}
				} else {
					asm("outsd");
					asm("outsb");
					if(_t518 >= 0) {
						L13:
						 *_t495 =  *_t495 + 0xbf;
						_t309 = _t309 + 0xef;
						 *_t447 =  *_t447 + _t465;
						goto L14;
					} else {
						if(_t518 < 0) {
							L14:
							_t311 = _t309 + 0x78655400;
							goto L15;
						} else {
							 *[gs:ecx] =  *[gs:ecx] + _t447;
							 *_t309 =  *_t309 + _t309;
							_t480 = _t480 + 1;
							 *((intOrPtr*)(_t495 + _t465)) =  *((intOrPtr*)(_t495 + _t465)) + _t309;
							 *((intOrPtr*)(_t465 + 0x75)) =  *((intOrPtr*)(_t465 + 0x75)) + _t309;
							_t498 =  *(_t465 + 0x6f + _t504 * 2) * 0x6e;
							_t519 = _t498;
							if(_t519 >= 0) {
								L17:
								_t465 = _t465 +  *_t309;
								 *((intOrPtr*)(_t447 + 0x6f)) =  *((intOrPtr*)(_t447 + 0x6f)) + _t309;
								goto L18;
							} else {
								if(_t519 < 0) {
									L19:
									asm("popad");
									asm("outsb");
									_t309 = (_t309 ^  *[fs:eax]) + 1;
									 *_t309 =  *_t309 | _t309;
									_t447 = _t447 + 1;
									asm("outsd");
									asm("insd");
									asm("insd");
									L20:
									asm("popad");
									asm("outsb");
									_t311 = (_t309 ^  *[fs:eax]) + 0x70;
									 *(_t311 - 0x10fb40f3) =  *(_t311 - 0x10fb40f3) | _t447;
									 *_t465 =  *_t465 + _t480;
									 *_t311 =  *_t311 + _t311;
									 *_t447 =  *_t447 + 1;
								} else {
									 *[gs:0xea9] =  *[gs:0xea9] + _t480;
									_t438 =  *0xab00001b;
									asm("sbb eax, [eax]");
									_t480 = _t480 + _t438;
									_push(cs);
									 *_t438 =  *_t438 + _t438;
									_t508 = _t508 + 1;
									 *((intOrPtr*)(_t498 + 3)) =  *((intOrPtr*)(_t498 + 3)) + _t438;
									 *_t465 =  *_t465 + 1;
									_t311 = _t438 & 0x00000000;
									 *_t311 =  *_t311 + _t311;
									 *0x78655400 =  *0x78655400 + _t311;
									if( *0x78655400 == 0) {
										L15:
										_t35 =  &_a120;
										 *_t35 = _a120 + _t480;
										if( *_t35 != 0) {
											 *_t480 =  *_t480 + _t480;
											 *_t447 =  *_t447 + 1;
											_t309 = _t311 +  *_t311 -  *((intOrPtr*)(_t311 +  *_t311));
											 *_t309 =  *_t309 + _t309;
											goto L17;
										}
									} else {
										 *_t480 =  *_t480 + _t311;
										_t439 = _t311 + 0xd8;
										 *(_t439 + 8) =  *(_t439 + 8) | _t498;
										_t495 = 0xb01ef04;
										_t309 = _t439 + 0x78655400;
										if(_t309 == 0) {
											L18:
											_t447 = _t447 + 1;
											asm("outsd");
											asm("insd");
											asm("insd");
											goto L19;
										} else {
											 *_t480 =  *_t480 + _t480;
											 *_t447 =  *_t447 + 1;
											_t441 = _t309 +  *_t309 & 0x00000000;
											 *_t441 =  *_t441 + _t441;
											_t309 = _t441 +  *0x78655400;
											_t522 = _t309;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				_t312 = _t311 -  *_t311;
				 *_t312 =  *_t312 + _t312;
				_t313 = _t312 + 8;
				 *((intOrPtr*)(_t447 + 0x6f)) =  *((intOrPtr*)(_t447 + 0x6f)) + _t313;
				asm("insd");
				asm("insd");
				asm("popad");
				asm("outsb");
				 *[fs:eax] =  *[fs:eax] ^ _t313;
				_t314 = _t313 + 1;
				 *_t314 =  *_t314 | _t314;
				asm("outsd");
				asm("insd");
				asm("insd");
				asm("popad");
				asm("outsb");
				 *[fs:eax] =  *[fs:eax] ^ _t314;
				_t315 = _t314 + 0xe0;
				 *_t315 =  *_t315 + _t508;
				asm("adc [eax], eax");
				_t317 = (_t315 | 0x01ef04bf) +  *((intOrPtr*)(_t498 + (_t315 | 0x01ef04bf)));
				 *_t317 =  *_t317 + _t317;
				_t321 = (_t317 + _t317 & 0x00010040) +  *(_t317 + _t317 & 0x00010040) + 1;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				_t450 = _t447 + 1 + _t447 + 1 + _t447 + 1 + _t447 + 1;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *_t321 =  *_t321 + 1;
				 *_t321 =  *_t321 + _t321;
				 *((intOrPtr*)(_t321 + 0x40)) =  *((intOrPtr*)(_t321 + 0x40)) + _t450;
				 *((intOrPtr*)(_t321 + _t498 * 8)) =  *((intOrPtr*)(_t321 + _t498 * 8)) + _t450;
				_t481 = _t480 + 1;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t481;
				asm("invalid");
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *((intOrPtr*)(_t504 + _t481 + 0x40)) =  *((intOrPtr*)(_t504 + _t481 + 0x40)) + _t321;
				 *_t465 =  *_t465 + _t321;
				 *_t495 =  *_t495 + _t321;
				 *((intOrPtr*)(_t321 + 0x401f)) =  *((intOrPtr*)(_t321 + 0x401f)) + _t465;
				 *_t321 =  *_t321 + _t321;
				_t451 = _t450 + _t450;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *_t321 =  *_t321 + 1;
				 *_t321 =  *_t321 + _t321;
				 *((intOrPtr*)(_t465 + 0x40)) =  *((intOrPtr*)(_t465 + 0x40)) + _t465;
				 *((intOrPtr*)(_t321 + 0x42f0)) =  *((intOrPtr*)(_t321 + 0x42f0)) + _t321;
				 *_t321 =  *_t321 + _t321;
				 *((intOrPtr*)(_t321 + 0x2c)) =  *((intOrPtr*)(_t321 + 0x2c)) + _t465;
				asm("daa");
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + _t321;
				 *((intOrPtr*)(_t504 + _t481 + 0x10040)) =  *((intOrPtr*)(_t504 + _t481 + 0x10040)) + _t451;
				_t323 = _t321 +  *_t321 + 1;
				 *_t323 =  *_t323 + _t323;
				 *_t323 =  *_t323 + _t323;
				_t452 = _t451 + _t451;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *_t323 =  *_t323 + 1;
				 *_t323 =  *_t323 + _t323;
				 *((intOrPtr*)(_t323 - 0xf9fffc0)) =  *((intOrPtr*)(_t323 - 0xf9fffc0)) + _t465;
				_t482 = _t481 + 1;
				 *_t323 =  *_t323 + _t323;
				 *_t323 =  *_t323 + _t323;
				_t325 = _t323 + _t452 -  *_t495;
				 *_t325 =  *_t325 + _t325;
				 *_t325 =  *_t325 + _t325;
				 *_t325 =  *_t325 + _t325;
				 *_t325 =  *_t325 + _t325;
				 *_t325 =  *_t325 + _t325;
				 *_t325 =  *_t325 + _t325;
				asm("adc eax, 0x10040");
				_t328 = _t325 + _t482 + 1;
				 *_t328 =  *_t328 + _t328;
				 *_t328 =  *_t328 + _t328;
				_t453 = _t452 + _t452;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *_t328 =  *_t328 + 1;
				 *_t328 =  *_t328 + _t328;
				 *((intOrPtr*)(_t328 - 0xf8fffc0)) =  *((intOrPtr*)(_t328 - 0xf8fffc0)) + _t453;
				_t483 = _t482 + 1;
				 *_t328 =  *_t328 + _t328;
				 *_t328 =  *_t328 + _t328;
				_t329 = _t328 + _t453;
				 *_t329 =  *_t329 + _t329;
				 *_t329 =  *_t329 + _t329;
				 *_t329 =  *_t329 + _t329;
				 *_t329 =  *_t329 + _t329;
				 *_t329 =  *_t329 + _t329;
				 *_t329 =  *_t329 + _t329;
				 *((intOrPtr*)(_t498 + _t483)) =  *((intOrPtr*)(_t498 + _t483)) + _t465;
				_t330 = _t329 + 1;
				 *_t465 =  *_t465 + _t330;
				 *0x401fa800 =  *0x401fa800 + _t330;
				 *_t330 =  *_t330 + _t330;
				 *_t330 =  *_t330 + _t330;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *_t330 =  *_t330 + 1;
				 *_t330 =  *_t330 + _t330;
				_t331 = _t330 + _t465;
				 *_t331 =  *_t331 & _t331;
				_t332 = _t331 ^ 0x00000042;
				 *_t332 =  *_t332 + _t332;
				 *_t332 =  *_t332 + _t332;
				 *((intOrPtr*)(_t332 + 0x2c)) =  *((intOrPtr*)(_t332 + 0x2c)) + _t465;
				asm("daa");
				 *_t332 =  *_t332 + _t332;
				 *_t332 =  *_t332 + _t332;
				 *_t332 =  *_t332 + _t332;
				 *_t332 =  *_t332 + _t332;
				 *_t332 =  *_t332 + _t332;
				 *_t332 =  *_t332 + _t332;
				 *((intOrPtr*)(_t498 + _t483 + 0x40)) =  *((intOrPtr*)(_t498 + _t483 + 0x40)) + _t332;
				 *_t465 =  *_t465 + _t332;
				 *_t498 =  *_t498 + _t332;
				 *((intOrPtr*)(_t332 + 0x401f)) =  *((intOrPtr*)(_t332 + 0x401f)) + _t465;
				 *_t332 =  *_t332 + _t332;
				_t455 = _t453 + _t453 + _t453 + _t453;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *_t332 =  *_t332 + 1;
				 *_t332 =  *_t332 + _t332;
				 *_t465 =  *_t465 + _t455;
				_t333 = _t332 + 1;
				 *((intOrPtr*)(_t333 + 0x42f0)) =  *((intOrPtr*)(_t333 + 0x42f0)) + _t483;
				 *_t333 =  *_t333 + _t333;
				 *((intOrPtr*)(_t333 + 0x272c)) =  *((intOrPtr*)(_t333 + 0x272c)) + _t465;
				 *_t333 =  *_t333 + _t333;
				 *_t333 =  *_t333 + _t333;
				 *_t333 =  *_t333 + _t333;
				 *_t333 =  *_t333 + _t333;
				 *_t333 =  *_t333 + _t333;
				 *((intOrPtr*)(_t498 + _t483 + 0x40)) =  *((intOrPtr*)(_t498 + _t483 + 0x40)) + _t455;
				 *_t333 =  *_t333 + _t483;
				 *_t333 =  *_t333 + _t333;
				asm("outsb");
				_t335 = _t333 - 0x00000031 & _t455;
				_v394885050 = _v394885050 << 1;
				_t505 =  &_v1;
				asm("adc dword [edx+esi*2], 0x56");
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t335;
				 *_t335 =  *_t335 + _t483;
				_t336 = _t335 +  *_t335;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *(_t336 + 1) =  *(_t336 + 1) + _t483;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				 *_t336 =  *_t336 + _t336;
				asm("aam 0x13");
				_t337 = _t336 + 1;
				 *((intOrPtr*)(_t337 + _t337)) =  *((intOrPtr*)(_t337 + _t337)) + _t465;
				 *_t337 =  *_t337 + _t483;
				 *_t337 =  *_t337 + _t337;
				asm("repe add ch, [ebp+0xc]");
				_t338 = _t337 & 0x8a4816f6;
				_t510 = _t508 -  *_t495 -  *((intOrPtr*)(_t495 + _t338 * 8 - 0x4610f0f9));
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				 *((intOrPtr*)(_t338 + 0x280)) =  *((intOrPtr*)(_t338 + 0x280)) + _t338;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t483;
				asm("daa");
				_t339 = _t338 + 1;
				 *((intOrPtr*)(_t339 + _t339 + 0x42560000)) =  *((intOrPtr*)(_t339 + _t339 + 0x42560000)) + _t455;
				_t340 = _t339 ^ 0x2a263621;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t498 =  *_t498 + _t455;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				 *_t340 =  *_t340 + _t340;
				_t341 = _t340 |  *_t340;
				 *(_t341 + _t341) =  *(_t341 + _t341) | _t341;
				 *_t341 =  *_t341 + _t341;
				 *_t341 =  *_t341 + _t341;
				 *_t341 =  *_t341 + _t341;
				 *_t341 =  *_t341 + _t341;
				 *((intOrPtr*)(_t341 + 0x19)) =  *((intOrPtr*)(_t341 + 0x19)) + _t483;
				_t342 = _t341 + 1;
				 *((intOrPtr*)(_t342 + _t498 * 8)) =  *((intOrPtr*)(_t342 + _t498 * 8)) + _t483;
				 *_t465 =  *_t465 ^ _t342;
				_t456 = _t455 + _t455;
				asm("invalid");
				 *_t342 =  *_t342 | _t342;
				 *_t342 =  *_t342 + _t342;
				 *_t342 =  *_t342 + _t342;
				 *_t342 =  *_t342 + _t342;
				_t343 = _t342 +  *_t342;
				 *_t343 =  *_t343 + _t343;
				goto 0x7c401769;
				_push(ss);
				_t344 = _t343 + 1;
				 *((intOrPtr*)(_t483 + 0x13880040)) =  *((intOrPtr*)(_t483 + 0x13880040)) + _t344;
				_t345 = _t344 + 1;
				 *_t345 =  *_t345 + _t456;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345;
				 *((intOrPtr*)(_t465 - 0x6e000000)) =  *((intOrPtr*)(_t465 - 0x6e000000)) + _t483;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				_t121 = _t345 + 0x61;
				 *_t121 =  *((intOrPtr*)(_t345 + 0x61)) + _t483;
				_t534 =  *_t121;
				if(_t534 == 0) {
					L28:
					_t345 = _t345 + 1;
					asm("sbb [eax], al");
					 *_t345 =  *_t345 + _t345;
					 *_t345 =  *_t345 + _t345;
					goto L29;
				} else {
					if(_t534 >= 0) {
						L27:
						asm("invalid");
						asm("invalid");
						 *_t345 =  *_t345 + _t345;
						 *_t345 =  *_t345 + _t345;
						_t434 = _t345 - 0x20 + 1;
						 *((intOrPtr*)(_t434 + 0x42 + _t498 * 8)) =  *((intOrPtr*)(_t434 + 0x42 + _t498 * 8)) + _t465;
						 *_t434 =  *_t434 + _t434;
						 *_t434 =  *_t434 + _t434;
						 *((intOrPtr*)(_t434 + 0x272c)) =  *((intOrPtr*)(_t434 + 0x272c)) + _t465;
						 *_t434 =  *_t434 + _t434;
						 *_t434 =  *_t434 + _t434;
						 *_t434 =  *_t434 + _t434;
						 *_t434 =  *_t434 + _t434;
						 *_t434 =  *_t434 + _t434;
						 *_t434 =  *_t434 + _t456;
						asm("sbb [eax], al");
						 *_t434 =  *_t434 + _t434;
						 *_t434 =  *_t434 + _t434;
						asm("aam 0x26");
						_t345 = _t434 + 1;
						 *_t345 =  *_t345 + _t345;
						 *_t345 =  *_t345 + _t345;
						 *_t345 =  *_t345 + _t456;
						asm("sbb [eax], al");
						 *_t345 =  *_t345 + _t345;
						 *_t345 =  *_t345 + _t345;
						goto L28;
					} else {
						_t123 = _t345 + 0x69;
						 *_t123 =  *((intOrPtr*)(_t345 + 0x69)) + _t465;
						asm("insb");
						asm("bound esi, [gs:edx+0x61]");
						asm("outsb");
						if( *_t123 >= 0) {
							L29:
							_t346 = _t345 + 1;
							 *_t483 =  *_t483 + _t346;
							 *_t346 =  *_t346 + _t346;
							 *((intOrPtr*)(_t346 + 0x18)) =  *((intOrPtr*)(_t346 + 0x18)) + _t346;
							_t345 = _t346 + 1;
							 *_t345 =  *_t345 + _t345;
							 *((intOrPtr*)(_t495 + 0x6c006801)) =  *((intOrPtr*)(_t495 + 0x6c006801)) + _t483;
						} else {
							_t510 = _a100 * 0x48000036;
							_t505 = _a89 * 0x6e617262;
							if(_t505 < 0) {
								_t510 = _a100 * 0x1000036;
								 *_t465 =  *_t465 + _t345;
								 *((intOrPtr*)(_t345 + 0x401f)) =  *((intOrPtr*)(_t345 + 0x401f)) + _t465;
								 *_t345 =  *_t345 + _t345;
								 *((intOrPtr*)(_t345 - 0xffbd58)) =  *((intOrPtr*)(_t345 - 0xffbd58)) + _t456;
								goto L27;
							}
						}
					}
				}
				asm("insb");
				 *((intOrPtr*)(_t345 - 0x37ffbfe8)) =  *((intOrPtr*)(_t345 - 0x37ffbfe8)) + _t483;
				asm("cmc");
				_t484 = _t483 + 1;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t495 + _t484)) =  *((intOrPtr*)(_t495 + _t484)) + _t345;
				 *_t345 =  *_t345 - _t345;
				asm("in al, 0x26");
				_t349 = _t345 + 1 + _t484 + 1;
				 *_t349 =  *_t349 + _t349;
				_t350 = _t349 | 0x00003400;
				 *_t495 =  *_t495 + _t350;
				_t351 = _t350 + 1;
				 *_t465 =  *_t465 + _t351;
				 *_t456 =  *_t456 + _t351;
				 *_t351 =  *_t351 + _t351;
				 *_t351 =  *_t351 + _t351;
				 *_t351 =  *_t351 + _t351;
				 *_t351 =  *_t351 + _t351;
				 *((intOrPtr*)(_t351 - 0x3fffbfe8)) =  *((intOrPtr*)(_t351 - 0x3fffbfe8)) + _t484;
				asm("pushad");
				_t352 = _t351 & 0x40271400;
				 *_t465 =  *_t465 + _t352;
				 *_t456 =  *_t456 + _t352;
				 *_t352 =  *_t352 + _t352;
				_pop(ds);
				 *_t352 =  *_t352 + _t456;
				 *_t352 =  *_t352 + _t352;
				 *_t456 =  *_t456 + _t456;
				_t353 = _t352 + 1;
				asm("invalid");
				 *_t353 =  *_t353 + 1;
				 *_t353 =  *_t353 + _t353;
				 *_t353 =  *_t353 + _t353;
				 *_t353 =  *_t353 + _t353;
				asm("sbb [eax], al");
				_t458 = _t456 + _t456 + _t456 + _t456;
				asm("invalid");
				 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) + 1;
				 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) + 0x60;
				 *0x00000018 =  *((intOrPtr*)(0x18)) + 0x60;
				_pop(ss);
				 *((intOrPtr*)(_t458 + _t484 + 0x40)) =  *((intOrPtr*)(_t458 + _t484 + 0x40)) + 3;
				 *((intOrPtr*)(_t484 + 0x13)) =  *((intOrPtr*)(_t484 + 0x13)) + _t465;
				 *0x00000017 =  *((intOrPtr*)(0x17)) + _t484;
				 *0x00000005 =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *((intOrPtr*)(5)) =  *((intOrPtr*)(5)) + 0x60;
				 *0x0000001D =  *((intOrPtr*)(0x1d)) + _t465;
				_pop(ss);
				 *((intOrPtr*)(_t458 + _t484 + 0x40)) =  *((intOrPtr*)(_t458 + _t484 + 0x40)) + 0xd;
				 *((intOrPtr*)(_t484 + 0x13)) =  *((intOrPtr*)(_t484 + 0x13)) + _t465;
				 *0x00000021 =  *((intOrPtr*)(0x21)) + _t484;
				 *0x0000000F =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				 *((intOrPtr*)(0xf)) =  *((intOrPtr*)(0xf)) + 0x60;
				_t367 = 0xf + _t484;
				 *_t367 =  *_t367 + _t367;
				 *((intOrPtr*)(_t367 + 0x401f)) =  *((intOrPtr*)(_t367 + 0x401f)) + _t465;
				 *_t367 =  *_t367 + 0x60;
				 *_t367 =  *_t367 + _t484;
				_t368 = _t367 + _t367;
				asm("adc eax, [eax]");
				 *_t368 =  *_t368 + _t465;
				asm("lock inc edx");
				_t486 = _t484 + 1 + _t484 + 1;
				asm("adc [eax], eax");
				_t369 = _t368 + _t486;
				_t487 = _t486 + 1;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + 0x60;
				 *((intOrPtr*)(_t487 + 0x10040)) =  *((intOrPtr*)(_t487 + 0x10040)) + _t369;
				 *_t369 =  *_t369 + 0x60;
				 *_t369 =  *_t369 + _t369;
				 *_t369 =  *_t369 + 0x60;
				_t370 = _t369 + 1;
				 *_t370 =  *_t370 + 0x60;
				 *_t370 =  *_t370 + 0x60;
				 *((intOrPtr*)(_t370 - 0x58)) =  *((intOrPtr*)(_t370 - 0x58)) + _t458;
				_t488 = _t487 + 1;
				_t459 = _t458 + _t458;
				asm("invalid");
				 *_t370 =  *_t370 + 1;
				 *_t370 =  *_t370 + 0x60;
				_pop(ds);
				_t372 = _t370 + _t459 + 1;
				 *_t372 =  *_t372 + _t465;
				asm("lock inc edx");
				 *_t372 =  *_t372 + 0x60;
				 *_t372 =  *_t372 + 0x60;
				 *_t372 =  *_t372 + _t465;
				asm("in al, 0x27");
				 *_t372 =  *_t372 + 0x60;
				 *_t372 =  *_t372 + 0x60;
				 *_t372 =  *_t372 + 0x60;
				 *_t372 =  *_t372 + 0x60;
				 *_t372 =  *_t372 + 0x60;
				 *_t372 =  *_t372 + 0x60;
				 *((intOrPtr*)(_t510 + _t459)) =  *((intOrPtr*)(_t510 + _t459)) + _t372;
				_t373 = _t372 + 1;
				 *_t465 =  *_t465 + 0x60;
				 *_t373 =  *_t373 + 0x60;
				 *_t373 =  *_t373 + _t459;
				_t374 = _t373 &  *_t373;
				 *_t374 =  *_t374 + 0x60;
				 *_t374 =  *_t374 + 0x60;
				_t376 = (_t374 & 0x0000001c) + 1;
				 *_t465 =  *_t465 + 0x60;
				 *_t376 =  *_t376 + 0x60;
				 *((intOrPtr*)(_t510 + _t459)) =  *((intOrPtr*)(_t510 + _t459)) + _t465;
				_t377 = _t376 + 1;
				 *_t377 =  *_t377 + 0x60;
				 *_t377 =  *_t377 + 0x60;
				 *_t377 =  *_t377 + _t465;
				asm("sbb al, 0x40");
				 *0x2c000000 =  *0x2c000000 + 0x60;
				asm("sbb al, 0x40");
				 *_t495 =  *_t495 + 0x60;
				 *((intOrPtr*)(_t495 + 0x6c006801)) =  *((intOrPtr*)(_t495 + 0x6c006801)) + _t488;
				asm("sbb al, 0x40");
				_t379 = _t377 + _t488 + _t465;
				asm("cld");
				_t489 = _t488 + 1;
				 *_t379 =  *_t379 + 0x60;
				 *_t379 =  *_t379 + 0x60;
				 *((intOrPtr*)(0x22480025 + _t459 * 2)) =  *((intOrPtr*)(0x22480025 + _t459 * 2)) + _t489;
				_t380 = _t379 + 1;
				 *((intOrPtr*)(_t380 + 0x22)) =  *((intOrPtr*)(_t380 + 0x22)) + _t459;
				_t381 = _t380 + 1;
				 *_t381 =  *_t381 + 0x60;
				asm("sbb [eax], al");
				_t382 = _t381 ^ 0x00000000;
				 *_t382 =  *_t382 + 0x60;
				_push(0x2004022);
				 *_t459 =  *_t459 + 0x60;
				 *_t382 =  *_t382 + 0x60;
				 *_t382 =  *_t382 + 0x60;
				 *_t382 =  *_t382 + 0x60;
				 *_t382 =  *_t382 + 0x60;
				 *_t382 =  *_t382 + _t489;
				asm("sbb eax, 0x60900040");
				_t383 = _t382 & 0x40227800;
				 *_t489 =  *_t489 + 0x60;
				 *_t459 =  *_t459 + 0x60;
				 *_t383 =  *_t383 + 0x60;
				asm("adc [eax], eax");
				 *_t383 =  *_t383 + 0x60;
				asm("clc");
				_t386 = (_t383 &  *_t383) +  *(_t383 &  *_t383) +  *((intOrPtr*)((_t383 &  *_t383) +  *(_t383 &  *_t383)));
				 *_t386 =  *_t386 + 0x60;
				 *_t386 =  *_t386 + 0x60;
				 *_t386 =  *_t386 + 0x60;
				 *_t386 =  *_t386 + 0x60;
				 *0x60a00040 = _t459;
				_t387 = _t386 & 0x40230800;
				 *_t459 =  *_t459 + 0x60;
				 *_t459 =  *_t459 + 0x60;
				 *_t387 =  *_t387 + 0x60;
				asm("sbb [eax], al");
				 *_t387 =  *_t387 + 0x60;
				 *_t459 =  *_t459 + 0x60;
				 *_t387 =  *_t387 + 0x60;
				 *_t387 =  *_t387 + 0x60;
				 *_t387 =  *_t387 + 0x60;
				 *_t387 =  *_t387 + 0x60;
				asm("sbb eax, 0x60900040");
				_t389 = _t387 + _t387 & 0x40231400;
				 *_t465 =  *_t465 + 0x60;
				 *_t459 =  *_t459 + 0x60;
				 *_t389 =  *_t389 + 0x60;
				ds = 0x1004022;
				 *_t389 =  *_t389 + 0x60;
				 *_t389 =  *_t389 + 0x60;
				asm("sbb al, 0x23");
				_t390 = _t389 + 1;
				_t460 = _t459 + _t459;
				asm("invalid");
				 *_t390 =  *_t390 + 1;
				 *_t390 =  *_t390 + 0x60;
				 *_t390 =  *_t390 + 0x60;
				 *_t390 =  *_t390 + 0x60;
				 *((intOrPtr*)(_t498 + _t460 + 0x40)) =  *((intOrPtr*)(_t498 + _t460 + 0x40)) + _t460;
				 *((intOrPtr*)(_t390 + 0x2c002560)) =  *((intOrPtr*)(_t390 + 0x2c002560)) + _t489;
				asm("invalid");
				asm("invalid");
				_t392 = (_t390 &  *_t390) + 1;
				 *_t465 =  *_t465 + _t489;
				 *((intOrPtr*)(_t392 + _t392)) =  *((intOrPtr*)(_t392 + _t392)) + 0x60;
				_t396 = (_t392 + _t460 &  *(_t392 + _t460)) +  *(_t392 + _t460 &  *(_t392 + _t460));
				 *_t396 =  *_t396 + 0x60;
				 *_t396 =  *_t396 + 0x60;
				 *_t396 =  *_t396 + 0x60;
				 *_t396 =  *_t396 + 0x60;
				asm("lock push ds");
				_t397 = _t396 + 1;
				 *((intOrPtr*)(_t397 + 0x34002560)) =  *((intOrPtr*)(_t397 + 0x34002560)) + _t397;
				_t400 = (_t397 &  *_t397) +  *(_t397 &  *_t397);
				if(_t400 == 0) {
					_a1409302559 = _a1409302559 + _t489;
					_pop(ds);
					_t430 = _t400 + 2;
					 *((intOrPtr*)(_t465 + 0x1f)) =  *((intOrPtr*)(_t465 + 0x1f)) + _t430;
					 *((intOrPtr*)(_t498 + 0x1f)) =  *((intOrPtr*)(_t498 + 0x1f)) + _t465;
					_t432 = _t430 + 2;
					 *((intOrPtr*)(_t432 - 0x5dffbfe1)) =  *((intOrPtr*)(_t432 - 0x5dffbfe1)) + _t465;
					_pop(ds);
					_t400 = _t432 + 1;
					 *_t400 =  *_t400 + 0x60;
					 *_t400 =  *_t400 + 0x60;
					 *((intOrPtr*)(_t510 + _t460)) =  *((intOrPtr*)(_t510 + _t460)) + _t465;
				}
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t460 + _t460 + 0x13640040)) =  *((intOrPtr*)(_t460 + _t460 + 0x13640040)) + _t465;
				 *((intOrPtr*)(_t489 + 0x13)) =  *((intOrPtr*)(_t489 + 0x13)) + _t465;
				_t402 = _t400 + 2;
				 *((intOrPtr*)(_t402 + 0x13)) =  *((intOrPtr*)(_t402 + 0x13)) + _t489;
				_t403 = _t402 + 1;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *((intOrPtr*)(_t510 + _t460 + 0x40)) =  *((intOrPtr*)(_t510 + _t460 + 0x40)) + _t489;
				 *((intOrPtr*)(_t460 + _t460 + 0x13640040)) =  *((intOrPtr*)(_t460 + _t460 + 0x13640040)) + _t465;
				 *((intOrPtr*)(_t489 + 0x13)) =  *((intOrPtr*)(_t489 + 0x13)) + _t465;
				_t405 = _t403 + 2;
				 *((intOrPtr*)(_t405 + 0x13)) =  *((intOrPtr*)(_t405 + 0x13)) + _t489;
				_t406 = _t405 + 1;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *((intOrPtr*)(_t510 + _t460 + 0x40)) =  *((intOrPtr*)(_t510 + _t460 + 0x40)) + _t460;
				 *((intOrPtr*)(_t460 + _t460 + 0x13640040)) =  *((intOrPtr*)(_t460 + _t460 + 0x13640040)) + _t465;
				 *((intOrPtr*)(_t489 + 0x13)) =  *((intOrPtr*)(_t489 + 0x13)) + _t465;
				_t408 = _t406 + 2;
				 *((intOrPtr*)(_t408 + 0x13)) =  *((intOrPtr*)(_t408 + 0x13)) + _t489;
				_t409 = _t408 + 1;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *_t409 =  *_t409 + _t409;
				 *((intOrPtr*)(_t510 + _t460 + 0x1bac0040)) =  *((intOrPtr*)(_t510 + _t460 + 0x1bac0040)) + _t409;
				_t410 = _t409 + 1;
				 *((intOrPtr*)(_t460 + _t489 + 0x40)) =  *((intOrPtr*)(_t460 + _t489 + 0x40)) + _t410;
				 *((intOrPtr*)(_t489 + 0x13)) =  *((intOrPtr*)(_t489 + 0x13)) + _t465;
				_t411 = _t410 + 1;
				 *((intOrPtr*)(_t411 + 0x13)) =  *((intOrPtr*)(_t411 + 0x13)) + _t489;
				_t412 = _t411 + 1;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *((intOrPtr*)(_t495 + _t460 + 0x40)) =  *((intOrPtr*)(_t495 + _t460 + 0x40)) + _t465;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				 *((intOrPtr*)(_t465 + 0x1f)) =  *((intOrPtr*)(_t465 + 0x1f)) + _t460;
				_t413 = _t412 + 1;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t460 + _t460 + 0x13640040)) =  *((intOrPtr*)(_t460 + _t460 + 0x13640040)) + _t465;
				 *((intOrPtr*)(_t489 + 0x13)) =  *((intOrPtr*)(_t489 + 0x13)) + _t465;
				_t416 = _t413 + _t465 + 2;
				 *((intOrPtr*)(_t416 + 0x13)) =  *((intOrPtr*)(_t416 + 0x13)) + _t489;
				_t417 = _t416 + 1;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				 *((intOrPtr*)(_t465 + 0x3f04246c)) =  *((intOrPtr*)(_t465 + 0x3f04246c)) + _t417;
				 *_t417 =  *_t417 + _t417;
				asm("fisttp dword [ecx+0x6c810002]");
				_t418 = _t417 & 0x00000004;
				asm("aas");
				 *_t418 =  *_t418 + _t418;
				_t419 = _t418 + 0xff;
				 *_t419 =  *_t419 + 1;
				_pop(ss);
				_t511 = _t419;
				_a8 = _a8 - 0xffff;
				_t512 = _t511 - 0xc;
				 *[fs:0x0] = _t512;
				_v12 = _t512 - 0x50;
				_v8 = 0x4011b0;
				_v4 = 0;
				_t423 = _a8;
				 *((intOrPtr*)( *_t423 + 4))(_t423, _t495, _t498, _t460,  *[fs:0x0], 0x4011f6, _t505);
				_v72 = 0;
				_v24 = 0;
				_v32 = 0;
				_v40 = 0;
				_v56 = 0;
				_v76 = 0;
				_v64 = L"6/6/6";
				_v72 = 8;
				L004012CE();
				_t425 =  &_v56;
				_push(_t425);
				L004012D4(); // executed
				L00401352();
				if( ~(0 | _t425 != 0x0000ffff) != 0) {
					_push(0);
					_push(0);
					_push(1);
					L004012C8();
					L0040133A();
					_t550 =  *0x42f5b4; // 0x223eda4
					if(_t550 == 0) {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
					}
					_t500 =  *0x42f5b4; // 0x223eda4
					_t427 =  *((intOrPtr*)( *_t500 + 0x14))(_t500,  &_v44);
					asm("fclex");
					if(_t427 < 0) {
						_push(0x14);
						_push(0x40237c);
						_push(_t500);
						_push(_t427);
						L00401346();
					}
					_t428 = _v44;
					_t501 = _t428;
					_t425 =  *((intOrPtr*)( *_t428 + 0x70))(_t428,  &_v80);
					asm("fclex");
					if(_t425 < 0) {
						_push(0x70);
						_push(0x40239c);
						_push(_t501);
						_push(_t425);
						L00401346();
					}
					L00401340();
					_push(0x50);
					L004012C2();
				}
				_v36 = 0x6c82cc;
				_push(0x42b69c);
				L0040131C();
				return _t425;
			}










































































































































      0x0040137c
      0x0040137c
      0x0040137c
      0x00401381
      0x00401386
      0x00401388
      0x0040138a
      0x0040138c
      0x0040138e
      0x00401390
      0x00401391
      0x00401393
      0x00401395
      0x00401397
      0x0040139a
      0x0040139f
      0x004013a0
      0x004013a5
      0x004013a6
      0x004013a6
      0x004013a7
      0x004013ac
      0x004013ae
      0x004013b0
      0x004013b2
      0x004013b5
      0x004013b6
      0x004013b7
      0x004013ba
      0x004013bb
      0x004013c0
      0x004013c1
      0x004013cd
      0x004013ce
      0x004013cf
      0x004013d1
      0x004013d5
      0x004013d6
      0x004013da
      0x004013dd
      0x004013df
      0x004013e1
      0x004013e5
      0x004013ec
      0x004013ee
      0x004013f3
      0x004013f4
      0x00401402
      0x00401404
      0x00401405
      0x00401408
      0x00401408
      0x00401409
      0x0040140b
      0x0040140d
      0x0040140f
      0x00401411
      0x00401413
      0x00401415
      0x00401417
      0x00401419
      0x0040141b
      0x0040141d
      0x0040141f
      0x00401421
      0x00401423
      0x00401425
      0x00401427
      0x00401429
      0x0040142b
      0x0040142d
      0x00401430
      0x00401433
      0x00401435
      0x00401437
      0x0040143b
      0x0040143c
      0x0040143d
      0x0040143e
      0x0040143f
      0x0040143f
      0x00401445
      0x004014b2
      0x004014b2
      0x00000000
      0x004014b4
      0x004014b4
      0x004014b8
      0x00000000
      0x004014b8
      0x00401449
      0x00401449
      0x0040144a
      0x0040144b
      0x004014b9
      0x004014b9
      0x004014bc
      0x004014be
      0x00000000
      0x0040144d
      0x0040144d
      0x004014c0
      0x004014c0
      0x00000000
      0x00401452
      0x00401452
      0x00401455
      0x00401457
      0x00401458
      0x0040145b
      0x0040145e
      0x0040145e
      0x00401463
      0x004014d1
      0x004014d1
      0x004014d3
      0x00000000
      0x00401465
      0x00401465
      0x004014d8
      0x004014d8
      0x004014d9
      0x004014dd
      0x004014df
      0x004014e1
      0x004014e2
      0x004014e3
      0x004014e4
      0x004014e5
      0x004014e5
      0x004014e6
      0x004014ea
      0x004014ec
      0x004014f2
      0x004014f4
      0x004014f6
      0x0040146a
      0x0040146a
      0x00401471
      0x00401476
      0x00401478
      0x0040147a
      0x0040147b
      0x0040147d
      0x0040147e
      0x00401481
      0x00401483
      0x00401485
      0x00401487
      0x0040148d
      0x004014c1
      0x004014c1
      0x004014c1
      0x004014c5
      0x004014c7
      0x004014cb
      0x004014cd
      0x004014cf
      0x00000000
      0x004014cf
      0x0040148f
      0x0040148f
      0x00401491
      0x00401493
      0x00401496
      0x0040149b
      0x004014a0
      0x004014d4
      0x004014d4
      0x004014d5
      0x004014d6
      0x004014d7
      0x00000000
      0x004014a2
      0x004014a2
      0x004014a6
      0x004014a8
      0x004014aa
      0x004014ac
      0x004014ac
      0x00000000
      0x004014ac
      0x004014a0
      0x0040148d
      0x00401465
      0x00401463
      0x0040144d
      0x0040144b
      0x004014f8
      0x004014fa
      0x004014fc
      0x004014fe
      0x00401501
      0x00401502
      0x00401503
      0x00401504
      0x00401505
      0x00401508
      0x0040150a
      0x0040150d
      0x0040150e
      0x0040150f
      0x00401510
      0x00401511
      0x00401512
      0x00401515
      0x00401517
      0x0040151e
      0x00401522
      0x00401525
      0x00401532
      0x00401533
      0x00401535
      0x00401537
      0x00401539
      0x0040153b
      0x0040153d
      0x0040153f
      0x00401541
      0x00401543
      0x00401547
      0x0040154a
      0x0040154b
      0x0040154d
      0x0040154f
      0x00401551
      0x00401553
      0x00401555
      0x00401557
      0x00401559
      0x0040155b
      0x0040155d
      0x0040155f
      0x00401563
      0x00401565
      0x00401567
      0x0040156d
      0x0040156f
      0x00401571
      0x00401573
      0x00401575
      0x00401577
      0x00401579
      0x0040157b
      0x0040157f
      0x00401585
      0x00401587
      0x0040158a
      0x0040158b
      0x0040158d
      0x0040158f
      0x00401591
      0x00401593
      0x00401595
      0x00401597
      0x004015a2
      0x004015a3
      0x004015a5
      0x004015a7
      0x004015a9
      0x004015ab
      0x004015ad
      0x004015af
      0x004015b1
      0x004015b3
      0x004015ba
      0x004015bb
      0x004015bd
      0x004015c1
      0x004015c3
      0x004015c5
      0x004015c7
      0x004015c9
      0x004015cb
      0x004015cd
      0x004015d1
      0x004015da
      0x004015db
      0x004015dd
      0x004015df
      0x004015e1
      0x004015e3
      0x004015e5
      0x004015e7
      0x004015e9
      0x004015eb
      0x004015f2
      0x004015f3
      0x004015f5
      0x004015f7
      0x004015fb
      0x004015fd
      0x004015ff
      0x00401601
      0x00401603
      0x00401605
      0x00401607
      0x0040160a
      0x0040160b
      0x0040160d
      0x00401613
      0x00401615
      0x00401619
      0x0040161b
      0x0040161d
      0x0040161f
      0x00401621
      0x00401623
      0x00401625
      0x00401628
      0x0040162b
      0x0040162d
      0x0040162f
      0x00401632
      0x00401633
      0x00401635
      0x00401637
      0x00401639
      0x0040163b
      0x0040163d
      0x0040163f
      0x00401643
      0x00401645
      0x00401647
      0x0040164d
      0x0040164f
      0x00401651
      0x00401653
      0x00401655
      0x00401657
      0x00401659
      0x0040165b
      0x0040165e
      0x0040165f
      0x00401665
      0x00401667
      0x0040166d
      0x0040166f
      0x00401671
      0x00401673
      0x00401675
      0x00401677
      0x0040167b
      0x0040167e
      0x00401682
      0x00401683
      0x00401685
      0x0040168b
      0x0040168c
      0x00401693
      0x00401695
      0x00401697
      0x00401699
      0x0040169b
      0x0040169d
      0x0040169f
      0x004016a1
      0x004016a3
      0x004016a5
      0x004016a7
      0x004016a9
      0x004016ab
      0x004016ad
      0x004016af
      0x004016b1
      0x004016b3
      0x004016b5
      0x004016b7
      0x004016b9
      0x004016bb
      0x004016be
      0x004016c0
      0x004016c2
      0x004016c4
      0x004016c6
      0x004016c7
      0x004016cb
      0x004016ce
      0x004016d0
      0x004016d4
      0x004016d9
      0x004016e0
      0x004016e2
      0x004016e4
      0x004016e6
      0x004016e8
      0x004016ea
      0x004016ec
      0x004016ee
      0x004016f0
      0x004016f2
      0x004016f4
      0x004016f7
      0x004016f9
      0x004016fb
      0x004016fd
      0x004016ff
      0x00401701
      0x00401703
      0x00401705
      0x00401707
      0x00401709
      0x0040170b
      0x00401711
      0x00401713
      0x00401715
      0x00401716
      0x00401717
      0x0040171e
      0x00401723
      0x00401725
      0x00401727
      0x00401729
      0x0040172b
      0x0040172d
      0x0040172f
      0x00401732
      0x00401734
      0x00401736
      0x00401738
      0x0040173a
      0x0040173c
      0x0040173e
      0x00401740
      0x00401743
      0x00401745
      0x00401747
      0x00401749
      0x0040174b
      0x0040174e
      0x0040174f
      0x00401752
      0x00401754
      0x00401756
      0x00401758
      0x0040175a
      0x0040175c
      0x0040175e
      0x00401760
      0x00401762
      0x00401764
      0x00401769
      0x0040176a
      0x0040176b
      0x00401772
      0x00401773
      0x00401776
      0x00401778
      0x0040177b
      0x00401781
      0x00401783
      0x00401785
      0x00401787
      0x00401789
      0x0040178b
      0x0040178d
      0x0040178f
      0x00401791
      0x00401793
      0x00401793
      0x00401793
      0x00401796
      0x0040180c
      0x0040180c
      0x0040180d
      0x00401810
      0x00401812
      0x00000000
      0x00401798
      0x00401798
      0x004017d0
      0x004017d0
      0x004017d2
      0x004017d4
      0x004017d6
      0x004017da
      0x004017db
      0x004017df
      0x004017e1
      0x004017e3
      0x004017e9
      0x004017eb
      0x004017ed
      0x004017ef
      0x004017f1
      0x004017f3
      0x004017f5
      0x004017f8
      0x004017fa
      0x004017fc
      0x004017fe
      0x004017ff
      0x00401801
      0x00401803
      0x00401805
      0x00401808
      0x0040180a
      0x00000000
      0x0040179b
      0x0040179b
      0x0040179b
      0x0040179e
      0x0040179f
      0x004017a4
      0x004017a5
      0x00401814
      0x00401816
      0x00401817
      0x00401819
      0x0040181b
      0x0040181e
      0x0040181f
      0x00401821
      0x004017a8
      0x004017a8
      0x004017af
      0x004017b7
      0x004017ba
      0x004017c1
      0x004017c3
      0x004017c9
      0x004017cb
      0x00000000
      0x004017cb
      0x004017b7
      0x004017a5
      0x00401798
      0x00401826
      0x00401827
      0x0040182d
      0x0040182e
      0x0040182f
      0x00401831
      0x00401833
      0x00401836
      0x00401838
      0x0040183d
      0x0040183f
      0x00401842
      0x00401847
      0x0040184a
      0x0040184b
      0x0040184d
      0x0040184f
      0x00401851
      0x00401853
      0x00401855
      0x00401857
      0x0040185d
      0x0040185e
      0x00401863
      0x00401865
      0x00401867
      0x0040186a
      0x0040186b
      0x0040186d
      0x0040186f
      0x00401872
      0x00401875
      0x00401877
      0x00401879
      0x0040187b
      0x0040187d
      0x00401881
      0x0040188b
      0x0040188d
      0x0040188f
      0x00401891
      0x00401893
      0x00401899
      0x0040189b
      0x0040189f
      0x004018a3
      0x004018a7
      0x004018a9
      0x004018ab
      0x004018ad
      0x004018af
      0x004018b1
      0x004018b3
      0x004018b5
      0x004018b7
      0x004018b9
      0x004018bb
      0x004018bd
      0x004018bf
      0x004018c1
      0x004018c3
      0x004018c5
      0x004018c7
      0x004018c9
      0x004018cb
      0x004018cd
      0x004018cf
      0x004018d1
      0x004018d3
      0x004018d5
      0x004018d7
      0x004018d9
      0x004018db
      0x004018dd
      0x004018df
      0x004018e5
      0x004018e7
      0x004018eb
      0x004018ef
      0x004018f3
      0x004018f5
      0x004018f7
      0x004018f9
      0x004018fb
      0x004018fd
      0x004018ff
      0x00401901
      0x00401903
      0x00401905
      0x00401907
      0x00401909
      0x0040190b
      0x0040190d
      0x0040190f
      0x00401911
      0x00401913
      0x00401915
      0x00401917
      0x00401919
      0x0040191b
      0x0040191d
      0x0040191f
      0x00401921
      0x00401923
      0x00401925
      0x00401927
      0x00401929
      0x0040192b
      0x0040192d
      0x0040192f
      0x00401931
      0x00401933
      0x00401935
      0x00401937
      0x00401939
      0x0040193b
      0x0040193d
      0x0040193f
      0x00401941
      0x00401943
      0x00401945
      0x00401947
      0x00401949
      0x0040194b
      0x0040194d
      0x0040194f
      0x00401951
      0x00401953
      0x00401955
      0x00401957
      0x00401959
      0x0040195b
      0x0040195d
      0x0040195f
      0x00401961
      0x00401963
      0x00401965
      0x00401967
      0x00401969
      0x0040196b
      0x0040196d
      0x0040196f
      0x00401971
      0x00401973
      0x00401979
      0x0040197b
      0x00401983
      0x00401985
      0x00401987
      0x00401989
      0x0040198b
      0x0040198d
      0x00401990
      0x00401992
      0x00401993
      0x00401995
      0x00401997
      0x00401999
      0x0040199b
      0x0040199d
      0x0040199f
      0x004019a1
      0x004019a3
      0x004019a5
      0x004019a7
      0x004019a9
      0x004019ab
      0x004019ad
      0x004019af
      0x004019b1
      0x004019b3
      0x004019b5
      0x004019b7
      0x004019b9
      0x004019bb
      0x004019bd
      0x004019bf
      0x004019c1
      0x004019c3
      0x004019c5
      0x004019c7
      0x004019c9
      0x004019cb
      0x004019cd
      0x004019cf
      0x004019d1
      0x004019d3
      0x004019d5
      0x004019d7
      0x004019d9
      0x004019db
      0x004019dd
      0x004019df
      0x004019e1
      0x004019e3
      0x004019e5
      0x004019e7
      0x004019e9
      0x004019eb
      0x004019ed
      0x004019ef
      0x004019f1
      0x004019f3
      0x004019f5
      0x004019f7
      0x004019f9
      0x004019fb
      0x004019fd
      0x004019ff
      0x00401a01
      0x00401a03
      0x00401a05
      0x00401a07
      0x00401a09
      0x00401a0b
      0x00401a0d
      0x00401a0f
      0x00401a11
      0x00401a13
      0x00401a15
      0x00401a17
      0x00401a19
      0x00401a1b
      0x00401a1d
      0x00401a1f
      0x00401a21
      0x00401a23
      0x00401a25
      0x00401a27
      0x00401a29
      0x00401a2b
      0x00401a2d
      0x00401a2f
      0x00401a31
      0x00401a33
      0x00401a35
      0x00401a37
      0x00401a39
      0x00401a3b
      0x00401a3d
      0x00401a3f
      0x00401a41
      0x00401a43
      0x00401a45
      0x00401a47
      0x00401a49
      0x00401a4b
      0x00401a4d
      0x00401a4f
      0x00401a51
      0x00401a53
      0x00401a55
      0x00401a57
      0x00401a59
      0x00401a5b
      0x00401a5d
      0x00401a5f
      0x00401a61
      0x00401a63
      0x00401a65
      0x00401a67
      0x00401a69
      0x00401a6b
      0x00401a6d
      0x00401a6f
      0x00401a71
      0x00401a73
      0x00401a75
      0x00401a77
      0x00401a79
      0x00401a7b
      0x00401a7d
      0x00401a7f
      0x00401a81
      0x00401a83
      0x00401a85
      0x00401a87
      0x00401a89
      0x00401a8b
      0x00401a8d
      0x00401a8f
      0x00401a91
      0x00401a93
      0x00401a95
      0x00401a97
      0x00401a99
      0x00401a9b
      0x00401a9d
      0x00401a9f
      0x00401aa1
      0x00401aa3
      0x00401aa5
      0x00401aa7
      0x00401aa9
      0x00401aab
      0x00401aad
      0x00401aaf
      0x00401ab1
      0x00401ab3
      0x00401ab5
      0x00401ab7
      0x00401ab9
      0x00401abb
      0x00401abd
      0x00401abf
      0x00401ac1
      0x00401ac3
      0x00401ac5
      0x00401ac7
      0x00401ac9
      0x00401acb
      0x00401acd
      0x00401acf
      0x00401ad1
      0x00401ad3
      0x00401ad5
      0x00401ad7
      0x00401ad9
      0x00401adb
      0x00401add
      0x00401adf
      0x00401ae1
      0x00401ae3
      0x00401ae5
      0x00401ae7
      0x00401ae9
      0x00401aeb
      0x00401aed
      0x00401aef
      0x00401af1
      0x00401af3
      0x00401af5
      0x00401af7
      0x00401af9
      0x00401afb
      0x00401afd
      0x00401aff
      0x00401b01
      0x00401b03
      0x00401b05
      0x00401b07
      0x00401b09
      0x00401b0b
      0x00401b0d
      0x00401b0f
      0x00401b11
      0x00401b13
      0x00401b15
      0x00401b17
      0x00401b19
      0x00401b1b
      0x00401b1d
      0x00401b1f
      0x00401b21
      0x00401b23
      0x00401b25
      0x00401b27
      0x00401b29
      0x00401b2b
      0x00401b2d
      0x00401b2f
      0x00401b31
      0x00401b33
      0x00401b35
      0x00401b37
      0x00401b39
      0x00401b3b
      0x00401b3d
      0x00401b3f
      0x00401b41
      0x00401b43
      0x00401b45
      0x00401b47
      0x00401b49
      0x00401b4b
      0x00401b4d
      0x00401b4f
      0x00401b51
      0x00401b53
      0x00401b55
      0x00401b57
      0x00401b59
      0x00401b5b
      0x00401b5d
      0x00401b5f
      0x00401b61
      0x00401b63
      0x00401b65
      0x00401b67
      0x00401b69
      0x00401b6b
      0x00401b6d
      0x00401b6f
      0x00401b71
      0x00401b73
      0x00401b75
      0x00401b77
      0x00401b79
      0x00401b7b
      0x00401b7d
      0x00401b7f
      0x00401b81
      0x00401b83
      0x00401b85
      0x00401b87
      0x00401b89
      0x00401b8b
      0x00401b8d
      0x00401b8f
      0x00401b91
      0x00401b93
      0x00401b95
      0x00401b97
      0x00401b99
      0x00401b9b
      0x00401b9d
      0x00401b9f
      0x00401ba1
      0x00401ba3
      0x00401baa
      0x00401bac
      0x00401bae
      0x00401bb2
      0x00401bb3
      0x00401bb5
      0x00401bb7
      0x00401bba
      0x00401bbb
      0x00401bbd
      0x00401bbf
      0x00401bc1
      0x00401bc5
      0x00401bc6
      0x00401bc7
      0x00401bc9
      0x00401bcb
      0x00401bcd
      0x00401bcf
      0x00401bd1
      0x00401bd3
      0x00401bd5
      0x00401bd7
      0x00401bd9
      0x00401bdb
      0x00401bdd
      0x00401bdf
      0x00401be2
      0x00401be3
      0x00401be5
      0x00401be7
      0x00401be9
      0x00401bec
      0x00401bee
      0x00401bf2
      0x00401bf3
      0x00401bf5
      0x00401bf7
      0x00401bfa
      0x00401bfb
      0x00401bfd
      0x00401bff
      0x00401c01
      0x00401c03
      0x00401c09
      0x00401c0b
      0x00401c0d
      0x00401c15
      0x00401c17
      0x00401c19
      0x00401c1a
      0x00401c1b
      0x00401c1d
      0x00401c1f
      0x00401c26
      0x00401c27
      0x00401c2a
      0x00401c2b
      0x00401c2e
      0x00401c30
      0x00401c32
      0x00401c34
      0x00401c39
      0x00401c3b
      0x00401c3d
      0x00401c3f
      0x00401c41
      0x00401c43
      0x00401c45
      0x00401c4a
      0x00401c4f
      0x00401c51
      0x00401c53
      0x00401c56
      0x00401c5a
      0x00401c5c
      0x00401c62
      0x00401c64
      0x00401c66
      0x00401c68
      0x00401c6a
      0x00401c6c
      0x00401c72
      0x00401c77
      0x00401c79
      0x00401c7b
      0x00401c7e
      0x00401c82
      0x00401c89
      0x00401c8b
      0x00401c8d
      0x00401c8f
      0x00401c91
      0x00401c95
      0x00401c9a
      0x00401c9f
      0x00401ca1
      0x00401ca3
      0x00401ca6
      0x00401ca7
      0x00401caa
      0x00401cac
      0x00401cae
      0x00401caf
      0x00401cb1
      0x00401cb3
      0x00401cb5
      0x00401cb7
      0x00401cb9
      0x00401cbb
      0x00401cbf
      0x00401cc8
      0x00401cca
      0x00401ccc
      0x00401ccd
      0x00401ccf
      0x00401cda
      0x00401cdc
      0x00401cde
      0x00401ce0
      0x00401ce2
      0x00401ce4
      0x00401ce6
      0x00401ce7
      0x00401cf2
      0x00401cf4
      0x00401cf7
      0x00401cfd
      0x00401cfe
      0x00401cff
      0x00401d03
      0x00401d06
      0x00401d07
      0x00401d0d
      0x00401d0e
      0x00401d0f
      0x00401d11
      0x00401d13
      0x00401d13
      0x00401d15
      0x00401d17
      0x00401d1f
      0x00401d22
      0x00401d23
      0x00401d26
      0x00401d27
      0x00401d29
      0x00401d2b
      0x00401d2d
      0x00401d2f
      0x00401d31
      0x00401d33
      0x00401d35
      0x00401d37
      0x00401d39
      0x00401d3b
      0x00401d3d
      0x00401d3f
      0x00401d41
      0x00401d43
      0x00401d45
      0x00401d47
      0x00401d49
      0x00401d4b
      0x00401d4d
      0x00401d4f
      0x00401d51
      0x00401d53
      0x00401d55
      0x00401d57
      0x00401d59
      0x00401d5b
      0x00401d5d
      0x00401d5f
      0x00401d61
      0x00401d63
      0x00401d65
      0x00401d67
      0x00401d69
      0x00401d6b
      0x00401d6d
      0x00401d6f
      0x00401d71
      0x00401d73
      0x00401d75
      0x00401d77
      0x00401d79
      0x00401d7b
      0x00401d7d
      0x00401d7f
      0x00401d81
      0x00401d83
      0x00401d85
      0x00401d87
      0x00401d89
      0x00401d8b
      0x00401d8f
      0x00401d97
      0x00401d9a
      0x00401d9b
      0x00401d9e
      0x00401d9f
      0x00401da1
      0x00401da3
      0x00401da5
      0x00401da7
      0x00401da9
      0x00401dab
      0x00401dad
      0x00401daf
      0x00401db1
      0x00401db3
      0x00401db5
      0x00401db7
      0x00401db9
      0x00401dbb
      0x00401dbd
      0x00401dbf
      0x00401dc1
      0x00401dc3
      0x00401dc5
      0x00401dc7
      0x00401dc9
      0x00401dcb
      0x00401dcd
      0x00401dcf
      0x00401dd1
      0x00401dd3
      0x00401dd5
      0x00401dd7
      0x00401dd9
      0x00401ddb
      0x00401ddd
      0x00401ddf
      0x00401de1
      0x00401de3
      0x00401de5
      0x00401de7
      0x00401deb
      0x00401df3
      0x00401df6
      0x00401df7
      0x00401dfa
      0x00401dfb
      0x00401dfd
      0x00401dff
      0x00401e01
      0x00401e03
      0x00401e05
      0x00401e07
      0x00401e09
      0x00401e0b
      0x00401e0d
      0x00401e0f
      0x00401e11
      0x00401e13
      0x00401e15
      0x00401e17
      0x00401e19
      0x00401e1b
      0x00401e1d
      0x00401e1f
      0x00401e21
      0x00401e23
      0x00401e25
      0x00401e27
      0x00401e29
      0x00401e2b
      0x00401e2d
      0x00401e2f
      0x00401e31
      0x00401e33
      0x00401e35
      0x00401e37
      0x00401e39
      0x00401e3b
      0x00401e3d
      0x00401e3f
      0x00401e41
      0x00401e43
      0x00401e45
      0x00401e47
      0x00401e49
      0x00401e4b
      0x00401e4d
      0x00401e4f
      0x00401e51
      0x00401e53
      0x00401e55
      0x00401e57
      0x00401e59
      0x00401e5b
      0x00401e5d
      0x00401e5f
      0x00401e66
      0x00401e67
      0x00401e6b
      0x00401e6e
      0x00401e6f
      0x00401e72
      0x00401e73
      0x00401e75
      0x00401e77
      0x00401e79
      0x00401e7b
      0x00401e7d
      0x00401e7f
      0x00401e81
      0x00401e83
      0x00401e85
      0x00401e87
      0x00401e89
      0x00401e8b
      0x00401e8f
      0x00401e91
      0x00401e93
      0x00401e95
      0x00401e97
      0x00401e99
      0x00401e9b
      0x00401e9d
      0x00401e9f
      0x00401ea1
      0x00401ea3
      0x00401ea5
      0x00401ea7
      0x00401ea9
      0x00401eab
      0x00401ead
      0x00401eaf
      0x00401eb1
      0x00401eb3
      0x00401eb5
      0x00401eb7
      0x00401eb9
      0x00401ebb
      0x00401ebd
      0x00401ebf
      0x00401ec1
      0x00401ec3
      0x00401ec5
      0x00401ec7
      0x00401ec9
      0x00401ecb
      0x00401ece
      0x00401ecf
      0x00401ed1
      0x00401ed3
      0x00401ed5
      0x00401ed7
      0x00401ed9
      0x00401edb
      0x00401edd
      0x00401edf
      0x00401ee1
      0x00401ee3
      0x00401ee5
      0x00401ee7
      0x00401ee9
      0x00401eeb
      0x00401eed
      0x00401eef
      0x00401ef1
      0x00401ef5
      0x00401ef7
      0x00401eff
      0x00401f02
      0x00401f03
      0x00401f06
      0x00401f07
      0x00401f09
      0x00401f0b
      0x00401f0d
      0x00401f0f
      0x00401f11
      0x00401f13
      0x00401f15
      0x00401f17
      0x00401f19
      0x00401f1b
      0x00401f1d
      0x00401f1f
      0x00401f21
      0x00401f23
      0x00401f25
      0x00401f27
      0x00401f29
      0x00401f2b
      0x00401f2d
      0x00401f2f
      0x00401f31
      0x00401f33
      0x00401f35
      0x00401f37
      0x00401f39
      0x00401f3b
      0x00401f3d
      0x00401f3f
      0x00401f41
      0x00401f43
      0x00401f45
      0x00401f47
      0x00401f49
      0x00401f4b
      0x00401f51
      0x00401f55
      0x00401f5b
      0x00401f5d
      0x00401f5e
      0x00401f69
      0x00401f6b
      0x00401f6f
      0x00401f70
      0x00401f73
      0x0042b56d
      0x0042b57c
      0x0042b589
      0x0042b58c
      0x0042b595
      0x0042b598
      0x0042b59e
      0x0042b5a1
      0x0042b5aa
      0x0042b5ad
      0x0042b5b0
      0x0042b5b3
      0x0042b5b6
      0x0042b5b9
      0x0042b5c0
      0x0042b5c7
      0x0042b5cc
      0x0042b5cf
      0x0042b5d0
      0x0042b5e6
      0x0042b5ee
      0x0042b5f4
      0x0042b5f5
      0x0042b5f6
      0x0042b5f8
      0x0042b602
      0x0042b607
      0x0042b60d
      0x0042b60f
      0x0042b614
      0x0042b619
      0x0042b619
      0x0042b61e
      0x0042b62b
      0x0042b62e
      0x0042b632
      0x0042b634
      0x0042b636
      0x0042b63b
      0x0042b63c
      0x0042b63d
      0x0042b63d
      0x0042b642
      0x0042b64c
      0x0042b64e
      0x0042b651
      0x0042b655
      0x0042b657
      0x0042b659
      0x0042b65e
      0x0042b65f
      0x0042b660
      0x0042b660
      0x0042b668
      0x0042b66d
      0x0042b66f
      0x0042b66f
      0x0042b674
      0x0042b67b
      0x0042b696
      0x0042b69b

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1191724406.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1191719786.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191812090.000000000042F000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191818167.0000000000431000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: #100
      • String ID: VB5!6&*
      • API String ID: 1341478452-3593831657
      • Opcode ID: 4da97669c24223af7e20f1ee1008f27728f2318579157f224f4739836853dc8f
      • Instruction ID: 0a4777c414aa070b0a3d6bafd7df09a233e2f0d89c05d0a80e26a570885920e4
      • Opcode Fuzzy Hash: 4da97669c24223af7e20f1ee1008f27728f2318579157f224f4739836853dc8f
      • Instruction Fuzzy Hash: FE51566640E7C04FD7134B7489B91A5BFB0AE2771431A06EBC8C19F5B3D22C681BD726
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      Function 04C11BCE, Relevance: 3.1, Strings: 2, Instructions: 566COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: Gf8$Z5
      • API String ID: 0-947967345
      • Opcode ID: 2296fab55f1c8ed6d1c170149b31a38f618417abe284a01bd0c8561280f84c22
      • Instruction ID: 5c5fe8b705528f0284238f20fd891e4d909e977b79dcbcb8f61e43cf5e802c15
      • Opcode Fuzzy Hash: 2296fab55f1c8ed6d1c170149b31a38f618417abe284a01bd0c8561280f84c22
      • Instruction Fuzzy Hash: 1B32E8356083C58FDB35CF39CC987DA7BA2AF56310F4982AACC994F2A6D3309641D716
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C07574, Relevance: 2.0, Strings: 1, Instructions: 800COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID: QJQ
      • API String ID: 2167126740-1123671965
      • Opcode ID: 23a87022dab17b6a7da1b40d579749e676e298f6ed3110e98488bc9b326012ff
      • Instruction ID: c7a0212e7fc59756c72f57897ef8d08ae9d5ffc8674c8701921b82ac8d3863b5
      • Opcode Fuzzy Hash: 23a87022dab17b6a7da1b40d579749e676e298f6ed3110e98488bc9b326012ff
      • Instruction Fuzzy Hash: 5A7233B1604389DFDF789F29CD517EA7BA2FF55340F05812ADC8A9B250D730AA41DB82
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C1130A, Relevance: 2.0, Strings: 1, Instructions: 790COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: QJQ
      • API String ID: 0-1123671965
      • Opcode ID: 3c8faa50bc7a6fbf58bdea1535cfeafc80df8a2332d9c73fd0d59aeacaf475f7
      • Instruction ID: b6433a327042042b6f4faef3f22793de11898c9a11480eda316738f0dc6c5fda
      • Opcode Fuzzy Hash: 3c8faa50bc7a6fbf58bdea1535cfeafc80df8a2332d9c73fd0d59aeacaf475f7
      • Instruction Fuzzy Hash: 8E7233B1A04389DFDB749F39CD457EABBA2FF55310F09811ADC899B250D7306A81DB82
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C0087E, Relevance: 2.0, Strings: 1, Instructions: 739COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: QJQ
      • API String ID: 0-1123671965
      • Opcode ID: b8476430e8e40aaf17f4d9c2bf36d9921c7c3f1080ee0bda1ffff81e29240989
      • Instruction ID: 5a3efe0fb7cf3c50910e8b2ef48c836ef4882187f2452a58e33d0198ce840852
      • Opcode Fuzzy Hash: b8476430e8e40aaf17f4d9c2bf36d9921c7c3f1080ee0bda1ffff81e29240989
      • Instruction Fuzzy Hash: 326234B2604389DFDB749F39CD557EA7BA2FF55340F05812ADC899B260D7306A81CB82
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C06BF6, Relevance: 1.5, Strings: 1, Instructions: 270COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: XD;
      • API String ID: 0-1827544411
      • Opcode ID: 540f21c433227036eb714c4cc06471b5a8db81d2344e798cb69ba56a66a2e248
      • Instruction ID: 666859ea2f8c4c7aa7986dcc3b33989b39773be322fb8407a255d2c7889906a8
      • Opcode Fuzzy Hash: 540f21c433227036eb714c4cc06471b5a8db81d2344e798cb69ba56a66a2e248
      • Instruction Fuzzy Hash: 69B1033060438ADFDF399E75CD91BEA3BB2EF45300F44852ADD8A9B661E3305A41EB11
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C100B4, Relevance: 1.5, Strings: 1, Instructions: 250COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: oLH}
      • API String ID: 0-764773473
      • Opcode ID: f6e5b9e0a277244a9a82f6a34dd5f4d400c83fa9118bf529e50a78bb91c35228
      • Instruction ID: f9960a43a53a26720e3ecb91cc9cbb7879ea2343587e7b902b2b20dfe072e557
      • Opcode Fuzzy Hash: f6e5b9e0a277244a9a82f6a34dd5f4d400c83fa9118bf529e50a78bb91c35228
      • Instruction Fuzzy Hash: 07A13731A05349CFDB34DF2ACD997EA77A3AF46340F59402ECC499B650E734AA80DB41
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C0ECDD, Relevance: 1.4, Strings: 1, Instructions: 102COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: Gf8
      • API String ID: 0-2358942130
      • Opcode ID: 698ac7fa9a16c30732d87508c17710465fd7dff275ac96f8448f73bbaed36040
      • Instruction ID: 05face57ac1f329a740facac51e4a27791664165e18f42149ac713e9da19c60b
      • Opcode Fuzzy Hash: 698ac7fa9a16c30732d87508c17710465fd7dff275ac96f8448f73bbaed36040
      • Instruction Fuzzy Hash: CC3137756082848BEF34DE7ACD443EA7AA3AF94210F59C23A9C4E572C4E3317A429752
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C0E400, Relevance: 1.3, Strings: 1, Instructions: 71COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: .q
      • API String ID: 0-1843157625
      • Opcode ID: 9d0cab120b8f8105f530a00bb67a049ed9d8fa757e9b49c56acb3e50085b8ba5
      • Instruction ID: c8fe149e6fe1c5bbc0b171355e53d62ee290eceba48f48eb84922cf65f4ea343
      • Opcode Fuzzy Hash: 9d0cab120b8f8105f530a00bb67a049ed9d8fa757e9b49c56acb3e50085b8ba5
      • Instruction Fuzzy Hash: AC21D47564438ACBCB30DF68C484AEA63E2BF29700F89866DDC858B255F730A946D706
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04BF4AA2, Relevance: .4, Instructions: 395COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 9fd8b9ca9c29a03a701d3492743c7a2ce2928034376e6bf198f23879d5c41ac8
      • Instruction ID: 6bcc2fe403bb57df3297b401a04af3fb2610edde909884fbc6a7696ccbf946a1
      • Opcode Fuzzy Hash: 9fd8b9ca9c29a03a701d3492743c7a2ce2928034376e6bf198f23879d5c41ac8
      • Instruction Fuzzy Hash: 0FE1D832E185859FCB17EF3CD8CCDE6BBA5AE42624F5543CCE4834A44BE231551BC686
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C000C6, Relevance: .1, Instructions: 99COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e8ffd7e6884c61650175069a6e40082e834981f748c3cae0a522c2991f181201
      • Instruction ID: 0832fcbadcdcf74b4f7f402a0cc3675c6f5e06fe2d9d321817c22003d68e5654
      • Opcode Fuzzy Hash: e8ffd7e6884c61650175069a6e40082e834981f748c3cae0a522c2991f181201
      • Instruction Fuzzy Hash: F241F775605348CBDB34CE2BA9D17EB33A3BF98700F46C52ECC4A4B685D735B6418A85
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C04B8B, Relevance: .0, Instructions: 48COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 7e01c117410fc39e1368157bc4c9cf9280b8ca0a60405592e7f2b7927a61b07b
      • Instruction ID: 6a2c0ef1a8b27048e1e993e1ebdf70b8fd74bd718710ea7385e6637957c475d2
      • Opcode Fuzzy Hash: 7e01c117410fc39e1368157bc4c9cf9280b8ca0a60405592e7f2b7927a61b07b
      • Instruction Fuzzy Hash: DD113132988300DFC7986EA0C9056EABBA2FF59390F02880DDCC653510E3341A92CB07
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C0E990, Relevance: .0, Instructions: 42COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: aec5e0dfa2a00e97126cfe487e842c2f33f8182f52d0c83a80d4e9c4153ad272
      • Instruction ID: b0fab3d80e1f025d7046cb219f9f9d9da91a3a610966ca7e7e0d5abaa44891dd
      • Opcode Fuzzy Hash: aec5e0dfa2a00e97126cfe487e842c2f33f8182f52d0c83a80d4e9c4153ad272
      • Instruction Fuzzy Hash: 58015E75648358CFCB61DF25C984ADA73B2BFA8360F598829D90A8F351CB30BA41DB14
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C0F8DA, Relevance: .0, Instructions: 15COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: f276e8b0d6e8976e4a4fb04b423d91193b99671d5d90f5d861323109a329aafe
      • Instruction ID: cdce7d648c45bad85b55a84a0675a05e4212d6443bbbc460d5ca5b01eb5f7604
      • Opcode Fuzzy Hash: f276e8b0d6e8976e4a4fb04b423d91193b99671d5d90f5d861323109a329aafe
      • Instruction Fuzzy Hash: 81C080056160251D5271553C179406A140791C10A4319CE793445EF589D8E8FFC531E1
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C046A0, Relevance: .0, Instructions: 7COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 95a7b69c8dfc7ed44161c76ebc926b6c030e5a45655e04daf85073892828f8af
      • Instruction ID: 9b198b8e31deeb6f4b2c207cfc0bcab5c4fbf7fa364c3361673f7de07de9c90b
      • Opcode Fuzzy Hash: 95a7b69c8dfc7ed44161c76ebc926b6c030e5a45655e04daf85073892828f8af
      • Instruction Fuzzy Hash: 20C092FA601581CFEF06CB48D581B4473B0FB48B48F0808D0E002CF712C224E900CB00
      Uniqueness

      Uniqueness Score: -1.00%

      Function 04C0C054, Relevance: .0, Instructions: 4COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.1193811530.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
      • Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
      • Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
      • Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10
      Uniqueness

      Uniqueness Score: -1.00%

      Function 0042A934, Relevance: 56.2, APIs: 31, Strings: 1, Instructions: 234COMMON
      Download Yara Rule
      C-Code - Quality: 50%
      			E0042A934(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v28;
				signed int _v32;
				void* _v40;
				void* _v44;
				char _v60;
				signed int _v76;
				intOrPtr _v84;
				char _v92;
				char _v96;
				intOrPtr* _t62;
				char* _t66;
				void* _t68;
				intOrPtr* _t69;
				void* _t70;
				void* _t72;
				intOrPtr* _t73;
				void* _t74;
				void* _t76;
				intOrPtr* _t77;
				void* _t78;
				intOrPtr* _t81;
				intOrPtr* _t83;
				signed int _t86;
				intOrPtr* _t116;
				intOrPtr* _t117;
				intOrPtr* _t118;
				intOrPtr* _t119;
				signed int _t120;
				intOrPtr* _t121;
				intOrPtr* _t122;
				intOrPtr* _t123;
				void* _t124;
				void* _t126;
				intOrPtr _t127;
				intOrPtr _t130;
				intOrPtr _t136;
				intOrPtr _t139;

				_t127 = _t126 - 0xc;
				 *[fs:0x0] = _t127;
				_v16 = _t127 - 0x64;
				_v12 = 0x401118;
				_t86 = 1;
				_v8 = _a4 & _t86;
				_a4 = _a4 & 0xfffffffe;
				_t62 = _a4;
				 *((intOrPtr*)( *_t62 + 4))(_t62, __edi, __esi, __ebx,  *[fs:0x0], 0x4011f6, _t124);
				_push(_t86);
				_push( &_v60);
				_v28 = 0;
				_v32 = 0;
				_v40 = 0;
				_v44 = 0;
				_v60 = 0;
				_v76 = 0;
				_v92 = 0;
				_v96 = 0;
				L00401358();
				_push( &_v60);
				_t66 =  &_v92;
				_push(_t66);
				_v84 = 0x402368;
				_v92 = 0x8008;
				L0040135E();
				L00401352();
				if(_t66 != 0) {
					_t130 =  *0x42f5b4; // 0x223eda4
					if(_t130 == 0) {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
					}
					_t121 =  *0x42f5b4; // 0x223eda4
					_t76 =  *((intOrPtr*)( *_t121 + 0x14))(_t121,  &_v44);
					asm("fclex");
					if(_t76 < 0) {
						_push(0x14);
						_push(0x40237c);
						_push(_t121);
						_push(_t76);
						L00401346();
					}
					_t77 = _v44;
					_t122 = _t77;
					_t78 =  *((intOrPtr*)( *_t77 + 0xb8))(_t77,  &_v96);
					asm("fclex");
					if(_t78 < 0) {
						_push(0xb8);
						_push(0x40239c);
						_push(_t122);
						_push(_t78);
						L00401346();
					}
					L00401340();
					_push(_t86);
					_push(_t86);
					_push(_t86);
					_push( &_v60);
					L0040132E();
					_push( &_v60);
					L00401334();
					L0040133A();
					L00401352();
					_t81 =  *0x42f010; // 0x602500
					if(_t81 == 0) {
						_push(0x42f010);
						_push(0x401bac);
						L0040134C();
						_t81 =  *0x42f010; // 0x602500
					}
					_t83 =  &_v44;
					L00401322();
					_t123 = _t83;
					_t66 =  *((intOrPtr*)( *_t123 + 0x110))(_t123,  &_v40, _t83,  *((intOrPtr*)( *_t81 + 0x304))(_t81));
					asm("fclex");
					if(_t66 < 0) {
						_push(0x110);
						_push(0x4023ac);
						_push(_t123);
						_push(_t66);
						L00401346();
					}
					_push(_v40);
					L00401328();
					L0040131C();
					L00401340();
				}
				_push(L"True");
				L00401316();
				if(_t66 != 0xffff) {
					_t136 =  *0x42f5b4; // 0x223eda4
					if(_t136 == 0) {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
					}
					_t116 =  *0x42f5b4; // 0x223eda4
					_t68 =  *((intOrPtr*)( *_t116 + 0x14))(_t116,  &_v44);
					asm("fclex");
					if(_t68 < 0) {
						_push(0x14);
						_push(0x40237c);
						_push(_t116);
						_push(_t68);
						L00401346();
					}
					_t69 = _v44;
					_t117 = _t69;
					_t70 =  *((intOrPtr*)( *_t69 + 0xe8))(_t69,  &_v40);
					asm("fclex");
					if(_t70 < 0) {
						_push(0xe8);
						_push(0x40239c);
						_push(_t117);
						_push(_t70);
						L00401346();
					}
					_v40 = 0;
					L0040133A();
					L00401340();
					_t139 =  *0x42f5b4; // 0x223eda4
					if(_t139 == 0) {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
					}
					_t118 =  *0x42f5b4; // 0x223eda4
					_t72 =  *((intOrPtr*)( *_t118 + 0x4c))(_t118,  &_v44);
					asm("fclex");
					if(_t72 < 0) {
						_push(0x4c);
						_push(0x40237c);
						_push(_t118);
						_push(_t72);
						L00401346();
					}
					_t73 = _v44;
					_t119 = _t73;
					_t74 =  *((intOrPtr*)( *_t73 + 0x28))(_t73);
					asm("fclex");
					if(_t74 < 0) {
						_push(0x28);
						_push(0x4023cc);
						_push(_t119);
						_push(_t74);
						L00401346();
					}
					L00401340();
					_t120 = _a4;
					L00401310();
					_t66 =  *((intOrPtr*)( *_t120 + 0x64))(_t120, _t74);
					asm("fclex");
					if(_t66 < 0) {
						_push(0x64);
						_push(0x402228);
						_push(_t120);
						_push(_t66);
						L00401346();
					}
				}
				_v8 = 0;
				asm("wait");
				_push(0x42ac21);
				L0040131C();
				L0040131C();
				return _t66;
			}











































      0x0042a937
      0x0042a946
      0x0042a953
      0x0042a956
      0x0042a962
      0x0042a965
      0x0042a968
      0x0042a96c
      0x0042a972
      0x0042a977
      0x0042a97b
      0x0042a97c
      0x0042a97f
      0x0042a982
      0x0042a985
      0x0042a988
      0x0042a98b
      0x0042a98e
      0x0042a991
      0x0042a994
      0x0042a99c
      0x0042a99d
      0x0042a9a0
      0x0042a9a1
      0x0042a9a8
      0x0042a9af
      0x0042a9ba
      0x0042a9c2
      0x0042a9c8
      0x0042a9ce
      0x0042a9d0
      0x0042a9d5
      0x0042a9da
      0x0042a9da
      0x0042a9df
      0x0042a9ec
      0x0042a9ef
      0x0042a9f3
      0x0042a9f5
      0x0042a9f7
      0x0042a9fc
      0x0042a9fd
      0x0042a9fe
      0x0042a9fe
      0x0042aa03
      0x0042aa0d
      0x0042aa0f
      0x0042aa15
      0x0042aa19
      0x0042aa1b
      0x0042aa20
      0x0042aa25
      0x0042aa26
      0x0042aa27
      0x0042aa27
      0x0042aa2f
      0x0042aa34
      0x0042aa35
      0x0042aa36
      0x0042aa3a
      0x0042aa3b
      0x0042aa43
      0x0042aa44
      0x0042aa4e
      0x0042aa56
      0x0042aa5b
      0x0042aa62
      0x0042aa64
      0x0042aa69
      0x0042aa6e
      0x0042aa73
      0x0042aa73
      0x0042aa82
      0x0042aa86
      0x0042aa8e
      0x0042aa94
      0x0042aa9a
      0x0042aa9e
      0x0042aaa0
      0x0042aaa5
      0x0042aaaa
      0x0042aaab
      0x0042aaac
      0x0042aaac
      0x0042aab1
      0x0042aab4
      0x0042aabc
      0x0042aac4
      0x0042aac4
      0x0042aac9
      0x0042aace
      0x0042aad7
      0x0042aadd
      0x0042aae3
      0x0042aae5
      0x0042aaea
      0x0042aaef
      0x0042aaef
      0x0042aaf4
      0x0042ab01
      0x0042ab04
      0x0042ab08
      0x0042ab0a
      0x0042ab0c
      0x0042ab11
      0x0042ab12
      0x0042ab13
      0x0042ab13
      0x0042ab18
      0x0042ab22
      0x0042ab24
      0x0042ab2a
      0x0042ab2e
      0x0042ab30
      0x0042ab35
      0x0042ab3a
      0x0042ab3b
      0x0042ab3c
      0x0042ab3c
      0x0042ab47
      0x0042ab4a
      0x0042ab52
      0x0042ab57
      0x0042ab5d
      0x0042ab5f
      0x0042ab64
      0x0042ab69
      0x0042ab69
      0x0042ab6e
      0x0042ab7b
      0x0042ab7e
      0x0042ab82
      0x0042ab84
      0x0042ab86
      0x0042ab8b
      0x0042ab8c
      0x0042ab8d
      0x0042ab8d
      0x0042ab92
      0x0042ab98
      0x0042ab9a
      0x0042ab9d
      0x0042aba1
      0x0042aba3
      0x0042aba5
      0x0042abaa
      0x0042abab
      0x0042abac
      0x0042abac
      0x0042abb4
      0x0042abbf
      0x0042abc4
      0x0042abcb
      0x0042abce
      0x0042abd2
      0x0042abd4
      0x0042abd6
      0x0042abdb
      0x0042abdc
      0x0042abdd
      0x0042abdd
      0x0042abd2
      0x0042abe2
      0x0042abe5
      0x0042abe6
      0x0042ac13
      0x0042ac1b
      0x0042ac20

      APIs
      • #526.MSVBVM60(?,00000001), ref: 0042A994
      • __vbaVarTstNe.MSVBVM60(?,?,?,00000001), ref: 0042A9AF
      • __vbaFreeVar.MSVBVM60(?,?,?,00000001), ref: 0042A9BA
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4,?,?,?,00000001), ref: 0042A9DA
      • __vbaHresultCheckObj.MSVBVM60(00000000,0223EDA4,0040237C,00000014), ref: 0042A9FE
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040239C,000000B8), ref: 0042AA27
      • __vbaFreeObj.MSVBVM60(00000000,?,0040239C,000000B8), ref: 0042AA2F
      • #539.MSVBVM60(?,00000001,00000001,00000001), ref: 0042AA3B
      • __vbaStrVarMove.MSVBVM60(?,?,00000001,00000001,00000001), ref: 0042AA44
      • __vbaStrMove.MSVBVM60(?,?,00000001,00000001,00000001), ref: 0042AA4E
      • __vbaFreeVar.MSVBVM60(?,?,00000001,00000001,00000001), ref: 0042AA56
      • __vbaNew2.MSVBVM60(00401BAC,0042F010,?,?,00000001,00000001,00000001), ref: 0042AA6E
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042AA86
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004023AC,00000110), ref: 0042AAAC
      • #532.MSVBVM60(?), ref: 0042AAB4
      • __vbaFreeStr.MSVBVM60(?), ref: 0042AABC
      • __vbaFreeObj.MSVBVM60(?), ref: 0042AAC4
      • __vbaBoolStr.MSVBVM60(True,?,?,?,00000001), ref: 0042AACE
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4,True,?,?,?,00000001), ref: 0042AAEF
      • __vbaHresultCheckObj.MSVBVM60(00000000,0223EDA4,0040237C,00000014), ref: 0042AB13
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040239C,000000E8), ref: 0042AB3C
      • __vbaStrMove.MSVBVM60(00000000,?,0040239C,000000E8), ref: 0042AB4A
      • __vbaFreeObj.MSVBVM60(00000000,?,0040239C,000000E8), ref: 0042AB52
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4), ref: 0042AB69
      • __vbaHresultCheckObj.MSVBVM60(00000000,0223EDA4,0040237C,0000004C), ref: 0042AB8D
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004023CC,00000028), ref: 0042ABAC
      • __vbaFreeObj.MSVBVM60(00000000,?,004023CC,00000028), ref: 0042ABB4
      • __vbaFpI4.MSVBVM60(00000000,?,004023CC,00000028), ref: 0042ABC4
      • __vbaHresultCheckObj.MSVBVM60(00000000,000000FE,00402228,00000064), ref: 0042ABDD
      • __vbaFreeStr.MSVBVM60(0042AC21,True,?,?,?,00000001), ref: 0042AC13
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1191724406.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1191719786.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191812090.000000000042F000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191818167.0000000000431000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckFreeHresult$New2$Move$#526#532#539Bool
      • String ID: True
      • API String ID: 2916232083-1573839795
      • Opcode ID: d21ac2f9756c34b8a74d765d9b1e185aaeb5d1cd4a6e170515e59d43617b618e
      • Instruction ID: eee5ac21ca96bd58c219fff64775f251e41dda24355e8548afabaa71934d1f9b
      • Opcode Fuzzy Hash: d21ac2f9756c34b8a74d765d9b1e185aaeb5d1cd4a6e170515e59d43617b618e
      • Instruction Fuzzy Hash: 62819271A40214ABDB10EFA1D98AEDE7BB8EF58314F94043BF900B71E1D7786945CB68
      Uniqueness

      Uniqueness Score: -1.00%

      Function 0042B38A, Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 135COMMON
      Download Yara Rule
      C-Code - Quality: 44%
      			E0042B38A(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				char _v76;
				signed int _t29;
				intOrPtr* _t30;
				intOrPtr* _t32;
				void* _t34;
				void* _t38;
				intOrPtr* _t39;
				void* _t40;
				intOrPtr* _t42;
				intOrPtr* _t66;
				intOrPtr* _t67;
				signed int _t70;
				intOrPtr _t74;

				_push(0x4011f6);
				_t29 =  *[fs:0x0];
				_push(_t29);
				 *[fs:0x0] = _t70;
				_v12 = _t70 - 0x4c;
				_v8 = 0x4011a0;
				_push(2);
				_push(0x402418);
				_v32 = 0;
				_v36 = 0;
				_v40 = 0;
				_v56 = 0;
				_v76 = 0;
				L004012E6();
				L0040133A();
				_push(_t29);
				_push(0x402424);
				L004012EC();
				asm("sbb esi, esi");
				L0040131C();
				if( ~( ~( ~_t29)) != 0) {
					_push(L"EVADNE");
					_push(L"Jaimie6");
					_push(L"Sikkerhedkopiering6");
					_push(L"forureningsforebyggendes");
					L004012E0();
					_push(L"17:17:17");
					_push( &_v56);
					L004012DA();
					_push( &_v56);
					L00401334();
					L0040133A();
					L00401352();
					_t74 =  *0x42f5b4; // 0x223eda4
					if(_t74 == 0) {
						_push(0x42f5b4);
						_push(0x40238c);
						L0040134C();
					}
					_t66 =  *0x42f5b4; // 0x223eda4
					_t38 =  *((intOrPtr*)( *_t66 + 0x1c))(_t66,  &_v40);
					asm("fclex");
					if(_t38 < 0) {
						_push(0x1c);
						_push(0x40237c);
						_push(_t66);
						_push(_t38);
						L00401346();
					}
					_t39 = _v40;
					_t67 = _t39;
					_t40 =  *((intOrPtr*)( *_t39 + 0x64))(_t39, 1,  &_v76);
					asm("fclex");
					if(_t40 < 0) {
						_push(0x64);
						_push(0x4024e0);
						_push(_t67);
						_push(_t40);
						L00401346();
					}
					L00401340();
				}
				_t30 =  *0x42f010; // 0x602500
				if(_t30 == 0) {
					_push(0x42f010);
					_push(0x401bac);
					L0040134C();
					_t30 =  *0x42f010; // 0x602500
				}
				_t32 =  &_v40;
				L00401322();
				_v64 = 0x80020004;
				_v72 = 0xa;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t42 = _t32;
				asm("movsd");
				_t34 =  *((intOrPtr*)( *_t42 + 0x1b0))(_t42, _t32,  *((intOrPtr*)( *_t30 + 0x304))(_t30));
				asm("fclex");
				if(_t34 < 0) {
					_push(0x1b0);
					_push(0x4023ac);
					_push(_t42);
					_push(_t34);
					L00401346();
				}
				L00401340();
				_v28 = 0x3458;
				_push(0x42b54d);
				L0040131C();
				return _t34;
			}

























      0x0042b38f
      0x0042b394
      0x0042b39a
      0x0042b39b
      0x0042b3a8
      0x0042b3ab
      0x0042b3b4
      0x0042b3b6
      0x0042b3bb
      0x0042b3be
      0x0042b3c1
      0x0042b3c4
      0x0042b3c7
      0x0042b3ca
      0x0042b3d4
      0x0042b3d9
      0x0042b3da
      0x0042b3df
      0x0042b3e8
      0x0042b3f1
      0x0042b3f9
      0x0042b3ff
      0x0042b404
      0x0042b409
      0x0042b40e
      0x0042b413
      0x0042b418
      0x0042b420
      0x0042b421
      0x0042b429
      0x0042b42a
      0x0042b434
      0x0042b43c
      0x0042b441
      0x0042b447
      0x0042b449
      0x0042b44e
      0x0042b453
      0x0042b453
      0x0042b458
      0x0042b465
      0x0042b468
      0x0042b46c
      0x0042b46e
      0x0042b470
      0x0042b475
      0x0042b476
      0x0042b477
      0x0042b477
      0x0042b47c
      0x0042b488
      0x0042b48a
      0x0042b48d
      0x0042b491
      0x0042b493
      0x0042b495
      0x0042b49a
      0x0042b49b
      0x0042b49c
      0x0042b49c
      0x0042b4a4
      0x0042b4a4
      0x0042b4a9
      0x0042b4b0
      0x0042b4b2
      0x0042b4b7
      0x0042b4bc
      0x0042b4c1
      0x0042b4c1
      0x0042b4d0
      0x0042b4d4
      0x0042b4dc
      0x0042b4e3
      0x0042b4ef
      0x0042b4f0
      0x0042b4f1
      0x0042b4f2
      0x0042b4f7
      0x0042b4f8
      0x0042b500
      0x0042b502
      0x0042b504
      0x0042b509
      0x0042b50e
      0x0042b50f
      0x0042b510
      0x0042b510
      0x0042b518
      0x0042b51d
      0x0042b524
      0x0042b547
      0x0042b54c

      APIs
      • #512.MSVBVM60(00402418,00000002), ref: 0042B3CA
      • __vbaStrMove.MSVBVM60(00402418,00000002), ref: 0042B3D4
      • __vbaStrCmp.MSVBVM60(00402424,00000000,00402418,00000002), ref: 0042B3DF
      • __vbaFreeStr.MSVBVM60(00402424,00000000,00402418,00000002), ref: 0042B3F1
      • #690.MSVBVM60(forureningsforebyggendes,Sikkerhedkopiering6,Jaimie6,EVADNE,00402424,00000000,00402418,00000002), ref: 0042B413
      • #541.MSVBVM60(?,17:17:17,forureningsforebyggendes,Sikkerhedkopiering6,Jaimie6,EVADNE,00402424,00000000,00402418,00000002), ref: 0042B421
      • __vbaStrVarMove.MSVBVM60(?,?,17:17:17,forureningsforebyggendes,Sikkerhedkopiering6,Jaimie6,EVADNE,00402424,00000000,00402418,00000002), ref: 0042B42A
      • __vbaStrMove.MSVBVM60(?,?,17:17:17,forureningsforebyggendes,Sikkerhedkopiering6,Jaimie6,EVADNE,00402424,00000000,00402418,00000002), ref: 0042B434
      • __vbaFreeVar.MSVBVM60(?,?,17:17:17,forureningsforebyggendes,Sikkerhedkopiering6,Jaimie6,EVADNE,00402424,00000000,00402418,00000002), ref: 0042B43C
      • __vbaNew2.MSVBVM60(0040238C,0042F5B4,?,?,17:17:17,forureningsforebyggendes,Sikkerhedkopiering6,Jaimie6,EVADNE,00402424,00000000,00402418,00000002), ref: 0042B453
      • __vbaHresultCheckObj.MSVBVM60(00000000,0223EDA4,0040237C,0000001C), ref: 0042B477
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004024E0,00000064), ref: 0042B49C
      • __vbaFreeObj.MSVBVM60(00000000,?,004024E0,00000064), ref: 0042B4A4
      • __vbaNew2.MSVBVM60(00401BAC,0042F010,00402424,00000000,00402418,00000002), ref: 0042B4BC
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042B4D4
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004023AC,000001B0), ref: 0042B510
      • __vbaFreeObj.MSVBVM60(00000000,00000000,004023AC,000001B0), ref: 0042B518
      • __vbaFreeStr.MSVBVM60(0042B54D), ref: 0042B547
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1191724406.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1191719786.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191812090.000000000042F000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191818167.0000000000431000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresultMove$New2$#512#541#690
      • String ID: 17:17:17$EVADNE$Jaimie6$Sikkerhedkopiering6$X4$forureningsforebyggendes
      • API String ID: 509014564-2754207988
      • Opcode ID: 47e6c6a805af6dbf2c908de4f67353a3b2e1b48b0ce6aee00380844cad00a5c8
      • Instruction ID: 7c8b6068a66c8e573243ee70223de2b6d94009e2cb81fa34890380416baed3ae
      • Opcode Fuzzy Hash: 47e6c6a805af6dbf2c908de4f67353a3b2e1b48b0ce6aee00380844cad00a5c8
      • Instruction Fuzzy Hash: 8B418371A40214ABDB10FFA5DD8AE9E77B8EF54704FA0403BF501B71E2D7BC690586A8
      Uniqueness

      Uniqueness Score: -1.00%

      Function 0042B6C1, Relevance: 28.7, APIs: 19, Instructions: 151COMMON
      Download Yara Rule
      C-Code - Quality: 56%
      			E0042B6C1(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				short _v28;
				char _v32;
				char _v36;
				intOrPtr _v44;
				char _v52;
				intOrPtr _v60;
				char _v68;
				intOrPtr _v76;
				char _v84;
				intOrPtr _v92;
				char _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				short _v168;
				char* _t53;
				char* _t55;
				intOrPtr* _t56;
				char _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t62;
				void* _t64;
				intOrPtr* _t71;
				intOrPtr _t95;
				intOrPtr* _t97;
				intOrPtr _t102;

				_push(0x4011f6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t102;
				_v12 = _t102 - 0xa8;
				_v8 = 0x4011c0;
				_t95 = 8;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v52 = 0;
				_v68 = 0;
				_v84 = 0;
				_v100 = 0;
				_v168 = 0;
				_v108 = 0x402504;
				_v116 = _t95;
				L004012CE();
				_t53 =  &_v52;
				_push(_t53);
				L004012BC();
				L00401352();
				if( ~(0 | _t53 != _t95) != 0) {
					L004012B6();
					L0040133A();
					_push(1);
					_push(1);
					_push(1);
					_push( &_v52);
					L0040132E();
					_t55 =  &_v52;
					_push(_t55);
					L00401334();
					L0040133A();
					L00401352();
					L004012B0();
					_push(_t55);
					_t56 =  &_v36;
					_push(_t56);
					L00401322();
					_t71 = _t56;
					_t57 = 0xa;
					_v100 = _t57;
					_v84 = _t57;
					_v68 = _t57;
					_v52 = _t57;
					_t58 =  *0x42f010; // 0x602500
					_v92 = 0x80020004;
					_v76 = 0x80020004;
					_v60 = 0x80020004;
					_v44 = 0x80020004;
					if(_t58 == 0) {
						_push(0x42f010);
						_push(0x401bac);
						L0040134C();
						_t58 =  *0x42f010; // 0x602500
					}
					_t60 =  &_v32;
					L00401322();
					_t97 = _t60;
					_t62 =  *((intOrPtr*)( *_t97 + 0x1e8))(_t97,  &_v168, _t60,  *((intOrPtr*)( *_t58 + 0x300))(_t58));
					asm("fclex");
					if(_t62 < 0) {
						_push(0x1e8);
						_push(0x402508);
						_push(_t97);
						_push(_t62);
						L00401346();
					}
					_t64 =  *((intOrPtr*)( *_t71 + 0x44))(_t71, _v168,  &_v52,  &_v68,  &_v84,  &_v100);
					asm("fclex");
					if(_t64 < 0) {
						_push(0x44);
						_push(0x402518);
						_push(_t71);
						_push(_t64);
						L00401346();
					}
					_push( &_v36);
					_push( &_v32);
					_push(2);
					L004012AA();
					_push( &_v100);
					_push( &_v84);
					_push( &_v68);
					_t53 =  &_v52;
					_push(_t53);
					_push(4);
					L0040130A();
				}
				_push(0x42b8aa);
				L0040131C();
				L0040131C();
				return _t53;
			}
































      0x0042b6c6
      0x0042b6d1
      0x0042b6d2
      0x0042b6e2
      0x0042b6e5
      0x0042b6f0
      0x0042b6f7
      0x0042b6fa
      0x0042b6fd
      0x0042b700
      0x0042b703
      0x0042b706
      0x0042b709
      0x0042b70c
      0x0042b70f
      0x0042b715
      0x0042b71c
      0x0042b71f
      0x0042b724
      0x0042b727
      0x0042b728
      0x0042b73c
      0x0042b744
      0x0042b74a
      0x0042b754
      0x0042b759
      0x0042b75b
      0x0042b75d
      0x0042b762
      0x0042b763
      0x0042b768
      0x0042b76b
      0x0042b76c
      0x0042b776
      0x0042b77e
      0x0042b783
      0x0042b788
      0x0042b789
      0x0042b78c
      0x0042b78d
      0x0042b792
      0x0042b796
      0x0042b79c
      0x0042b79f
      0x0042b7a2
      0x0042b7a5
      0x0042b7a8
      0x0042b7af
      0x0042b7b2
      0x0042b7b5
      0x0042b7b8
      0x0042b7bb
      0x0042b7bd
      0x0042b7c2
      0x0042b7c7
      0x0042b7cc
      0x0042b7cc
      0x0042b7db
      0x0042b7df
      0x0042b7ea
      0x0042b7f0
      0x0042b7f6
      0x0042b7fa
      0x0042b7fc
      0x0042b801
      0x0042b806
      0x0042b807
      0x0042b808
      0x0042b808
      0x0042b828
      0x0042b82d
      0x0042b82f
      0x0042b831
      0x0042b833
      0x0042b838
      0x0042b839
      0x0042b83a
      0x0042b83a
      0x0042b842
      0x0042b846
      0x0042b847
      0x0042b849
      0x0042b851
      0x0042b855
      0x0042b859
      0x0042b85a
      0x0042b85d
      0x0042b85e
      0x0042b860
      0x0042b865
      0x0042b868
      0x0042b89c
      0x0042b8a4
      0x0042b8a9

      APIs
      • __vbaVarDup.MSVBVM60 ref: 0042B71F
      • #563.MSVBVM60(?), ref: 0042B728
      • __vbaFreeVar.MSVBVM60(?), ref: 0042B73C
      • #611.MSVBVM60(?), ref: 0042B74A
      • __vbaStrMove.MSVBVM60(?), ref: 0042B754
      • #539.MSVBVM60(?,00000001,00000001,00000001,?), ref: 0042B763
      • __vbaStrVarMove.MSVBVM60(?,?,00000001,00000001,00000001,?), ref: 0042B76C
      • __vbaStrMove.MSVBVM60(?,?,00000001,00000001,00000001,?), ref: 0042B776
      • __vbaFreeVar.MSVBVM60(?,?,00000001,00000001,00000001,?), ref: 0042B77E
      • #685.MSVBVM60(?,?,00000001,00000001,00000001,?), ref: 0042B783
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,00000001,00000001,00000001,?), ref: 0042B78D
      • __vbaNew2.MSVBVM60(00401BAC,0042F010,?,00000000,?,?,00000001,00000001,00000001,?), ref: 0042B7C7
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042B7DF
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402508,000001E8), ref: 0042B808
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402518,00000044), ref: 0042B83A
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042B849
      • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,00000002,?,?), ref: 0042B860
      • __vbaFreeStr.MSVBVM60(0042B8AA,?), ref: 0042B89C
      • __vbaFreeStr.MSVBVM60(0042B8AA,?), ref: 0042B8A4
      Memory Dump Source
      • Source File: 00000000.00000002.1191724406.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1191719786.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191812090.000000000042F000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1191818167.0000000000431000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$Move$CheckHresultList$#539#563#611#685New2
      • String ID:
      • API String ID: 401280197-0
      • Opcode ID: ec5fa6d15dd9cd53944810b568695504963184bd6d959c4d517d60b65d027325
      • Instruction ID: baf0d10eb9a5b419a223cc6c95f14da7fa83309385c4ed17ffde0e0f59fd9816
      • Opcode Fuzzy Hash: ec5fa6d15dd9cd53944810b568695504963184bd6d959c4d517d60b65d027325
      • Instruction Fuzzy Hash: BD5119B1A10228ABDB14EBD4DC86EEEB7B8BF08704F54012FF505F7191DB7859058B98
      Uniqueness

      Uniqueness Score: -1.00%