Play interactive tour

Edit tour

Windows Analysis Report 2GirCpksIO

Overview

General Information

Sample Name:	2GirCpksIO (renamed file extension from none to exe)
Analysis ID:	526365
MD5:	5cc619f7dd365ec061f1f385d25bea30
SHA1:	5b28cb97973da18953fb284648f13257f0aba2f3
SHA256:	7f5124088c09a925ad3a162b4e56391557dfc7d9950b9a55044036698d369d13
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Potential malicious icon found

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

2GirCpksIO.exe (PID: 6604 cmdline: "C:\Users\user\Desktop\2GirCpksIO.exe" MD5: 5CC619F7DD365EC061F1F385D25BEA30)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://afrocompass.com/karinedocesesalgados_Hpi"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://afrocompass.com/karinedocesesalgados_Hpi"}

Multi AV Scanner detection for submitted file

Show sources

Source: 2GirCpksIO.exe	Virustotal: Detection: 32%			Perma Link
Source: 2GirCpksIO.exe	ReversingLabs: Detection: 20%

Machine Learning detection for sample

Show sources

Source: 2GirCpksIO.exe

Joe Sandbox ML: detected

Source: 2GirCpksIO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://afrocompass.com/karinedocesesalgados_Hpi

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: 2GirCpksIO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 2GirCpksIO.exe, 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSORNER.exe vs 2GirCpksIO.exe
Source: 2GirCpksIO.exe	Binary or memory string: OriginalFilenameSORNER.exe vs 2GirCpksIO.exe

Source: 2GirCpksIO.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293BE72	0_2_0293BE72
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_029418A6	0_2_029418A6
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293B688	0_2_0293B688
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_029402D0	0_2_029402D0
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293BA6E	0_2_0293BA6E
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293C399	0_2_0293C399
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_029303EC	0_2_029303EC
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293EC0A	0_2_0293EC0A
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293E876	0_2_0293E876

Source: C:\Users\user\Desktop\2GirCpksIO.exe

Code function: 0_2_0293BE72 NtAllocateVirtualMemory,

0_2_0293BE72

Source: C:\Users\user\Desktop\2GirCpksIO.exe

Process Stats: CPU usage > 98%

Source: 2GirCpksIO.exe	Virustotal: Detection: 32%
Source: 2GirCpksIO.exe	ReversingLabs: Detection: 20%

Source: 2GirCpksIO.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2GirCpksIO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\2GirCpksIO.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal84.rans.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_00407447 push esi; ret	0_2_00407448
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_004084D6 push ebp; retf	0_2_0040856D
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0040688C pushfd ; iretd	0_2_0040688D
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0040856E push ebp; retf	0_2_0040856D
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_00404572 push ecx; ret	0_2_0040459E
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_004091FD push ss; retf	0_2_00409213
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0040798C pushfd ; ret	0_2_004079A0
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_004085A1 push ebp; retf	0_2_0040856D
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_004059BD pushad ; retf 0008h	0_2_004059BE
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_00405EA9 push edi; retf	0_2_00405EAA
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0040937F push FFFFFFDFh; ret	0_2_00409385
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_00408325 push dword ptr [edi]; ret	0_2_00408328
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_00407B9F push esi; ret	0_2_00407BCB
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02041EF5 push edx; ret	0_2_02041F21
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02044205 push edx; ret	0_2_02044231
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02042A05 push edx; ret	0_2_02042A31
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02041205 push edx; ret	0_2_02041231
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02045A03 push edx; ret	0_2_02045A31
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02046214 push edx; ret	0_2_02046241
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02044A13 push edx; ret	0_2_02044A41
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02043213 push edx; ret	0_2_02043241
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02041A13 push edx; ret	0_2_02041A41
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02040218 push edx; ret	0_2_02040241
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02043A24 push edx; ret	0_2_02043A51
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02042224 push edx; ret	0_2_02042251
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02040A24 push edx; ret	0_2_02040A51
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02046A24 push edx; ret	0_2_02046A51
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02045225 push edx; ret	0_2_02045251
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02044233 push edx; ret	0_2_02044261
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02042A33 push edx; ret	0_2_02042A61
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_02041233 push edx; ret	0_2_02041261

Source: initial sample

Static PE information: section name: .text entropy: 6.86127779315

Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\2GirCpksIO.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_029402D0 mov eax, dword ptr fs:[00000030h]	0_2_029402D0
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293EE31 mov eax, dword ptr fs:[00000030h]	0_2_0293EE31
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293B87D mov eax, dword ptr fs:[00000030h]	0_2_0293B87D
Source: C:\Users\user\Desktop\2GirCpksIO.exe	Code function: 0_2_0293E553 mov eax, dword ptr fs:[00000030h]	0_2_0293E553

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\2GirCpksIO.exe

Code function: 0_2_029418A6 RtlAddVectoredExceptionHandler,

0_2_029418A6

Source: 2GirCpksIO.exe, 00000000.00000002.780409814.0000000000C20000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 2GirCpksIO.exe, 00000000.00000002.780409814.0000000000C20000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: 2GirCpksIO.exe, 00000000.00000002.780409814.0000000000C20000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: 2GirCpksIO.exe, 00000000.00000002.780409814.0000000000C20000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: 2GirCpksIO.exe, 00000000.00000002.780409814.0000000000C20000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
2GirCpksIO.exe	32%	Virustotal	Browse
2GirCpksIO.exe	20%	ReversingLabs
2GirCpksIO.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://afrocompass.com/karinedocesesalgados_Hpi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://afrocompass.com/karinedocesesalgados_Hpi	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	526365
Start date:	22.11.2021
Start time:	15:16:43
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2GirCpksIO (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 17.9% (good quality ratio 12.1%) Quality average: 38.5% Quality standard deviation: 35.1%
HCA Information:	Successful, ratio: 52% Number of executed functions: 7 Number of non-executed functions: 13
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.550902828543532
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2GirCpksIO.exe
File size:	114688
MD5:	5cc619f7dd365ec061f1f385d25bea30
SHA1:	5b28cb97973da18953fb284648f13257f0aba2f3
SHA256:	7f5124088c09a925ad3a162b4e56391557dfc7d9950b9a55044036698d369d13
SHA512:	bc3f1c85c20d22c7124ed93987f49d32cbe21639d7078ff0cb11dc5f439342f9609ba78c92b097affd610ee878372e8673a12829ba16ee70b73c1470f1124cd7
SSDEEP:	1536:SIQo1sxasghSzS9Qu2cRs/UVCNmETDFdnvr3Syjh3sMU+Wi04Mthlxxx:X51sxXiQu2cRss8mSFROyjh3s6W2u
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L....5.a.....................@....................@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401398
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x619B35E8 [Mon Nov 22 06:17:12 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6161f2da031dac68f8cae17819217d19

Entrypoint Preview

Instruction
push 0040144Ch
call 00007F1A60A16F03h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
mov dl, 93h
int1
or eax, 9B479C46h
mov ah, 10h
dec esi
lds ebx, esp
loope 00007F1A60A16EABh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [ebx], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc esi
dec ecx
dec ebp
push ebx
inc ebp
inc esp
inc ebp
push ebx
add byte ptr [eax], cl
inc ecx
add al, dh
pop es
inc ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], al
add byte ptr [esi+40h], cl
add byte ptr [edi], al
add byte ptr [eax], al
add byte ptr [ecx], bh
inc eax
add byte ptr [edi], al
add byte ptr [eax], al
add ah, dl
and byte ptr [eax+00h], al
pop es
add byte ptr [eax], al
add byte ptr [eax+40h], bh
add byte ptr [ecx], al
add byte ptr [edx], al
add byte ptr [eax+1Ch], ah
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18764	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1b000	0x1ede	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x148	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17cac	0x18000	False	0.631123860677	data	6.86127779315	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x19000	0x11dc	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1b000	0x1ede	0x2000	False	0.205200195312	data	4.84044222159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
45	0x1ca92	0x420	ASCII text, with CRLF line terminators	English	United States
CUSTOM	0x1c672	0x420	ASCII text, with CRLF line terminators	English	United States
CUSTOM	0x1c252	0x420	ASCII text, with CRLF line terminators	English	United States
CUSTOM	0x1be16	0x43c	ASCII text, with CRLF line terminators	English	United States
CUSTOM	0x1ba94	0x382	ASCII text, with CRLF line terminators	English	United States
RT_ICON	0x1b964	0x130	data
RT_ICON	0x1b67c	0x2e8	data
RT_ICON	0x1b554	0x128	GLS_BINARY_LSB_FIRST
RT_STRING	0x1ceb2	0x2c	data	English	United States
RT_GROUP_ICON	0x1b524	0x30	data
RT_VERSION	0x1b2d0	0x254	data

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaR8Str, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarAdd, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0000 0x04b0
InternalName	SORNER
FileVersion	1.00
CompanyName	Fireflies.ai
Comments	Fireflies.ai
ProductName	Fireflies.ai
ProductVersion	1.00
OriginalFilename	SORNER.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: 2GirCpksIO.exe PID: 6604 Parent PID: 6136

General

Start time:	15:17:46
Start date:	22/11/2021
Path:	C:\Users\user\Desktop\2GirCpksIO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2GirCpksIO.exe"
Imagebase:	0x400000
File size:	114688 bytes
MD5 hash:	5CC619F7DD365EC061F1F385D25BEA30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 2GirCpksIO.exe PID: 6604 Parent PID: 6136 2GirCpksIO.exeCOMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	17.3%
Signature Coverage:	10.4%
Total number of Nodes:	202
Total number of Limit Nodes:	16

Executed Functions

Function 029418A6, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o\t{, xrefs: 02941E8E

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: o\t{
API String ID: 0-2871262171
Opcode ID: 631a3e53dabccdd958e877223b76de1c63b597dfc24196206a704673b74c149c
Instruction ID: 822886c321ebaa374c06188583adc976156309acdd8b8bd98e03cdc73b8a4212
Opcode Fuzzy Hash: 631a3e53dabccdd958e877223b76de1c63b597dfc24196206a704673b74c149c
Instruction Fuzzy Hash: 0EB148316043468FDB35DE74CA657EA37A2EF91350FD5862ACC8E8B654DB3089C6CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0293BE72, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 307
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(AC6A510D), ref: 0293C131

Strings

HNi, xrefs: 0293E656

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: HNi
API String ID: 2167126740-709816660
Opcode ID: ed59b83e1d0eb83386aae0944fce43643970a2adc422caa79f18f622ff2cacd0
Instruction ID: 2d59d22381363dec1469fcf0c3c82ebfb6ff54a9b45bc4be8cd4403ca261894b
Opcode Fuzzy Hash: ed59b83e1d0eb83386aae0944fce43643970a2adc422caa79f18f622ff2cacd0
Instruction Fuzzy Hash: 0BA13831604B499BDF329E78CDA17EE3BA6EF46750F54062ADCC9AB252D3308A45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00416740, Relevance: 386.4, APIs: 191, Strings: 29, Instructions: 1360COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,004024C4,00000008), ref: 00416800
__vbaOnError.MSVBVM60(00000000), ref: 00416807
__vbaR8Str.MSVBVM60(00402180), ref: 00416812
#703.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041684C
__vbaStrMove.MSVBVM60 ref: 00416857
__vbaFreeVar.MSVBVM60 ref: 00416863
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 0041687B
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 004168A9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000140), ref: 004168DD
__vbaFreeObj.MSVBVM60 ref: 004168EB
#554.MSVBVM60 ref: 004168ED
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00416906
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 0041692E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,000000B8), ref: 0041695A
__vbaFreeObj.MSVBVM60 ref: 00416962
__vbaNew2.MSVBVM60(00401980, V`), ref: 00416977
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416993
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000188), ref: 004169BD
__vbaNew2.MSVBVM60(00401980, V`), ref: 004169D2
__vbaFpI4.MSVBVM60 ref: 004169E6
__vbaHresultCheckObj.MSVBVM60(00000000,00605620,00401EF4,000002C8), ref: 00416A2A
__vbaFreeObj.MSVBVM60 ref: 00416A32
__vbaStrCopy.MSVBVM60 ref: 00416A50
#712.MSVBVM60(?,004021E4,00000000,00000001,000000FF,00000000), ref: 00416A61
__vbaStrMove.MSVBVM60 ref: 00416A6C
__vbaStrCmp.MSVBVM60(004021EC,?), ref: 00416A7B
#554.MSVBVM60 ref: 00416A89
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00416AA1
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00416AC9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000140), ref: 00416AF5
__vbaFreeObj.MSVBVM60 ref: 00416AFD
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00416B16
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00416B3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000060), ref: 00416B64
__vbaStrMove.MSVBVM60 ref: 00416B79
__vbaFreeObj.MSVBVM60 ref: 00416B85
#690.MSVBVM60(Freudianeres,selvfoelgelig,Divisionskampes5,HOSPITANTAKTIVIST), ref: 00416B9F
__vbaNew2.MSVBVM60(00401980, V`), ref: 00416BB8
__vbaObjSetAddref.MSVBVM60(?,00605620), ref: 00416BCB
__vbaLateMemCall.MSVBVM60(?,GoHHm7tJqFWi5VHFhEMOVG3dqkPTt8QP99,00000003), ref: 00416C4F
__vbaCastObj.MSVBVM60(?,00401F24), ref: 00416C64
__vbaObjSet.MSVBVM60( V`,00000000), ref: 00416C70
__vbaFreeObj.MSVBVM60 ref: 00416C7C
__vbaSetSystemError.MSVBVM60 ref: 00416C95
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00416CBD
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00416CE5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000130), ref: 00416D11
__vbaStrMove.MSVBVM60 ref: 00416D26
__vbaFreeObj.MSVBVM60 ref: 00416D32
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00416D4B
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00416D73
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000070), ref: 00416D99
__vbaFreeObj.MSVBVM60 ref: 00416DA1
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00416DCA
__vbaStrMove.MSVBVM60 ref: 00416DDB
__vbaFreeVar.MSVBVM60 ref: 00416DE3
#613.MSVBVM60(?,00000002), ref: 00416E08
__vbaStrVarMove.MSVBVM60(?), ref: 00416E15
__vbaStrMove.MSVBVM60 ref: 00416E20
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00416E32
__vbaNew2.MSVBVM60(00401980, V`), ref: 00416E4E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416E6A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,000000F8), ref: 00416E94
__vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 00416EA8
__vbaNew2.MSVBVM60(00401980, V`), ref: 00416EC4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416EE0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000060), ref: 00416F04
__vbaNew2.MSVBVM60(00401980, V`), ref: 00416F19
__vbaFpI4.MSVBVM60 ref: 00416F2D
__vbaI4Var.MSVBVM60(00000002,?,49A4A430,00000000), ref: 00416F53
__vbaHresultCheckObj.MSVBVM60(00000000,00605620,00401EF4,000002C8), ref: 00416F92
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00416FAF
__vbaFreeVar.MSVBVM60 ref: 00416FBE
__vbaStrToAnsi.MSVBVM60(?,magtbalancernen,002F6E1A), ref: 00416FE1
__vbaSetSystemError.MSVBVM60(00000000), ref: 00416FF3
__vbaFreeStr.MSVBVM60 ref: 00417019
#536.MSVBVM60(?), ref: 0041703C
__vbaStrMove.MSVBVM60 ref: 00417047
__vbaFreeVar.MSVBVM60 ref: 00417053
__vbaStrCopy.MSVBVM60 ref: 00417061
__vbaStrCopy.MSVBVM60 ref: 0041706E
__vbaStrCopy.MSVBVM60 ref: 0041707B
__vbaStrCopy.MSVBVM60 ref: 00417088
__vbaNew2.MSVBVM60(00401980, V`), ref: 0041709D
__vbaObjSet.MSVBVM60(?,00000000), ref: 004170B9
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000158), ref: 004170E3
__vbaStrCopy.MSVBVM60 ref: 004170F5
__vbaFreeStr.MSVBVM60 ref: 004170FD
__vbaFreeObj.MSVBVM60 ref: 00417105
__vbaStrCopy.MSVBVM60 ref: 00417116
__vbaStrCopy.MSVBVM60 ref: 00417123
__vbaNew2.MSVBVM60(00401980, V`), ref: 00417138
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417154
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000050), ref: 00417178
__vbaStrCopy.MSVBVM60 ref: 0041718A
__vbaFreeStr.MSVBVM60 ref: 00417192
__vbaFreeObj.MSVBVM60 ref: 0041719A
__vbaStrCopy.MSVBVM60 ref: 004171AB
__vbaStrCopy.MSVBVM60 ref: 004171B8
__vbaStrCopy.MSVBVM60 ref: 004171C5
__vbaNew2.MSVBVM60(00401980, V`), ref: 004171DA
__vbaObjSet.MSVBVM60(?,00000000), ref: 004171F6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000048), ref: 0041721A
__vbaStrCopy.MSVBVM60 ref: 0041722C
__vbaFreeStr.MSVBVM60 ref: 00417234
__vbaFreeObj.MSVBVM60 ref: 0041723C
__vbaNew2.MSVBVM60(00401980, V`), ref: 00417255
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417271
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000130), ref: 0041729B
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004172B3
__vbaStrVarMove.MSVBVM60(00000000), ref: 004172BD
__vbaStrMove.MSVBVM60 ref: 004172CB
__vbaStrCopy.MSVBVM60 ref: 004172D9
__vbaFreeStr.MSVBVM60 ref: 004172E1
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004172F3
__vbaFreeVar.MSVBVM60 ref: 00417302
__vbaStrCopy.MSVBVM60 ref: 00417313
__vbaStrCopy.MSVBVM60 ref: 00417320
__vbaStrCopy.MSVBVM60 ref: 0041732D
__vbaNew2.MSVBVM60(00401980, V`), ref: 00417342
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041735E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000108), ref: 00417388
__vbaStrCopy.MSVBVM60 ref: 0041739A
__vbaFreeStr.MSVBVM60 ref: 004173A2
__vbaFreeObj.MSVBVM60 ref: 004173AA
__vbaStrCopy.MSVBVM60 ref: 004173BB
__vbaNew2.MSVBVM60(00401980, V`), ref: 004173D0
__vbaObjSet.MSVBVM60(?,00000000), ref: 004173EC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000108), ref: 00417416
__vbaStrCopy.MSVBVM60 ref: 00417428
__vbaFreeStr.MSVBVM60 ref: 00417430
__vbaFreeObj.MSVBVM60 ref: 00417438
__vbaNew2.MSVBVM60(00401980, V`), ref: 00417451
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041746D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000050), ref: 00417491
__vbaStrCopy.MSVBVM60 ref: 004174A3
__vbaFreeStr.MSVBVM60 ref: 004174AB
__vbaFreeObj.MSVBVM60 ref: 004174B3
__vbaNew2.MSVBVM60(00401980, V`), ref: 004174CC
__vbaObjSet.MSVBVM60(?,00000000), ref: 004174E8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000158), ref: 00417512
__vbaStrCopy.MSVBVM60 ref: 00417524
__vbaFreeStr.MSVBVM60 ref: 0041752C
__vbaFreeObj.MSVBVM60 ref: 00417534
__vbaNew2.MSVBVM60(00401980, V`), ref: 0041754D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417569
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000048), ref: 0041758D
__vbaStrCopy.MSVBVM60 ref: 0041759F
__vbaFreeStr.MSVBVM60 ref: 004175A7
__vbaFreeObj.MSVBVM60 ref: 004175AF
__vbaStrCopy.MSVBVM60 ref: 004175C0
__vbaStrCopy.MSVBVM60 ref: 004175CD
__vbaStrCopy.MSVBVM60 ref: 004175DA
__vbaStrCopy.MSVBVM60 ref: 004175E7
__vbaNew2.MSVBVM60(00401980, V`), ref: 004175FC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417618
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000158), ref: 00417642
__vbaStrCopy.MSVBVM60 ref: 00417654
__vbaFreeStr.MSVBVM60 ref: 0041765C
__vbaFreeObj.MSVBVM60 ref: 00417664
__vbaStrCopy.MSVBVM60 ref: 00417675
__vbaStrCopy.MSVBVM60 ref: 00417682
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00417697
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 004176BF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000060), ref: 004176E9
__vbaStrMove.MSVBVM60 ref: 00417702
__vbaFreeObj.MSVBVM60 ref: 0041770E
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00417727
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 0041774F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000070), ref: 00417779
__vbaFreeObj.MSVBVM60 ref: 00417785
#571.MSVBVM60(0000000C), ref: 0041778D
__vbaNew2.MSVBVM60(00401980, V`), ref: 004177A6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004177C2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000188), ref: 004177EC
__vbaFreeObj.MSVBVM60(?,00778A6C), ref: 00417821
__vbaStrCopy.MSVBVM60 ref: 00417850
__vbaStrCopy.MSVBVM60 ref: 0041785D
__vbaFreeStrList.MSVBVM60(00000002,?,?,2133F510,00005B04,?,?,54273D80,00000002), ref: 0041789A
__vbaNew2.MSVBVM60(00401980, V`), ref: 004178B6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004178D8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000108), ref: 004178FE
__vbaNew2.MSVBVM60(00401980, V`), ref: 00417917
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417933
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000178), ref: 00417959
__vbaFreeStr.MSVBVM60(0000379A,?,001DD3EA,00000002), ref: 0041799C
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004179AE

Part of subcall function 00418620: __vbaNew2.MSVBVM60(00401980, V`,004179BC), ref: 00418633
Part of subcall function 00418620: __vbaHresultCheckObj.MSVBVM60(00000000,00605620,00401EF4,000001D4), ref: 0041865D

__vbaNew2.MSVBVM60(00401980, V`), ref: 004179CF
__vbaObjSet.MSVBVM60(?,00000000), ref: 004179EB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000138), ref: 00417A11
__vbaFreeObj.MSVBVM60(?,BBC80000,4202A2AC,1D0EBDC0), ref: 00417A5A

Strings

V`, xrefs: 00416964, 0041696D, 0041697D, 004169BF, 004169C8, 004169D8, 00416BA5, 00416BAE, 00416BBE, 00416C6B, 00416E3B, 00416E44, 00416E54, 00416EB1, 00416EBA, 00416ECA, 00416F06, 00416F0F, 00416F1F, 0041708A, 00417093, 004170A3, 00417125, 0041712E, 0041713E, 004171C7, 004171D0, 004171E0, 00417242, 0041724B, 0041725B, 0041732F, 00417338, 00417348, 004173BD, 004173C6, 004173D6, 0041743E, 00417447, 00417457, 004174B9, 004174C2, 004174D2, 0041753A, 00417543, 00417553, 004175E9, 004175F2, 00417602, 00417793, 0041779C, 004177AC, 004178A3, 004178AC, 004178BC, 00417904, 0041790D, 0041791D, 004179BC, 004179C5, 004179D5
pikparadehairball, xrefs: 00417308
UDST, xrefs: 00417070
val, xrefs: 00416A42
selvfoelgelig, xrefs: 00416B95
Freudianeres, xrefs: 00416B9A
BADEHUSENES, xrefs: 00417852
Byldemoderens, xrefs: 004171BA
UNDERPANTENE, xrefs: 00417118
Hyperemotively7, xrefs: 0041710B
CILIOSPINAL, xrefs: 00416BDC
AZTEKERNESPREANTER, xrefs: 004173B0
Whipple, xrefs: 0041766A
CURATORS, xrefs: 00417063
Antidomestic, xrefs: 00417322
iconianbrevk, xrefs: 004175CF
CASHIERS, xrefs: 00417059
KOMMANDODELS, xrefs: 0041707D
Trichoderma1, xrefs: 00417845
HOSPITANTAKTIVIST, xrefs: 00416B8B
Divisionskampes5, xrefs: 00416B90
GoHHm7tJqFWi5VHFhEMOVG3dqkPTt8QP99, xrefs: 00416C46
CIRCUMCISE, xrefs: 004171A0
brnelrdommene, xrefs: 004175C2
Afsvrgendes, xrefs: 00417315
magtbalancernen, xrefs: 00416FD5, 00417677
selvsikkerhedens, xrefs: 004175DC
Adstadigst, xrefs: 004175B5
PRINTKERNES, xrefs: 004171AD

Memory Dump Source

Source File: 00000000.00000002.779462164.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.779441423.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.779677235.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2GirCpksIO.jbxd

Similarity

API ID: __vba$Free$CheckHresult$Copy$New2$Move$List$CallErrorLate$#554System$#536#571#613#690#703#704#712AddrefAnsiCastConstruct2
String ID: V`$AZTEKERNESPREANTER$Adstadigst$Afsvrgendes$Antidomestic$BADEHUSENES$Byldemoderens$CASHIERS$CILIOSPINAL$CIRCUMCISE$CURATORS$Divisionskampes5$Freudianeres$GoHHm7tJqFWi5VHFhEMOVG3dqkPTt8QP99$HOSPITANTAKTIVIST$Hyperemotively7$KOMMANDODELS$PRINTKERNES$Trichoderma1$UDST$UNDERPANTENE$Whipple$brnelrdommene$iconianbrevk$magtbalancernen$pikparadehairball$selvfoelgelig$selvsikkerhedens$val
API String ID: 1187569605-4198888063
Opcode ID: 39cf138910551542b2e6285b56bcf1bc879978cf6066f8472cb8f789234d8522
Instruction ID: 99724629b65e42402a37dac7863310bb9dc8e832b008dc53b67857a904f9fb4b
Opcode Fuzzy Hash: 39cf138910551542b2e6285b56bcf1bc879978cf6066f8472cb8f789234d8522
Instruction Fuzzy Hash: D0C26E70A002189BDB14DF64CD58FDA7BB8BF48704F1084AAF589E72A0DB749985CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00417C10, Relevance: 75.5, APIs: 36, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#556.MSVBVM60(?,00000000,660E6C4A,660E6BEC), ref: 00417C82
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00417CA4
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00417CC9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,000000E8), ref: 00417CF3
__vbaStrMove.MSVBVM60 ref: 00417D08
__vbaFreeObj.MSVBVM60 ref: 00417D0D
#611.MSVBVM60 ref: 00417D13
__vbaStrMove.MSVBVM60 ref: 00417D1E
#648.MSVBVM60(?), ref: 00417D34
__vbaFreeVar.MSVBVM60 ref: 00417D3D
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00417D55
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00417D7A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,000000C0), ref: 00417DA7
__vbaFreeObj.MSVBVM60 ref: 00417DB0
__vbaEnd.MSVBVM60 ref: 00417DB6
__vbaVarDup.MSVBVM60 ref: 00417DE5
#544.MSVBVM60(?,?), ref: 00417DF3
__vbaVarTstNe.MSVBVM60(?,?), ref: 00417E14
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00417E31
#705.MSVBVM60(?,00000000), ref: 00417E58
__vbaStrMove.MSVBVM60 ref: 00417E63
__vbaFreeVar.MSVBVM60 ref: 00417E6C
#680.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40490000,00000002,?,?), ref: 00417EA5
__vbaFreeVarList.MSVBVM60(00000003,00000002,?,?), ref: 00417EBB
#593.MSVBVM60(00000002), ref: 00417ECA
__vbaFreeVar.MSVBVM60 ref: 00417ED5
#690.MSVBVM60(Nathimle9,staggard,civilianising,Mesmerizing), ref: 00417EEF
__vbaVarDup.MSVBVM60 ref: 00417F24
#595.MSVBVM60(00000002,00000000,?,?,?), ref: 00417F3C
__vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 00417F54
__vbaNew2.MSVBVM60(00401980, V`), ref: 00417F6C
__vbaHresultCheckObj.MSVBVM60(00000000,00605620,00401EF4,000001BC), ref: 00417F95
__vbaAryDestruct.MSVBVM60(00000000,?,00417FF3), ref: 00417FD7
__vbaFreeStr.MSVBVM60 ref: 00417FE6
__vbaFreeStr.MSVBVM60 ref: 00417FEB
__vbaFreeStr.MSVBVM60 ref: 00417FF0

Strings

V`, xrefs: 00417F59, 00417F62, 00417F72
Mesmerizing, xrefs: 00417EDB
Nathimle9, xrefs: 00417EEA
civilianising, xrefs: 00417EE0
Somersaults9, xrefs: 00417F10
10:10:10, xrefs: 00417DD1
staggard, xrefs: 00417EE5

Memory Dump Source

Source File: 00000000.00000002.779462164.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.779441423.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.779677235.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2GirCpksIO.jbxd

Similarity

API ID: __vba$Free$CheckHresult$ListMoveNew2$#544#556#593#595#611#648#680#690#705Destruct
String ID: V`$10:10:10$Mesmerizing$Nathimle9$Somersaults9$civilianising$staggard
API String ID: 2342265087-3338652660
Opcode ID: 5a26a7f984d2c563fcc64d06e6fda8b93474491772b01989c2415a90f9a26989
Instruction ID: 238ceedf53a81b926829ffe75472e2a317f5a3f6de8f2c6cc5780a3186e3f0b2
Opcode Fuzzy Hash: 5a26a7f984d2c563fcc64d06e6fda8b93474491772b01989c2415a90f9a26989
Instruction Fuzzy Hash: 7FB113B1D00209ABDB14DF95DD48BDEBBB8FF48704F10806AE555B72A0DB741A4ACF68

Uniqueness

Uniqueness Score: -1.00%

Function 00417B60, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaVarDup.MSVBVM60(00000000,660E6C4A), ref: 00417BA5
#645.MSVBVM60(?,00000000), ref: 00417BB0
__vbaStrMove.MSVBVM60 ref: 00417BBB
__vbaFreeVar.MSVBVM60 ref: 00417BC4
__vbaFreeStr.MSVBVM60(00417BF3), ref: 00417BEC

Strings

sium, xrefs: 00417B97

Memory Dump Source

Source File: 00000000.00000002.779462164.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.779441423.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.779677235.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2GirCpksIO.jbxd

Similarity

API ID: __vba$Free$#645Move
String ID: sium
API String ID: 3481341938-2122559639
Opcode ID: 02b0e9834526699690009a7ac65ece1a786f7ac24847f47600e0672181c1a16d
Instruction ID: 7f19b18a8ab4bf856bd68d37604afbec7351aa7b8c4e9fe76f8aa97ce2bf3995
Opcode Fuzzy Hash: 02b0e9834526699690009a7ac65ece1a786f7ac24847f47600e0672181c1a16d
Instruction Fuzzy Hash: 0D011EB5C00209DBCB04DFA5DE89ADEBB78FB48745F10812AF511B72A0DB741608CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401398, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 23%

			_entry_() {
				signed char _t559;
				intOrPtr* _t560;
				signed char _t570;
				intOrPtr* _t571;
				intOrPtr* _t572;
				intOrPtr* _t573;
				intOrPtr* _t574;
				intOrPtr* _t575;
				signed char _t576;
				intOrPtr* _t577;
				intOrPtr* _t578;
				intOrPtr* _t580;
				intOrPtr* _t581;
				intOrPtr* _t582;
				intOrPtr* _t584;
				signed char _t585;
				intOrPtr* _t586;
				intOrPtr* _t587;
				void* _t588;
				intOrPtr* _t589;
				intOrPtr* _t591;
				intOrPtr* _t592;
				void* _t593;
				void* _t594;
				intOrPtr* _t595;
				void* _t596;
				void* _t597;
				intOrPtr* _t598;
				intOrPtr* _t599;
				intOrPtr* _t600;
				intOrPtr* _t601;
				intOrPtr* _t603;
				intOrPtr* _t604;
				intOrPtr* _t605;
				intOrPtr* _t607;
				intOrPtr* _t608;
				intOrPtr* _t609;
				intOrPtr* _t611;
				intOrPtr* _t612;
				signed char _t613;
				signed char _t614;
				intOrPtr* _t616;
				signed char _t617;
				intOrPtr* _t619;
				void* _t620;
				signed char _t623;
				intOrPtr* _t625;
				void* _t626;
				intOrPtr* _t629;
				intOrPtr* _t630;
				void* _t632;
				intOrPtr* _t633;
				void* _t634;
				intOrPtr* _t635;
				void* _t636;
				intOrPtr* _t637;
				void* _t638;
				intOrPtr* _t639;
				void* _t640;
				intOrPtr* _t641;
				intOrPtr* _t642;
				intOrPtr* _t654;
				intOrPtr* _t655;
				intOrPtr* _t656;
				signed int _t657;
				signed int _t659;
				signed char _t660;
				signed char _t661;
				signed int _t662;
				signed int _t663;
				signed char _t664;
				signed char _t665;
				signed char _t666;
				signed int* _t667;
				signed int _t669;
				signed int _t670;
				signed char _t671;
				signed int _t674;
				signed int _t739;
				signed char _t742;
				signed int _t743;
				void* _t744;
				intOrPtr* _t745;
				intOrPtr* _t746;
				intOrPtr* _t747;
				signed int _t748;
				void* _t750;
				intOrPtr* _t751;
				intOrPtr* _t752;
				void* _t754;
				intOrPtr* _t756;
				intOrPtr* _t758;
				void* _t760;
				void* _t761;
				void* _t762;
				intOrPtr* _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t785;
				intOrPtr* _t787;
				void* _t789;
				void* _t790;
				intOrPtr* _t792;
				void* _t793;
				void* _t794;
				intOrPtr* _t796;
				intOrPtr* _t798;
				void* _t799;
				void* _t801;
				intOrPtr* _t803;
				intOrPtr* _t806;
				char* _t807;
				signed char _t810;
				void* _t812;
				signed char _t834;
				signed int _t838;
				signed char _t840;
				void* _t850;
				intOrPtr* _t852;
				signed int* _t853;
				signed int* _t854;
				void* _t886;
				intOrPtr* _t888;
				void* _t889;
				intOrPtr* _t894;
				signed int _t895;
				void* _t896;
				void* _t913;
				void* _t914;
				signed int _t915;
				void* _t916;
				void* _t919;
				void* _t920;
				intOrPtr* _t921;
				void* _t923;
				void* _t924;
				void* _t926;
				intOrPtr* _t927;
				signed int _t929;
				signed int _t930;
				void* _t952;
				void* _t953;
				signed int _t957;
				void* _t960;
				void* _t979;
				signed int _t994;
				intOrPtr _t995;
				signed int _t1012;

				_push("VB5!6&*"); // executed
				L00401390(); // executed
				 *_t559 =  *_t559 + _t559;
				 *_t559 =  *_t559 + _t559;
				 *_t559 =  *_t559 + _t559;
				 *_t559 =  *_t559 ^ _t559;
				 *_t559 =  *_t559 + _t559;
				_t560 = _t559 + 1;
				 *_t560 =  *_t560 + _t560;
				 *_t560 =  *_t560 + _t560;
				 *_t560 =  *_t560 + _t560;
				_t745 = _t744 + _t744;
				asm("int1");
				asm("invalid");
				asm("loope 0xffffff9b");
				 *0x10 =  *0x10 + 0x10;
				 *0x10 =  *0x10 + 0x10;
				 *0x10 =  *0x10 + 0x10;
				 *0x10 =  *0x10 + 0x10;
				 *0x10 =  *0x10 + 0x10;
				 *_t745 =  *_t745 + 0x10;
				 *0x10 =  *0x10 + 0x10;
				 *0x10 =  *0x10 + 0x10;
				_t888 = _t886 - 1 + 1;
				_t790 = _t789 - 1;
				_t953 = _t952 + 1;
				_t919 = _t916 - 1 + 2;
				 *0x10 =  *0x10 + _t790;
				es = _t745;
				_t792 = _t790 + 2;
				 *0x000000A3 =  *((intOrPtr*)(0xa3)) + 0xa3;
				 *((intOrPtr*)(0xa3)) =  *((intOrPtr*)(0xa3)) + 0xa3;
				 *_t888 =  *_t888 + 0xa3;
				 *((intOrPtr*)(0xa3)) =  *((intOrPtr*)(0xa3)) + 0xa3;
				 *((intOrPtr*)(_t888 + 0x40)) =  *((intOrPtr*)(_t888 + 0x40)) + _t792;
				 *_t852 =  *_t852 + 0xa3;
				 *((intOrPtr*)(0xa3)) =  *((intOrPtr*)(0xa3)) + 0xa3;
				 *_t792 =  *_t792 + _t745;
				 *_t852 =  *_t852 + 0xa4;
				 *((intOrPtr*)(0xa4)) =  *((intOrPtr*)(0xa4)) + 0xa4;
				 *0x00000137 =  *0x00000137 & 0x137;
				es = _t745;
				 *0x00000137 = 0x137 +  *0x00000137;
				 *0x00000177 =  *((intOrPtr*)(0x177)) + _t745;
				 *_t792 =  *_t792 + 0x137;
				 *0x93 =  *0x93 + 0x137;
				 *0x00000153 =  *((intOrPtr*)(0x153)) + 0x10;
				 *0x00000138 =  *((intOrPtr*)(0x138)) + 0x138;
				 *((intOrPtr*)(0x138)) =  *((intOrPtr*)(0x138)) + 0x138;
				_t746 = _t745 + _t745;
				asm("invalid");
				asm("invalid");
				asm("invalid");
				 *((intOrPtr*)(0x138)) =  *((intOrPtr*)(0x138)) + 1;
				 *((intOrPtr*)(0x138)) =  *((intOrPtr*)(0x138)) + 0x138;
				 *((intOrPtr*)(_t746 - 0x6fcfffc0)) =  *((intOrPtr*)(_t746 - 0x6fcfffc0)) + 0x93;
				_t793 = _t792 + 1;
				 *_t746 =  *_t746 + 0x138;
				 *((intOrPtr*)(0x138)) =  *((intOrPtr*)(0x138)) + 0x138;
				 *0x0000014C =  *((intOrPtr*)(0x14c)) + 0x138;
				 *0x00000139 =  *((intOrPtr*)(0x139)) + 0x139;
				 *((intOrPtr*)(0x139)) =  *((intOrPtr*)(0x139)) + 0x139;
				 *((intOrPtr*)(0x139)) =  *((intOrPtr*)(0x139)) + 0x139;
				 *((intOrPtr*)(0x139)) =  *((intOrPtr*)(0x139)) + 0x139;
				 *((intOrPtr*)(0x139)) =  *((intOrPtr*)(0x139)) + 0x139;
				 *((intOrPtr*)(0x139)) =  *((intOrPtr*)(0x139)) + 0x139;
				 *0x0000014D =  *((intOrPtr*)(0x14d)) + 0x139;
				 *0x00000274 =  *((intOrPtr*)(0x274)) + _t793;
				 *((intOrPtr*)(0x274)) =  *((intOrPtr*)(0x274)) + 0x13a;
				 *((intOrPtr*)(0x13a)) =  *((intOrPtr*)(0x13a)) + 0x13a;
				 *((intOrPtr*)(0x13a)) =  *((intOrPtr*)(0x13a)) + 0x13a;
				 *((intOrPtr*)(0x13a)) =  *((intOrPtr*)(0x13a)) + 0x13a;
				_push(_t888);
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *_t888 =  *_t888 + _t746;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				 *0x2A26371B = 0x2a26371b +  *0x2A26371B;
				_t570 = 0x2a26371b |  *0x2A26371B;
				 *(_t570 + _t570) =  *(_t570 + _t570) | _t570;
				 *_t570 =  *_t570 + _t570;
				 *_t570 =  *_t570 + _t570;
				 *((intOrPtr*)(_t570 + 0x67)) =  *((intOrPtr*)(_t570 + 0x67)) + _t570;
				_t794 = _t793 + 1;
				 *((intOrPtr*)(_t852 + 0xd4)) =  *((intOrPtr*)(_t852 + 0xd4)) + _t570;
				 *((intOrPtr*)(_t570 - 0x10)) =  *((intOrPtr*)(_t570 - 0x10)) + 0x93;
				 *_t570 =  *_t570 ^ _t570;
				_t747 = _t746 + _t746;
				asm("invalid");
				 *_t570 =  *_t570 | _t570;
				 *_t570 =  *_t570 + _t570;
				 *_t570 =  *_t570 + _t570;
				 *_t570 =  *_t570 + _t570;
				_t571 = _t570 +  *_t570;
				 *_t571 =  *_t571 + _t571;
				goto 0xe4401499;
				asm("adc al, 0x40");
				_t572 = _t571 + _t794;
				asm("adc eax, [eax]");
				asm("movsb");
				asm("adc eax, [eax]");
				if (_t572 < 0) goto L2;
				 *_t572 =  *_t572 + _t572;
				if ( *_t572 > 0) goto L3;
				 *_t572 =  *_t572 + _t572;
				_t573 =  *_t572;
				 *_t573 =  *_t573 + _t573;
				 *_t573 = es;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				_push(_t747);
				_t853 = _t852 - 1;
				_push(0x94);
				_t889 = _t888 - 1;
				_t920 = _t919 + 1;
				_push(0x94);
				_t27 = _t889 + 0x65;
				 *_t27 =  *((intOrPtr*)(_t889 + 0x65)) + _t573;
				_push(0x6c);
				if( *_t27 == 0) {
					L6:
					 *_t573 =  *_t573 + _t573;
					_t838 = 0x94 &  *_t853;
					 *((intOrPtr*)(_t838 - 0x48b3086d)) =  *((intOrPtr*)(_t838 - 0x48b3086d)) + _t573;
					asm("out dx, eax");
					asm("loop 0x58");
					asm("clc");
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					_t796 = _t794 - 1 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *_t573 =  *_t573 + _t573;
					 *((intOrPtr*)(_t573 - 0x63ffbfd7)) =  *((intOrPtr*)(_t573 - 0x63ffbfd7)) + _t796;
					 *_t573 =  *_t573 + _t573;
					 *_t796 =  *_t796 + _t573;
					 *_t796 =  *_t796 + _t573;
					 *((intOrPtr*)(_t573 + 0x1c)) =  *((intOrPtr*)(_t573 + 0x1c)) + _t573;
					_t574 = _t573 + 1;
					 *_t574 =  *_t574 + _t574;
					 *_t574 =  *_t574 + _t574;
					 *((intOrPtr*)(_t574 - 0xffbe9a)) =  *((intOrPtr*)(_t574 - 0xffbe9a)) + _t747;
					asm("invalid");
					 *_t574 =  *_t574 + 1;
					 *_t574 =  *_t574 + _t574;
					_t575 = _t574 + _t574;
					asm("sbb al, 0x40");
					 *((intOrPtr*)(_t575 + _t838 * 4)) =  *((intOrPtr*)(_t575 + _t838 * 4)) + _t747;
					 *_t575 =  *_t575 + _t575;
					 *_t575 =  *_t575 + _t575;
					 *((intOrPtr*)(_t575 + 0x934f)) =  *((intOrPtr*)(_t575 + 0x934f)) + _t747;
					 *_t575 =  *_t575 + _t575;
					 *_t575 =  *_t575 + _t575;
					 *_t575 =  *_t575 + _t575;
					 *_t575 =  *_t575 + _t575;
					 *_t575 =  *_t575 + _t575;
					_t576 = _t575 + _t747;
					asm("adc eax, 0x10040");
					 *_t576 =  *_t576 + _t576;
					 *_t576 =  *_t576 | _t576;
					_t577 = _t576 + 1;
					 *_t577 =  *_t577 + _t577;
					 *_t577 =  *_t577 + _t577;
					_t578 = _t577 + _t747;
					asm("adc eax, 0x10040");
					 *_t578 =  *_t578 + _t578;
					_t580 = _t578 + 0x17;
					 *_t580 =  *_t580 + _t580;
					 *_t580 =  *_t580 + _t580;
					 *_t580 =  *_t580 + _t580;
					_t581 = _t580 + 1;
					 *_t838 =  *_t838 + _t581;
					 *_t581 =  *_t581 + _t581;
					 *((intOrPtr*)(_t889 + _t838)) =  *((intOrPtr*)(_t889 + _t838)) + _t581;
					_t582 = _t581 + 1;
					 *_t582 =  *_t582 + _t582;
					_t853[0x1b001a00] = _t853[0x1b001a00] + _t838;
					 *((intOrPtr*)(_t889 + _t838 + 0x40)) =  *((intOrPtr*)(_t889 + _t838 + 0x40)) + _t838;
					_t584 = _t747;
					_t748 = _t582 + _t838;
					_t798 = _t796 + 2;
					 *_t584 =  *_t584 + _t584;
					 *_t584 =  *_t584 + _t584;
					 *((intOrPtr*)(_t748 + 0x20180095 + _t748 * 8)) =  *((intOrPtr*)(_t748 + 0x20180095 + _t748 * 8)) + _t584;
					_t585 = _t584 + 1;
					 *_t585 =  *_t585 + _t798;
					 *_t585 =  *_t585 & _t585;
					_t586 = _t585 + 1;
					 *_t798 =  *_t798 + _t838;
					 *((intOrPtr*)(_t586 + _t586)) =  *((intOrPtr*)(_t586 + _t586)) + _t838;
					 *_t586 =  *_t586 + _t586;
					_t587 = _t586 + 1;
					 *_t798 =  *_t798 + _t587;
					 *_t748 =  *_t748 + _t587;
					 *_t587 =  *_t587 + _t587;
					 *_t587 =  *_t587 + _t587;
					 *_t587 =  *_t587 + _t587;
					 *_t587 =  *_t587 + _t587;
					 *((intOrPtr*)(_t889 + _t838 + 0x40)) =  *((intOrPtr*)(_t889 + _t838 + 0x40)) + _t838;
					 *((intOrPtr*)(_t587 - 0x42)) =  *((intOrPtr*)(_t587 - 0x42)) + _t798;
					_t588 = _t920;
					_t921 = _t587;
					 *((intOrPtr*)(_t588 + 0x20)) =  *((intOrPtr*)(_t588 + 0x20)) + _t798;
					_t589 = _t588 + 1;
					 *_t798 =  *_t798 + _t589;
					 *_t748 =  *_t748 + _t589;
					 *_t589 =  *_t589 + _t589;
					ds = ss;
					 *_t589 =  *_t589 + _t748;
					 *_t589 =  *_t589 + _t589;
					_pop(ds);
					_t591 = _t589 + _t838 + 1;
					asm("invalid");
					 *_t591 =  *_t591 + 1;
					 *_t591 =  *_t591 + _t591;
					 *_t591 =  *_t591 + _t591;
					 *_t591 =  *_t591 + _t591;
					 *((intOrPtr*)(_t591 + 0x58004016)) =  *((intOrPtr*)(_t591 + 0x58004016)) + _t838;
					_t592 = _t591 + 1;
					_t750 = _t748 + _t748 + _t748 + _t748;
					asm("invalid");
					 *_t592 =  *_t592 + 1;
					 *_t592 =  *_t592 + _t592;
					 *((intOrPtr*)(0x1fe40095 + _t838)) =  *((intOrPtr*)(0x1fe40095 + _t838)) + _t592;
					_t593 = _t592 + 1;
					 *((intOrPtr*)(_t921 + _t838 + 0x137e0040)) =  *((intOrPtr*)(_t921 + _t838 + 0x137e0040)) + _t593;
					_t594 = _t593 + 1;
					 *((intOrPtr*)(_t750 + _t838 + 0x138a0040)) =  *((intOrPtr*)(_t750 + _t838 + 0x138a0040)) + _t594;
					_t595 = _t594 + 1;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *_t595 =  *_t595 + _t595;
					 *((intOrPtr*)(0x1fe40095 + _t838)) =  *((intOrPtr*)(0x1fe40095 + _t838)) + _t798;
					_t596 = _t595 + 1;
					 *((intOrPtr*)(_t921 + _t838 + 0x137e0040)) =  *((intOrPtr*)(_t921 + _t838 + 0x137e0040)) + _t596;
					_t597 = _t596 + 1;
					 *((intOrPtr*)(_t750 + _t838 + 0x138a0040)) =  *((intOrPtr*)(_t750 + _t838 + 0x138a0040)) + _t597;
					_t598 = _t597 + 1;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					 *_t598 =  *_t598 + _t598;
					_t599 = _t598 + _t838;
					 *_t599 =  *_t599 + _t599;
					 *((intOrPtr*)(_t599 + 0x1c)) =  *((intOrPtr*)(_t599 + 0x1c)) + _t599;
					_t600 = _t599 + 1;
					 *_t600 =  *_t600 + _t600;
					 *_t600 =  *_t600 + _t600;
					 *_t600 =  *_t600 + _t838;
					asm("a16 inc ecx");
					 *((intOrPtr*)(_t600 - 0x79)) =  *((intOrPtr*)(_t600 - 0x79)) + _t600;
					_t799 = _t798 + 1;
					_t601 = _t600 + _t838;
					asm("adc [eax], eax");
					 *_t601 =  *_t601 + _t799;
					 *0x1FE440A6 =  *((intOrPtr*)(0x1fe440a6)) + _t838;
					_t801 = _t799 + 2;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					 *_t601 =  *_t601 + _t601;
					asm("adc eax, [eax]");
					_t603 = _t601 + _t801;
					 *_t603 =  *_t603 + _t603;
					 *_t603 =  *_t603 + _t603;
					 *_t603 =  *_t603 + _t603;
					asm("pushad");
					asm("sbb al, 0x40");
					 *_t603 =  *_t603 + _t603;
					 *_t603 =  *_t603 + _t603;
					 *((intOrPtr*)(_t603 + 0x66)) =  *((intOrPtr*)(_t603 + 0x66)) + _t750;
					_t751 = _t750 + _t750;
					asm("invalid");
					 *_t603 =  *_t603 + 1;
					 *_t603 =  *_t603 + _t603;
					 *((intOrPtr*)(_t953 + _t751 - 0x6ff7ffc0)) =  *((intOrPtr*)(_t953 + _t751 - 0x6ff7ffc0)) + _t838;
					_t803 = _t801 + 2;
					 *_t603 =  *_t603 + _t603;
					 *_t603 =  *_t603 + _t603;
					 *((intOrPtr*)(_t603 + 0x4e)) =  *((intOrPtr*)(_t603 + 0x4e)) + _t751;
					_t604 = _t751;
					_t752 = _t603;
					 *_t604 =  *_t604 + _t604;
					 *_t604 =  *_t604 + _t604;
					 *_t604 =  *_t604 + _t604;
					 *_t604 =  *_t604 + _t604;
					 *_t604 =  *_t604 + _t604;
					 *_t604 =  *_t604 + _t604;
					_t605 = _t604 + _t752;
					asm("sbb [eax], eax");
					 *_t605 =  *_t605 + _t605;
					 *_t605 =  *_t605 + _t605;
					_t607 = _t605 + 0x20;
					 *_t607 =  *_t607 + _t607;
					 *_t607 =  *_t607 + _t607;
					_t608 = _t607 + _t752;
					asm("sbb [eax], eax");
					 *_t608 =  *_t608 + _t608;
					 *_t608 =  *_t608 + _t608;
					 *_t838 =  *_t838 + _t752;
					_t609 = _t608 + 1;
					 *_t609 =  *_t609 + _t609;
					 *_t609 =  *_t609 + _t609;
					asm("sbb [eax], eax");
					_t611 = _t609 + _t752;
					 *_t611 =  *_t611 + _t611;
					 *_t838 =  *_t838 + _t752;
					_t612 = _t611 + 1;
					 *_t612 =  *_t612 + _t612;
					_t853[0x1b001a00] = _t853[0x1b001a00] + _t838;
					 *((intOrPtr*)(_t612 - 0x27ffbfe6)) =  *((intOrPtr*)(_t612 - 0x27ffbfe6)) + _t612;
					0();
					asm("ficom dword [fs:ebp+0x401f1400]");
					 *((intOrPtr*)(_t853 + _t752)) =  *((intOrPtr*)(_t853 + _t752)) + _t612;
					_t613 = _t612 + 1;
					 *_t613 =  *_t613 + _t613;
					asm("adc eax, [eax]");
					_t614 = _t613 ^ 0x00000000;
					 *_t614 =  *_t614 + _t614;
					_t616 = (_t614 ^ 0x0000001f) + 1;
					 *_t752 =  *_t752 + _t616;
					 *_t752 =  *_t752 + _t616;
					 *_t616 =  *_t616 + _t616;
					 *_t616 =  *_t616 + _t616;
					 *_t616 =  *_t616 + _t616;
					 *_t616 =  *_t616 + _t616;
					 *((intOrPtr*)(_t616 + 0x4800401a)) =  *((intOrPtr*)(_t616 + 0x4800401a)) + _t616;
					_t617 = _t616 + 1;
					 *_t752 =  *_t752 + _t617;
					 *_t752 =  *_t752 + _t617;
					 *_t617 =  *_t617 + _t617;
					asm("adc eax, [eax]");
					 *_t617 =  *_t617 + _t617;
					_t619 = (_t617 ^ 0x0000001f) + 1;
					 *_t838 =  *_t838 + _t619;
					 *_t752 =  *_t752 + _t619;
					 *_t619 =  *_t619 + _t619;
					 *_t619 =  *_t619 + _t619;
					 *_t619 =  *_t619 + _t619;
					 *_t619 =  *_t619 + _t619;
					 *((intOrPtr*)(_t752 + _t752)) =  *((intOrPtr*)(_t752 + _t752)) + _t619;
					_t620 = _t619 + 1;
					 *((intOrPtr*)(_t620 - 0x42)) =  *((intOrPtr*)(_t620 - 0x42)) + _t803;
					_pop(ds);
					_t623 = _t921 + _t921 + 1;
					 *_t838 =  *_t838 + _t623;
					 *_t752 =  *_t752 + _t623;
					 *_t623 =  *_t623 + _t623;
					asm("adc eax, [eax]");
					 *_t623 =  *_t623 + _t623;
					_t625 = (_t623 ^ 0x0000001f) + 1;
					 *_t803 =  *_t803 + _t625;
					 *_t752 =  *_t752 + _t625;
					 *_t625 =  *_t625 + _t625;
					 *_t625 =  *_t625 + _t625;
					 *_t625 =  *_t625 + _t625;
					 *_t625 =  *_t625 + _t625;
					 *((intOrPtr*)(_t625 + 0x1b)) =  *((intOrPtr*)(_t625 + 0x1b)) + _t803;
					_t626 = _t625 + 1;
					 *((intOrPtr*)(_t626 - 0x42)) =  *((intOrPtr*)(_t626 - 0x42)) + _t803;
					_t923 = _t626;
					_pop(ds);
					_t629 = _t620 + _t803 + 1;
					 *_t803 =  *_t803 + _t629;
					 *_t752 =  *_t752 + _t629;
					 *_t629 =  *_t629 + _t629;
					_pop(ds);
					 *_t629 =  *_t629 + _t629;
					 *_t629 =  *_t629 + _t629;
					asm("aam 0x1f");
					_t630 = _t629 + 1;
					asm("invalid");
					 *_t630 =  *_t630 + 1;
					 *_t630 =  *_t630 + _t630;
					 *_t630 =  *_t630 + _t630;
					 *_t630 =  *_t630 + _t630;
					asm("sbb eax, [eax]");
					_pop(_t632);
					_t633 = _t632 + 1;
					_t754 = _t752 + _t752 + _t752 + _t752;
					asm("invalid");
					 *_t633 =  *_t633 + 1;
					 *_t633 =  *_t633 + _t633;
					 *_t633 =  *_t633 + _t633;
					asm("sbb al, [eax]");
					asm("sbb byte [ecx], 0x40");
					 *0x1FE400A8 =  *((intOrPtr*)(0x1fe400a8)) + _t754;
					_t634 = _t633 + 1;
					 *((intOrPtr*)(_t754 + _t838 + 0x138a0040)) =  *((intOrPtr*)(_t754 + _t838 + 0x138a0040)) + _t634;
					_t635 = _t634 + 1;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t635;
					 *_t635 =  *_t635 + _t803;
					asm("sbb al, [eax]");
					asm("sbb byte [ecx], 0x40");
					 *((intOrPtr*)(0x1fe400a8)) =  *((intOrPtr*)(0x1fe400a8)) + _t754;
					_t636 = _t635 + 1;
					 *((intOrPtr*)(_t754 + _t838 + 0x138a0040)) =  *((intOrPtr*)(_t754 + _t838 + 0x138a0040)) + _t636;
					_t637 = _t636 + 1;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *_t637 =  *_t637 + _t637;
					 *((intOrPtr*)(_t637 + 0x1a)) =  *((intOrPtr*)(_t637 + 0x1a)) + _t838;
					_t638 = _t637 + 1;
					 *((intOrPtr*)(_t638 + 0x7e004019)) =  *((intOrPtr*)(_t638 + 0x7e004019)) + _t638;
					asm("adc eax, [eax]");
					_t639 = _t638 + 1;
					 *((intOrPtr*)(_t838 + 0x4013)) =  *((intOrPtr*)(_t838 + 0x4013)) + _t803;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *_t639 =  *_t639 + _t639;
					 *((intOrPtr*)(_t639 + 0x1a)) =  *((intOrPtr*)(_t639 + 0x1a)) + _t754;
					_t640 = _t639 + 1;
					 *((intOrPtr*)(_t640 + 0x7e004019)) =  *((intOrPtr*)(_t640 + 0x7e004019)) + _t640;
					asm("adc eax, [eax]");
					_t641 = _t640 + 1;
					 *((intOrPtr*)(_t838 + 0x4013)) =  *((intOrPtr*)(_t838 + 0x4013)) + _t803;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *_t641 =  *_t641 + _t641;
					 *((intOrPtr*)(_t641 - 0x70)) =  *((intOrPtr*)(_t641 - 0x70)) + _t838;
					_t642 = _t641 + _t754;
					asm("invalid");
					 *_t642 =  *_t642 + 1;
					 *_t642 =  *_t642 + _t642;
					 *((intOrPtr*)(_t642 - 0x70)) =  *((intOrPtr*)(_t642 - 0x70)) + _t642;
					_t806 = _t803 + 3;
					 *0x1446DD53 =  *((intOrPtr*)(0x1446dd53)) + _t642;
					asm("in eax, 0x53");
					_t756 = _t754 + _t754 + 1;
					asm("fcom dword [ecx-0x5ccc6ac6]");
					 *0x0000001D =  *((intOrPtr*)(0x1d)) + 0x1d;
					 *((intOrPtr*)(0x1d)) =  *((intOrPtr*)(0x1d)) + 0x1d;
					 *((intOrPtr*)(0x1d)) =  *((intOrPtr*)(0x1d)) + 0x1d;
					 *((intOrPtr*)(0x1d)) =  *((intOrPtr*)(0x1d)) + 0x1d;
					 *((intOrPtr*)(0x1d)) =  *((intOrPtr*)(0x1d)) + 0x1d;
					 *((intOrPtr*)(0x1d)) =  *((intOrPtr*)(0x1d)) + 0x1d;
					 *0x0000003A =  *((intOrPtr*)(0x3a)) + _t756;
					 *_t806 =  *_t806 + _t806;
					 *_t806 =  *_t806 + _t806;
					 *0x0000001E =  *((intOrPtr*)(0x1e)) + 0x1e;
					 *((intOrPtr*)(0x1e)) =  *((intOrPtr*)(0x1e)) + 0x1e;
					 *0xb1 =  *0xb1 + 0x1e;
					 *((intOrPtr*)(0x1e)) =  *((intOrPtr*)(0x1e)) + 0x1e;
					 *0xFFFFFFFFFF004037 =  *((intOrPtr*)(0xffffffffff004037)) + 0x1e;
					asm("invalid");
					asm("invalid");
					_pop(ds);
					 *0x0000001F =  *((intOrPtr*)(0x1f)) + 0x1f;
					 *((intOrPtr*)(0x1f)) =  *((intOrPtr*)(0x1f)) + 0x1f;
					 *((intOrPtr*)(0x1f)) =  *((intOrPtr*)(0x1f)) + 0x1f;
					 *((intOrPtr*)(0x1f)) =  *((intOrPtr*)(0x1f)) + 0x1f;
					 *((intOrPtr*)(0x1f)) =  *((intOrPtr*)(0x1f)) + 0x1f;
					 *((intOrPtr*)(0x1f)) =  *((intOrPtr*)(0x1f)) + 0x1f;
					 *((intOrPtr*)(_t923 + _t756 + 0x40)) =  *((intOrPtr*)(_t923 + _t756 + 0x40)) + 0x1f;
					 *((intOrPtr*)(0x1f)) =  *((intOrPtr*)(0x1f)) + 0x1f;
					 *((intOrPtr*)(0x1f)) =  *((intOrPtr*)(0x1f)) + 0x1f;
					_t924 = _t923 - 1;
					_t654 = _t756;
					_t758 = 0x1f + _t806 + 0x1f + _t806;
					 *_t654 =  *_t654 + 1;
					 *((intOrPtr*)(_t758 + 0x180)) =  *((intOrPtr*)(_t758 + 0x180)) + _t654;
					 *_t654 =  *_t654 + _t654;
					 *((intOrPtr*)(_t924 + 0xffffffffffff00f1)) =  *((intOrPtr*)(_t924 + 0xffffffffffff00f1)) + _t654;
					asm("invalid");
					 *0x1fe40095 = _t758;
					_t655 = _t654 + 1;
					 *_t655 =  *_t655 + _t655;
					 *_t655 =  *_t655 + _t655;
					 *_t655 =  *_t655 + _t655;
					 *_t655 =  *_t655 + _t655;
					 *_t655 =  *_t655 + _t655;
					 *_t655 =  *_t655 + _t655;
					 *((intOrPtr*)(_t924 + _t758 + 0x40)) =  *((intOrPtr*)(_t924 + _t758 + 0x40)) + _t758;
					 *_t655 =  *_t655 + _t655;
					 *_t655 =  *_t655 + _t655;
					 *((intOrPtr*)(_t655 + 0x4f)) =  *((intOrPtr*)(_t655 + 0x4f)) + _t806;
					_t656 = _t758;
					_t760 = _t655 + _t655;
					 *_t656 =  *_t656 + 1;
					 *((intOrPtr*)(_t760 + 0x180)) =  *((intOrPtr*)(_t760 + 0x180)) + _t656;
					 *_t656 =  *_t656 + _t656;
					 *_t656 =  *_t656 + _t806;
					asm("adc al, 0x40");
					_t761 = _t760 + _t760;
					asm("invalid");
					_push( *((intOrPtr*)(_t656 + 0x21)));
					_t657 = _t656 + 1;
					 *_t657 =  *_t657 + _t657;
					 *_t657 =  *_t657 + _t657;
					 *_t657 =  *_t657 + _t761;
					_t807 = _t806 + 1;
					 *_t657 =  *_t657 + _t657;
					 *_t657 =  *_t657 + _t657;
					 *((intOrPtr*)(_t924 + _t761 + 0x40)) =  *((intOrPtr*)(_t924 + _t761 + 0x40)) + _t807;
					 *_t807 =  *_t807 + _t807;
					 *_t657 =  *_t657 + _t657;
					 *_t657 =  *_t657 + _t657;
					 *_t657 =  *_t657 + _t657;
					_t762 = _t761 + _t761;
					 *_t657 =  *_t657 + 1;
					 *_t807 =  *_t807 + _t657;
					 *_t807 =  *_t807;
					 *_t657 =  *_t657 + _t657;
					 *_t657 =  *_t657 + _t657;
					_t893 = 0x1fe40094;
					_t659 = _t657;
					_push(0x1fe40095);
					_push(_t762);
					_t926 = _t924 + 2;
					_push(_t762);
					_t810 = _t807 + 2 - 1;
					_push(0xb1);
					_t764 = _t762 + 1 - 1;
					_push(_t926);
					_push(0xb1);
					_t927 = _t926 + 1;
					_push(_t953 + 1);
					 *_t659 =  *_t659 + _t659;
					 *0x0000011B =  *((intOrPtr*)(0x11b)) + _t659;
					asm("insb");
					_t957 =  *(_t927 + 0x68) * 0x79;
					_t994 = _t957;
					if(_t994 == 0) {
						L13:
						 *_t893 =  *_t893 + _t810;
						 *_t764 =  *_t764 + 0xb1;
						_push(_t659);
						 *0xb1 = 0xb1 +  *0xb1;
						_t929 = _t927 + 2;
						 *_t810 =  *_t810 + _t659;
						_t894 = _t893 - 1;
						 *((intOrPtr*)(_t659 + _t659 + 0x45)) =  *((intOrPtr*)(_t659 + _t659 + 0x45)) + 0xb1;
						 *0xb1 = 0xb1 +  *0xb1;
						 *_t659 =  *_t659 + _t659;
						 *_t659 =  *_t659 + _t659;
						asm("sbb al, [eax]");
						 *_t659 =  *_t659 + _t659;
						if ( *_t659 > 0) goto L14;
						_t660 =  *_t659 * 0x68006c;
						 *[gs:eax+eax+0x6d] =  *[gs:eax+eax+0x6d] + _t810;
						 *_t810 =  *_t810 + _t810;
						asm("outsb");
						 *_t810 =  *_t810 + _t660;
						if ( *_t810 >= 0) goto L15;
						 *[gs:ebp] =  *[gs:ebp] + _t810;
						 *_t660 =  *_t660 + _t660;
						_t661 = _t660 &  *_t660;
						 *_t661 =  *_t661 + _t661;
						if ( *_t661 < 0) goto L16;
						_t662 =  *_t661 * 0x70006b;
						asm("popad");
						 *0xb1 = 0xb1 +  *0xb1;
						asm("popad");
						 *((intOrPtr*)(_t662 + _t662 + 0x65)) =  *((intOrPtr*)(_t662 + _t662 + 0x65)) + _t662;
						 *_t662 =  *_t662 + _t810;
						asm("popad");
						 *_t810 =  *_t810 + _t810;
						if ( *_t810 < 0) goto L17;
						asm("bound eax, [eax]");
						asm("popad");
						 *((intOrPtr*)(_t662 + _t662 + 0x6c)) =  *((intOrPtr*)(_t662 + _t662 + 0x6c)) + _t810;
						 *_t662 =  *_t662 + _t662;
						 *_t894 =  *_t894 + _t764;
						 *_t662 =  *_t662 + _t662;
						 *_t929 =  *_t929 + _t810;
						asm("popad");
						 *_t853 =  *_t853 + _t662;
						if ( *_t853 == 0) goto L18;
						asm("bound eax, [eax]");
						asm("popad");
						 *((intOrPtr*)(_t662 + _t662 + 0x61)) =  *((intOrPtr*)(_t662 + _t662 + 0x61)) + _t810;
						 *_t894 =  *_t894 + _t810;
						asm("arpl [eax], ax");
						 *[gs:edx] =  *[gs:edx] + 0xb1;
						asm("outsb");
						 *_t929 =  *_t929 + _t662;
						asm("outsb");
						 *_t662 =  *_t662 + _t662;
						 *0xb1 =  *0xb1 + _t662;
						 *_t662 =  *_t662 + _t662;
						 *_t662 =  *_t662 + _t810;
						_t854 = _t853 - 1;
						 *_t764 =  *_t764 + 0xb1;
						_push(_t662);
						 *_t810 =  *_t810 + _t810;
						_push(_t957);
						 *_t810 =  *_t810 + _t662;
						_t895 = _t894 - 1;
						 *((intOrPtr*)(_t662 + _t662 + 0x41)) =  *((intOrPtr*)(_t662 + _t662 + 0x41)) + 0xb1;
						 *_t764 =  *_t764 + _t810;
						_push(_t957);
						 *_t810 =  *_t810 + _t810;
						_push(_t895);
						 *_t810 =  *_t810 + _t810;
						_push(_t764);
						 *((intOrPtr*)(_t662 + _t662)) =  *((intOrPtr*)(_t662 + _t662)) + 0xb1;
						 *((intOrPtr*)(_t662 + _t662)) =  *((intOrPtr*)(_t662 + _t662)) + _t810;
						 *_t662 =  *_t662 + _t662;
						 *_t662 =  *_t662 + _t662;
						 *_t662 =  *_t662 + _t662;
						 *_t662 =  *_t662 + _t662;
						 *_t662 =  *_t662 + _t662;
						 *_t662 =  *_t662 + _t810;
						_t663 = _t662;
						 *0xb1 =  *0xb1 + _t663;
						 *((intOrPtr*)(0xb1 + _t663)) =  *((intOrPtr*)(0xb1 + _t663)) + _t663;
						_t664 = _t663 + 0x34;
						 *_t664 =  *_t664 & _t664;
						_t665 = _t664 |  *_t664;
						 *_t665 =  *_t665 + _t665;
						 *_t665 =  *_t665 & _t665;
						 *_t810 =  *_t810 + _t665;
						 *0xb1 =  *0xb1 & _t665;
						_t666 = _t665 |  *_t665;
						 *_t666 =  *_t666 + _t666;
						 *_t810 =  *_t810 & _t666;
						_t667 = _t666 + 1;
						 *_t667 = _t667 +  *_t667;
						 *_t667 = _t667 +  *_t667;
						 *[ss:eax] =  *[ss:eax] + _t667;
						 *_t667 =  *_t667 + _t810;
						 *[gs:ebp] =  *[gs:ebp] + _t810;
						_t669 =  *( *_t667 * 0x67006e) * 0x69006e;
						asm("outsb");
						 *_t854 =  *_t854 + _t810;
						if ( *_t854 <= 0) goto L19;
						 *[gs:eax+eax+0x73] =  *[gs:eax+eax+0x73] + _t810;
						 *0xb1 =  *0xb1 + _t669;
						 *[gs:esi] =  *[gs:esi] + 0xb1;
						_t670 =  *_t669 * 0x730064;
						if (_t670 == 0) goto L20;
						_push(0x64006500);
						 *_t764 =  *_t764 + 0xb1;
						_t671 = _t670 ^ 0x77000000;
						asm("cld");
						_t765 = _t764 - _t764;
						_t247 = _t765 - 0x4e;
						 *_t247 =  *((intOrPtr*)(_t765 - 0x4e)) - _t810;
						if( *_t247 != 0) {
							L27:
							asm("outsd");
							if(_t1012 >= 0) {
								 *_t671 =  *_t671 + _t671;
								 *((intOrPtr*)(_t671 + _t671)) =  *((intOrPtr*)(_t671 + _t671)) + _t810;
								 *_t671 =  *_t671 + _t671;
								 *_t671 =  *_t671 + _t671;
								 *_t671 =  *_t671 + _t671;
								 *_t671 =  *_t671 + _t671;
								 *((intOrPtr*)(_t810 + 0x63)) =  *((intOrPtr*)(_t810 + 0x63)) + 0xb1;
								_t854 = 0xddca268b;
								L37:
								asm("retf 0x41dd");
								_t766 = 0x60;
								asm("rcr byte [edi-0x34435edf], cl");
								asm("stosb");
								_t930 = _t929 - 1;
								asm("sbb ebx, [eax+0x46]");
								_t840 = 0x000000b1 &  *_t854;
								_t812 = (_t810 & 0x00000060) - 1;
								 *((intOrPtr*)(_t840 - 0x48b3086d)) =  *((intOrPtr*)(_t840 - 0x48b3086d)) + 0xdc;
								asm("out dx, eax");
								asm("loop 0x58");
								asm("clc");
								_t674 = 0xdb;
								 *(_t854 - 0x588aa909) =  *(_t854 - 0x588aa909) & 0x00000042;
								_t960 = _t895 + 0x53a38f9b;
								asm("in al, 0x87");
								asm("repne dec esi");
								L38:
								_t896 = _t895 - 1;
								asm("lodsd");
								L39:
								_t767 = _t766 ^  *(_t812 - 0x48ee309a);
								asm("cdq");
								asm("iretw");
								asm("adc [edi+0xaa000c], esi");
								asm("pushad");
								asm("rcl dword [ebx+0x6b6c6974], cl");
							}
							asm("o16 jz 0x23");
							_push(_t895);
							_t895 =  *(_t765 + 0x75) * 0x53206c61;
							if(_t895 == 0) {
								goto L37;
							}
							_t930 =  *[fs:edi+0x5c] * 0x38394256;
							L30:
							_pop(_t979);
							_t854 = _t854 - 1;
							_t840 = 0xb3;
							 *((intOrPtr*)(_t895 + 0x42)) =  *((intOrPtr*)(_t895 + 0x42)) + 0xb3;
							 *_t671 =  *_t671 + _t671;
							_t960 = _t979;
							ds = _t895;
							_t739 = _t671 + 1;
							 *_t739 =  *_t739 + _t739;
							 *_t739 =  *_t739 + _t739;
							 *_t895 =  *_t895 + _t739;
							 *_t739 =  *_t739 + _t739;
							 *_t810 =  *_t810 + _t810;
							 *_t739 =  *_t739 + _t739;
							 *((intOrPtr*)(_t854 + _t765 + 0x40)) =  *((intOrPtr*)(_t854 + _t765 + 0x40)) + _t765;
							 *((intOrPtr*)(_t739 - 0x63ffbfe1)) =  *((intOrPtr*)(_t739 - 0x63ffbfe1)) + _t765;
							_t674 = _t765;
							_t766 = _t739;
							_t812 = _t810 + 1;
							 *_t674 =  *_t674 + _t674;
							 *_t674 =  *_t674 + _t674;
							 *_t674 =  *_t674 + _t674;
							 *_t674 =  *_t674 + _t674;
							_t277 = _t674 + 0x4f009402;
							 *_t277 =  *((intOrPtr*)(_t674 + 0x4f009402)) + _t812;
							if( *_t277 < 0) {
								goto L39;
							}
							_t930 = _t854[0x1b] * 0x704f0032;
							if(_t930 == 0) {
								goto L38;
							}
							asm("outsd");
							asm("outsb");
							 *_t674 =  *_t674 ^ _t674;
							asm("cdq");
							asm("iretw");
							asm("adc [edi+0xaa000c], esi");
							asm("pushad");
							asm("rcl dword [ebx+0x6d726f46], cl");
						}
						_t834 = _t810 & _t671 *  *_t671 >> 0x00000020;
						 *[ds:eax] =  *[ds:eax] ^ _t895;
						asm("lodsb");
						asm("rcr byte [esi-0x60], cl");
						_t913 = _t895 - 1;
						 *0x48da805b = _t765;
						do {
							asm("salc");
							asm("pushfd");
							_pop(_t854);
							_t742 = _t834;
							_pop(_t850);
							_t914 = _t913 - 1;
							_push(_t850);
							asm("adc [esi-0x3f], esi");
							asm("fisttp dword [ebp+0x598548a3]");
							asm("insb");
							asm("aad 0xa7");
							_push(ds);
							_t834 = _t834 + _t850 +  *((intOrPtr*)(_t854 - 0x53));
							_t785 =  *(_t742 - 0x5e) ^  *(_t834 - 0x48ee309a);
							asm("cdq");
							asm("iretw");
							asm("adc [edi+0xaa000c], esi");
							asm("pushad");
							asm("rcl dword [ebx+0x6974704f], cl");
							_t929 = _t854[0x1b] * 0x3d2e0033;
							asm("sti");
							asm("cld");
							asm("cli");
							_t671 =  *0x38a71068;
							 *_t671 =  *_t671 | _t671;
							_t913 = _t914 -  *_t785;
						} while (_t913 >= 0);
						_t765 = _t785 + 1;
						asm("outsd");
						asm("a16 jb 0x64");
						asm("insd");
						_t263 = _t913 + 0x69;
						 *_t263 =  *(_t913 + 0x69) & _t671;
						_t1012 =  *_t263;
						asm("insb");
						if(_t1012 >= 0) {
							goto L30;
						}
						 *((intOrPtr*)(_t671 + 0x38)) =  *((intOrPtr*)(_t671 + 0x38)) - _t765;
						 *[ss:ebp+ecx*2+0x69] =  *[ss:ebp+ecx*2+0x69] - _t765;
						asm("arpl [edx+0x6f], si");
						goto L27;
					}
					asm("gs outsb");
					if(_t994 >= 0) {
						L12:
						 *_t659 =  *_t659 + _t659;
						 *_t659 =  *_t659 + _t659;
						asm("sbb al, 0x0");
						 *_t659 =  *_t659 + _t659;
						 *_t810 =  *_t810 + _t659;
						_t787 = _t764;
						 *((intOrPtr*)(_t659 + _t659 + 0x55)) =  *((intOrPtr*)(_t659 + _t659 + 0x55)) + 0xb1;
						 *_t787 =  *_t787 + 0xb1;
						_push(_t787);
						 *_t927 =  *_t927 + _t659;
						_t893 = _t893 - 1;
						 *((intOrPtr*)(_t659 + _t659 + 0x45)) =  *((intOrPtr*)(_t659 + _t659 + 0x45)) + _t810;
						 *((intOrPtr*)(_t659 + _t659 + 0x54)) =  *((intOrPtr*)(_t659 + _t659 + 0x54)) + 0xb1;
						 *_t927 =  *_t927 + _t659;
						 *_t659 =  *_t659 + _t659;
						 *_t659 =  *_t659 + _t659;
						_t659 = _t659 & 0x00000000;
						 *_t659 =  *_t659 + _t659;
						_t810 = _t810 + 1;
						 *0xb1 =  *0xb1 + _t787;
						_push(_t957);
						 *_t927 =  *_t927 + _t659;
						_t764 = _t787 - 1;
						 *_t927 =  *_t927 + _t659;
						_push(0xb1);
						goto L13;
					}
					 *_t659 =  *_t659 + _t659;
					 *0x00000126 =  *((intOrPtr*)(0x126)) + _t659;
					_t995 =  *((intOrPtr*)(0x126));
					asm("insb");
					asm("insb");
					asm("fs outsd");
					if(_t995 != 0) {
						goto L13;
					}
					if (_t995 == 0) goto L10;
					 *_t659 =  *_t659 + _t659;
					_t893 = 0x1fe40095;
					_t810 = _t810 - 1;
					_push(_t764);
					_t957 = _t957 + 1;
					_t927 = _t927 - 1 + 2;
					_push(_t764);
					 *_t659 =  *_t659 + _t659;
					 *_t659 =  *_t659 + _t659;
					asm("sbb [eax], al");
					 *_t659 =  *_t659 + _t659;
					_t743 =  *_t659 * 0x6f0063;
					asm("outsb");
					 *_t810 =  *_t810 + _t810;
					asm("popad");
					 *0x1fe40095 =  *0x1fe40095 + _t810;
					asm("bound eax, [eax]");
					if ( *0x1fe40095 < 0) goto L11;
					 *[gs:esi] =  *[gs:esi] + 0xb1;
					_t659 =  *_t743 * 0;
					goto L12;
				}
				_t915 =  *(_t747 + 0x74) * 0x65;
				if (_t915 < 0) goto L5;
				 *((intOrPtr*)(_t915 + 0x49)) =  *((intOrPtr*)(_t915 + 0x49)) + _t573;
				_push(_t747);
				_t953 = _t953 + 1;
				_t920 = _t920 - 1 + 2;
				_push(_t747);
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				_push(_t573);
				 *_t573 =  *_t573 + _t573;
				 *((intOrPtr*)(_t920 - 0x1e75659b)) =  *((intOrPtr*)(_t920 - 0x1e75659b)) + _t794;
				_pop(0x94);
				_t889 = _t915 - 1;
				_t747 =  *((intOrPtr*)(_t573 - 0x5e));
				_push(0x94);
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *((intOrPtr*)(_t573 + 1)) =  *((intOrPtr*)(_t573 + 1)) + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t747 =  *_t747 + _t747;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *_t573 =  *_t573 + _t573;
				 *((intOrPtr*)(_t573 + _t920 + 0x40)) =  *((intOrPtr*)(_t573 + _t920 + 0x40)) + _t794;
				 *((intOrPtr*)(_t573 + _t573)) =  *((intOrPtr*)(_t573 + _t573)) + _t794;
				 *_t573 =  *_t573 + 0x93;
				goto L6;
			}

0x00401398
0x0040139d
0x004013a2
0x004013a4
0x004013a6
0x004013a8
0x004013aa
0x004013ac
0x004013ad
0x004013af
0x004013b1
0x004013b3
0x004013b7
0x004013c0
0x004013c2
0x004013c4
0x004013c6
0x004013c8
0x004013ca
0x004013cc
0x004013ce
0x004013d0
0x004013d2
0x004013d4
0x004013d5
0x004013d9
0x004013da
0x004013dc
0x004013e1
0x004013e2
0x004013e3
0x004013e5
0x004013e7
0x004013e9
0x004013eb
0x004013ef
0x004013f1
0x004013f3
0x004013f7
0x004013f9
0x004013fd
0x00401400
0x00401401
0x00401403
0x00401407
0x00401409
0x0040140b
0x0040140f
0x00401411
0x00401413
0x00401415
0x00401417
0x00401419
0x0040141b
0x0040141d
0x0040141f
0x00401426
0x00401427
0x00401429
0x0040142b
0x0040142f
0x00401431
0x00401433
0x00401435
0x00401437
0x00401439
0x0040143b
0x0040143f
0x00401443
0x00401446
0x00401448
0x0040144a
0x0040144c
0x00401453
0x00401455
0x00401457
0x00401459
0x0040145b
0x0040145d
0x0040145f
0x00401462
0x00401464
0x00401466
0x00401468
0x0040146a
0x0040146c
0x0040146e
0x00401470
0x00401473
0x00401475
0x00401477
0x0040147a
0x0040147b
0x0040147f
0x00401482
0x00401484
0x00401486
0x00401488
0x0040148a
0x0040148c
0x0040148e
0x00401490
0x00401492
0x00401494
0x00401499
0x0040149b
0x0040149d
0x004014a0
0x004014a1
0x004014a4
0x004014a6
0x004014a8
0x004014aa
0x004014ac
0x004014ae
0x004014b0
0x004014b2
0x004014b4
0x004014b6
0x004014b8
0x004014ba
0x004014bc
0x004014be
0x004014c0
0x004014c2
0x004014c4
0x004014c5
0x004014c6
0x004014c7
0x004014c8
0x004014c9
0x004014ca
0x004014ca
0x004014cd
0x004014cf
0x00401536
0x00401536
0x00401538
0x0040153b
0x00401543
0x00401545
0x00401547
0x00401548
0x0040154a
0x0040154c
0x0040154e
0x00401550
0x00401552
0x00401554
0x00401556
0x00401558
0x0040155a
0x0040155c
0x0040155f
0x00401561
0x00401563
0x00401565
0x00401567
0x00401569
0x0040156b
0x0040156d
0x0040156f
0x00401571
0x00401573
0x00401577
0x00401579
0x0040157b
0x00401581
0x00401583
0x00401585
0x00401587
0x0040158a
0x0040158b
0x0040158d
0x0040158f
0x00401595
0x00401597
0x00401599
0x0040159b
0x0040159d
0x0040159f
0x004015a3
0x004015a5
0x004015a7
0x004015ad
0x004015af
0x004015b1
0x004015b3
0x004015b5
0x004015b7
0x004015b9
0x004015be
0x004015c0
0x004015c2
0x004015c3
0x004015c5
0x004015c7
0x004015c9
0x004015ce
0x004015d2
0x004015d3
0x004015d5
0x004015d7
0x004015da
0x004015db
0x004015dd
0x004015df
0x004015e2
0x004015e3
0x004015e5
0x004015eb
0x004015f1
0x004015f1
0x004015f2
0x004015f3
0x004015f5
0x004015f7
0x004015fe
0x004015ff
0x00401601
0x00401604
0x00401605
0x00401607
0x0040160a
0x0040160e
0x0040160f
0x00401611
0x00401613
0x00401615
0x00401617
0x00401619
0x0040161b
0x0040161f
0x00401622
0x00401622
0x00401623
0x00401626
0x00401627
0x00401629
0x0040162b
0x0040162e
0x0040162f
0x00401631
0x00401635
0x00401636
0x00401639
0x0040163b
0x0040163d
0x0040163f
0x00401641
0x00401643
0x0040164e
0x0040164f
0x00401651
0x00401653
0x00401655
0x00401657
0x0040165a
0x0040165b
0x00401662
0x00401663
0x0040166a
0x0040166b
0x0040166d
0x0040166f
0x00401671
0x00401673
0x00401675
0x00401677
0x00401679
0x0040167b
0x0040167d
0x0040167f
0x00401681
0x00401683
0x00401685
0x00401687
0x00401689
0x0040168b
0x0040168d
0x0040168f
0x00401691
0x00401693
0x00401695
0x00401697
0x00401699
0x0040169b
0x0040169d
0x0040169f
0x004016a1
0x004016a3
0x004016a5
0x004016a7
0x004016a9
0x004016ab
0x004016ad
0x004016af
0x004016b1
0x004016b3
0x004016b6
0x004016b7
0x004016be
0x004016bf
0x004016c6
0x004016c7
0x004016c9
0x004016cb
0x004016cd
0x004016cf
0x004016d1
0x004016d3
0x004016d5
0x004016d7
0x004016d9
0x004016db
0x004016dd
0x004016df
0x004016e1
0x004016e3
0x004016e5
0x004016e7
0x004016e9
0x004016eb
0x004016ed
0x004016ef
0x004016f1
0x004016f3
0x004016f5
0x004016f7
0x004016f9
0x004016fb
0x004016fd
0x004016ff
0x00401701
0x00401703
0x00401705
0x00401707
0x00401709
0x0040170b
0x0040170d
0x0040170f
0x00401711
0x00401713
0x00401715
0x00401717
0x00401719
0x0040171b
0x0040171d
0x0040171f
0x00401721
0x00401723
0x00401725
0x00401727
0x00401729
0x0040172b
0x0040172d
0x0040172f
0x00401731
0x00401733
0x00401735
0x00401737
0x00401739
0x0040173b
0x0040173d
0x0040173f
0x00401741
0x00401743
0x00401745
0x00401747
0x0040174a
0x0040174b
0x0040174d
0x0040174f
0x00401751
0x00401753
0x00401756
0x00401757
0x00401759
0x0040175b
0x0040175f
0x00401766
0x00401767
0x00401769
0x0040176b
0x0040176d
0x0040176f
0x00401771
0x00401773
0x00401775
0x00401777
0x00401779
0x0040177b
0x0040177d
0x0040177f
0x00401781
0x00401783
0x00401785
0x00401787
0x00401789
0x0040178b
0x0040178d
0x0040178f
0x00401791
0x00401793
0x00401795
0x00401797
0x00401799
0x0040179b
0x0040179d
0x0040179f
0x004017a1
0x004017a3
0x004017a5
0x004017a7
0x004017a9
0x004017ab
0x004017ad
0x004017af
0x004017b1
0x004017b3
0x004017b5
0x004017b7
0x004017b9
0x004017bb
0x004017bd
0x004017bf
0x004017c1
0x004017c3
0x004017c5
0x004017c7
0x004017c9
0x004017cb
0x004017cd
0x004017cf
0x004017d1
0x004017d3
0x004017d5
0x004017d7
0x004017d9
0x004017db
0x004017dd
0x004017df
0x004017e1
0x004017e3
0x004017e5
0x004017e7
0x004017e9
0x004017eb
0x004017ed
0x004017ef
0x004017f1
0x004017f3
0x004017f5
0x004017f7
0x004017f9
0x004017fb
0x004017fd
0x004017ff
0x00401801
0x00401803
0x00401805
0x00401807
0x00401809
0x0040180b
0x0040180d
0x0040180f
0x00401811
0x00401813
0x00401815
0x00401817
0x00401819
0x0040181b
0x0040181d
0x0040181f
0x00401821
0x00401823
0x00401825
0x00401827
0x00401829
0x0040182b
0x0040182d
0x0040182f
0x00401831
0x00401833
0x00401835
0x00401837
0x00401839
0x0040183b
0x0040183d
0x0040183f
0x00401841
0x00401843
0x00401845
0x00401847
0x00401849
0x0040184b
0x0040184d
0x0040184f
0x00401851
0x00401853
0x00401855
0x00401857
0x00401859
0x0040185b
0x0040185d
0x0040185f
0x00401861
0x00401863
0x00401865
0x00401867
0x00401869
0x0040186b
0x0040186d
0x0040186f
0x00401871
0x00401873
0x00401875
0x00401877
0x00401879
0x0040187b
0x0040187d
0x0040187f
0x00401881
0x00401883
0x00401885
0x00401887
0x00401889
0x0040188b
0x0040188d
0x0040188f
0x00401891
0x00401893
0x00401895
0x00401897
0x00401899
0x0040189b
0x0040189d
0x0040189f
0x004018a1
0x004018a3
0x004018a5
0x004018a7
0x004018a9
0x004018ab
0x004018ad
0x004018af
0x004018b1
0x004018b3
0x004018b5
0x004018b7
0x004018b9
0x004018bb
0x004018bd
0x004018bf
0x004018c1
0x004018c3
0x004018c5
0x004018c7
0x004018c9
0x004018cb
0x004018cd
0x004018cf
0x004018d1
0x004018d3
0x004018d5
0x004018d7
0x004018d9
0x004018db
0x004018dd
0x004018df
0x004018e1
0x004018e3
0x004018e5
0x004018e7
0x004018e9
0x004018eb
0x004018ed
0x004018ef
0x004018f1
0x004018f3
0x004018f5
0x004018f7
0x004018f9
0x004018fb
0x004018fd
0x004018ff
0x00401901
0x00401903
0x00401905
0x00401907
0x00401909
0x0040190b
0x0040190d
0x0040190f
0x00401911
0x00401913
0x00401915
0x00401917
0x00401919
0x0040191b
0x0040191d
0x0040191f
0x00401921
0x00401923
0x00401925
0x00401927
0x00401929
0x0040192b
0x0040192d
0x0040192f
0x00401931
0x00401933
0x00401935
0x00401937
0x00401939
0x0040193b
0x0040193d
0x0040193f
0x00401941
0x00401943
0x00401945
0x00401947
0x00401949
0x0040194b
0x0040194d
0x0040194f
0x00401951
0x00401953
0x00401955
0x00401957
0x00401959
0x0040195b
0x0040195d
0x0040195f
0x00401961
0x00401963
0x00401965
0x00401967
0x00401969
0x0040196b
0x0040196d
0x0040196f
0x00401971
0x00401973
0x00401975
0x00401979
0x0040197c
0x0040197e
0x00401980
0x00401982
0x00401984
0x00401985
0x00401987
0x00401989
0x0040198b
0x0040198f
0x00401991
0x00401993
0x00401995
0x00401997
0x0040199e
0x0040199f
0x004019a1
0x004019a3
0x004019a6
0x004019a6
0x004019a7
0x004019a9
0x004019ab
0x004019ad
0x004019af
0x004019b1
0x004019b3
0x004019b5
0x004019b8
0x004019ba
0x004019be
0x004019bf
0x004019c1
0x004019c3
0x004019c5
0x004019c8
0x004019ca
0x004019cc
0x004019ce
0x004019cf
0x004019d1
0x004019d5
0x004019d8
0x004019da
0x004019dc
0x004019de
0x004019df
0x004019e1
0x004019e7
0x004019ed
0x004019f4
0x004019fb
0x004019fe
0x004019ff
0x00401a02
0x00401a04
0x00401a06
0x00401a0a
0x00401a0b
0x00401a0d
0x00401a0f
0x00401a11
0x00401a13
0x00401a15
0x00401a17
0x00401a22
0x00401a23
0x00401a25
0x00401a27
0x00401a2a
0x00401a2e
0x00401a32
0x00401a33
0x00401a35
0x00401a37
0x00401a39
0x00401a3b
0x00401a3d
0x00401a3f
0x00401a42
0x00401a43
0x00401a49
0x00401a4a
0x00401a4b
0x00401a4d
0x00401a4f
0x00401a52
0x00401a56
0x00401a5a
0x00401a5b
0x00401a5d
0x00401a5f
0x00401a61
0x00401a63
0x00401a65
0x00401a67
0x00401a6a
0x00401a6b
0x00401a6e
0x00401a71
0x00401a72
0x00401a73
0x00401a75
0x00401a77
0x00401a7a
0x00401a7b
0x00401a7e
0x00401a80
0x00401a82
0x00401a85
0x00401a87
0x00401a89
0x00401a8b
0x00401a8d
0x00401a91
0x00401a94
0x00401a9a
0x00401a9b
0x00401a9d
0x00401a9f
0x00401aa1
0x00401aa3
0x00401aa5
0x00401aa8
0x00401aab
0x00401aae
0x00401aaf
0x00401ab6
0x00401ab7
0x00401ab9
0x00401abb
0x00401abd
0x00401abf
0x00401ac1
0x00401ac3
0x00401ac5
0x00401ac7
0x00401ac9
0x00401acb
0x00401acd
0x00401acf
0x00401ad1
0x00401ad3
0x00401ad5
0x00401ad7
0x00401ad9
0x00401adb
0x00401add
0x00401adf
0x00401ae1
0x00401ae3
0x00401ae5
0x00401ae7
0x00401ae9
0x00401aeb
0x00401aed
0x00401aef
0x00401af1
0x00401af3
0x00401af5
0x00401af7
0x00401af9
0x00401afb
0x00401afd
0x00401aff
0x00401b01
0x00401b03
0x00401b05
0x00401b07
0x00401b09
0x00401b0c
0x00401b0f
0x00401b12
0x00401b13
0x00401b1a
0x00401b1b
0x00401b1d
0x00401b1f
0x00401b21
0x00401b23
0x00401b25
0x00401b27
0x00401b29
0x00401b2b
0x00401b2d
0x00401b2f
0x00401b31
0x00401b33
0x00401b35
0x00401b37
0x00401b39
0x00401b3b
0x00401b3d
0x00401b3f
0x00401b41
0x00401b43
0x00401b45
0x00401b47
0x00401b49
0x00401b4b
0x00401b4d
0x00401b4f
0x00401b51
0x00401b53
0x00401b55
0x00401b57
0x00401b59
0x00401b5b
0x00401b5d
0x00401b5f
0x00401b61
0x00401b63
0x00401b65
0x00401b67
0x00401b69
0x00401b6b
0x00401b6e
0x00401b6f
0x00401b75
0x00401b7a
0x00401b7b
0x00401b81
0x00401b83
0x00401b85
0x00401b87
0x00401b89
0x00401b8b
0x00401b8d
0x00401b8f
0x00401b91
0x00401b93
0x00401b95
0x00401b97
0x00401b99
0x00401b9b
0x00401b9d
0x00401b9f
0x00401ba1
0x00401ba3
0x00401ba5
0x00401ba7
0x00401ba9
0x00401bab
0x00401bad
0x00401baf
0x00401bb1
0x00401bb3
0x00401bb5
0x00401bb7
0x00401bb9
0x00401bbb
0x00401bbd
0x00401bbf
0x00401bc1
0x00401bc3
0x00401bc5
0x00401bc7
0x00401bc9
0x00401bcb
0x00401bcd
0x00401bcf
0x00401bd2
0x00401bd3
0x00401bd9
0x00401bde
0x00401bdf
0x00401be5
0x00401be7
0x00401be9
0x00401beb
0x00401bed
0x00401bef
0x00401bf1
0x00401bf3
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfb
0x00401bfd
0x00401bff
0x00401c01
0x00401c03
0x00401c05
0x00401c07
0x00401c09
0x00401c0b
0x00401c0d
0x00401c0f
0x00401c11
0x00401c13
0x00401c15
0x00401c17
0x00401c19
0x00401c1b
0x00401c1d
0x00401c1f
0x00401c21
0x00401c23
0x00401c25
0x00401c27
0x00401c29
0x00401c2b
0x00401c2d
0x00401c2f
0x00401c31
0x00401c33
0x00401c35
0x00401c37
0x00401c39
0x00401c3b
0x00401c3d
0x00401c3f
0x00401c41
0x00401c43
0x00401c45
0x00401c47
0x00401c49
0x00401c4b
0x00401c4d
0x00401c4f
0x00401c51
0x00401c53
0x00401c55
0x00401c57
0x00401c59
0x00401c5b
0x00401c5d
0x00401c5f
0x00401c61
0x00401c63
0x00401c67
0x00401c6d
0x00401c6f
0x00401c71
0x00401c73
0x00401c76
0x00401c77
0x00401c7d
0x00401c7f
0x00401c82
0x00401c93
0x00401c95
0x00401c97
0x00401c99
0x00401c9b
0x00401c9d
0x00401c9f
0x00401ca3
0x00401ca7
0x00401cab
0x00401cad
0x00401caf
0x00401cb1
0x00401cb3
0x00401cb9
0x00401cbb
0x00401cbd
0x00401cbf
0x00401cc1
0x00401cc3
0x00401cc5
0x00401cc7
0x00401cc9
0x00401ccb
0x00401ccf
0x00401cd1
0x00401cd5
0x00401cd6
0x00401cd7
0x00401cd9
0x00401cdb
0x00401ce1
0x00401ce3
0x00401cea
0x00401cec
0x00401cee
0x00401cef
0x00401cf1
0x00401cf3
0x00401cf5
0x00401cf7
0x00401cf9
0x00401cfb
0x00401cff
0x00401d01
0x00401d03
0x00401d06
0x00401d07
0x00401d09
0x00401d0b
0x00401d11
0x00401d13
0x00401d15
0x00401d17
0x00401d19
0x00401d1b
0x00401d1e
0x00401d1f
0x00401d21
0x00401d23
0x00401d26
0x00401d27
0x00401d29
0x00401d2b
0x00401d2f
0x00401d31
0x00401d33
0x00401d35
0x00401d37
0x00401d39
0x00401d3b
0x00401d3d
0x00401d40
0x00401d42
0x00401d47
0x00401d49
0x00401d4a
0x00401d4d
0x00401d4e
0x00401d4f
0x00401d51
0x00401d52
0x00401d53
0x00401d54
0x00401d56
0x00401d57
0x00401d58
0x00401d59
0x00401d5b
0x00401d5e
0x00401d5f
0x00401d5f
0x00401d63
0x00401dd9
0x00401dd9
0x00401ddd
0x00401de0
0x00401de1
0x00401de4
0x00401de5
0x00401de8
0x00401de9
0x00401ded
0x00401df0
0x00401df2
0x00401df4
0x00401df6
0x00401df8
0x00401dfa
0x00401e00
0x00401e05
0x00401e08
0x00401e09
0x00401e0c
0x00401e0e
0x00401e12
0x00401e14
0x00401e16
0x00401e18
0x00401e1a
0x00401e20
0x00401e21
0x00401e24
0x00401e25
0x00401e29
0x00401e2c
0x00401e2d
0x00401e30
0x00401e32
0x00401e34
0x00401e35
0x00401e39
0x00401e3b
0x00401e3d
0x00401e3f
0x00401e42
0x00401e43
0x00401e46
0x00401e48
0x00401e4a
0x00401e4b
0x00401e4f
0x00401e52
0x00401e54
0x00401e58
0x00401e59
0x00401e5c
0x00401e5d
0x00401e5f
0x00401e61
0x00401e63
0x00401e66
0x00401e67
0x00401e6a
0x00401e6b
0x00401e6e
0x00401e6f
0x00401e72
0x00401e73
0x00401e77
0x00401e7a
0x00401e7b
0x00401e7e
0x00401e7f
0x00401e82
0x00401e83
0x00401e87
0x00401e8b
0x00401e8d
0x00401e8f
0x00401e91
0x00401e93
0x00401e95
0x00401e97
0x00401e99
0x00401e9b
0x00401e9e
0x00401ea0
0x00401ea2
0x00401ea4
0x00401ea6
0x00401ea8
0x00401eaa
0x00401eac
0x00401eae
0x00401eb0
0x00401eb2
0x00401eb4
0x00401eb6
0x00401eb8
0x00401ebb
0x00401ec4
0x00401ec8
0x00401ece
0x00401ecf
0x00401ed2
0x00401ed4
0x00401ed9
0x00401edc
0x00401ee0
0x00401ee6
0x00401ee8
0x00401eed
0x00401ef0
0x00401ef5
0x00401ef8
0x00401efa
0x00401efa
0x00401efd
0x00401f77
0x00401f77
0x00401f78
0x00401fe9
0x00401feb
0x00401fef
0x00401ff1
0x00401ff3
0x00401ff5
0x00401ff7
0x00401ffa
0x00401ffc
0x00401ffc
0x00402000
0x00402002
0x0040200e
0x0040200f
0x00402015
0x00402018
0x0040201a
0x0040201b
0x00402023
0x00402025
0x00402027
0x00402028
0x00402029
0x00402030
0x00402036
0x00402038
0x00402039
0x00402039
0x0040203a
0x0040203b
0x0040203b
0x0040203c
0x0040203d
0x0040203f
0x00402045
0x00402046
0x00402046
0x00401f7a
0x00401f7d
0x00401f7e
0x00401f85
0x00000000
0x00000000
0x00401f87
0x00401f8d
0x00401f8f
0x00401f92
0x00401f96
0x00401f97
0x00401f9a
0x00401f9c
0x00401f9d
0x00401f9e
0x00401f9f
0x00401fa1
0x00401fa3
0x00401fa5
0x00401fa7
0x00401fa9
0x00401fab
0x00401faf
0x00401fb5
0x00401fb5
0x00401fb6
0x00401fb7
0x00401fb9
0x00401fbb
0x00401fbd
0x00401fbf
0x00401fbf
0x00401fc5
0x00000000
0x00000000
0x00401fc7
0x00401fce
0x00000000
0x00000000
0x00401fd0
0x00401fd1
0x00401fd2
0x00401fd8
0x00401fd9
0x00401fdb
0x00401fe1
0x00401fe2
0x00401fe2
0x00401f02
0x00401f04
0x00401f07
0x00401f08
0x00401f0b
0x00401f0c
0x00401f11
0x00401f11
0x00401f12
0x00401f13
0x00401f17
0x00401f1a
0x00401f1b
0x00401f22
0x00401f25
0x00401f28
0x00401f30
0x00401f31
0x00401f33
0x00401f34
0x00401f37
0x00401f38
0x00401f39
0x00401f3b
0x00401f41
0x00401f42
0x00401f47
0x00401f4e
0x00401f4f
0x00401f50
0x00401f51
0x00401f56
0x00401f58
0x00401f58
0x00401f5c
0x00401f61
0x00401f62
0x00401f65
0x00401f66
0x00401f66
0x00401f66
0x00401f69
0x00401f6a
0x00000000
0x00000000
0x00401f6d
0x00401f70
0x00401f75
0x00000000
0x00401f75
0x00401d65
0x00401d67
0x00401da0
0x00401da0
0x00401da2
0x00401da4
0x00401da6
0x00401da9
0x00401dac
0x00401dad
0x00401db1
0x00401db4
0x00401db5
0x00401db8
0x00401db9
0x00401dbd
0x00401dc1
0x00401dc4
0x00401dc6
0x00401dc8
0x00401dca
0x00401dcc
0x00401dcd
0x00401dd0
0x00401dd1
0x00401dd4
0x00401dd5
0x00401dd8
0x00000000
0x00401dd8
0x00401d69
0x00401d6b
0x00401d6b
0x00401d6e
0x00401d6f
0x00401d70
0x00401d72
0x00000000
0x00000000
0x00401d74
0x00401d76
0x00401d78
0x00401d79
0x00401d7b
0x00401d7d
0x00401d7e
0x00401d7f
0x00401d80
0x00401d82
0x00401d84
0x00401d86
0x00401d88
0x00401d8e
0x00401d8f
0x00401d92
0x00401d93
0x00401d96
0x00401d98
0x00401d9a
0x00401d9e
0x00000000
0x00401d9e
0x004014d1
0x004014d5
0x004014d7
0x004014db
0x004014dd
0x004014de
0x004014df
0x004014e0
0x004014e2
0x004014e4
0x004014e5
0x004014e7
0x004014ee
0x004014ef
0x004014f3
0x004014f6
0x004014f7
0x004014f9
0x004014fb
0x004014fd
0x004014ff
0x00401501
0x00401503
0x00401505
0x00401507
0x00401509
0x0040150b
0x00401511
0x00401513
0x00401515
0x00401517
0x00401519
0x0040151b
0x0040151d
0x0040151f
0x00401521
0x00401523
0x00401525
0x00401527
0x00401529
0x0040152b
0x0040152f
0x00401533
0x00000000

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040139D

Strings

VB5!6&*, xrefs: 00401398

Memory Dump Source

Source File: 00000000.00000002.779462164.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.779441423.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.779677235.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2GirCpksIO.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 8baa4ea08b5ff3b27f789bd7f32250cf799ef915419771ad01a0ade948535cb3
Instruction ID: 88fdc1a575656313597d835cb07bfbf216f7a9635e0b169ad871589778eae2a7
Opcode Fuzzy Hash: 8baa4ea08b5ff3b27f789bd7f32250cf799ef915419771ad01a0ade948535cb3
Instruction Fuzzy Hash: 62112AA418E3D28FD3130BB14C691A17FB09D1322431E06EBD4C2CA8B3D26D488EC7A3

Uniqueness

Uniqueness Score: -1.00%

Function 02041EF5, Relevance: .0, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.780722446.0000000002040000.00000020.00000001.sdmp, Offset: 02040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2040000_2GirCpksIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f651cb9bbff878bb45251c6dbcb6cbefe1632ad40e5df6b8a57263486e8d8d
Instruction ID: a8885775d3bae492f54f5a4acd36672ddee0cb2afd02a783e6364069861f6320
Opcode Fuzzy Hash: b4f651cb9bbff878bb45251c6dbcb6cbefe1632ad40e5df6b8a57263486e8d8d
Instruction Fuzzy Hash: 04D09E71309100FFD244D614CD46ED677E8E785721F44C5B9B148CB241EA66ED525B62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 029402D0, Relevance: 8.1, Strings: 5, Instructions: 1844
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{)Bc, xrefs: 02940B50
QL$r, xrefs: 02940D0F
]-vX, xrefs: 0293B30B
;PU, xrefs: 029407E6
vl&, xrefs: 0293AF76

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: ;PU$QL$r$]-vX$vl&${)Bc
API String ID: 0-4195511027
Opcode ID: 80b76463fc02cbd8927a4cf325e9ea1b23314b56102f1e750ed3ba04e48118f5
Instruction ID: 83031c54e1b9b86ce5c2060d1bc50e3a4951f532009f533a38e0653127e673ea
Opcode Fuzzy Hash: 80b76463fc02cbd8927a4cf325e9ea1b23314b56102f1e750ed3ba04e48118f5
Instruction Fuzzy Hash: 36E27B316043468FDF359E38CDA87DA7BE2AF56350F95822ECCC98B255D7358586CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0293B688, Relevance: 5.4, Strings: 3, Instructions: 1610COMMON

Download Yara Rule

Strings

@l}, xrefs: 0293DC47
75', xrefs: 0293DC30
HNi, xrefs: 0293E656

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: 75'$HNi$@l}
API String ID: 0-57597368
Opcode ID: 0a8166482f665c38ca0f791316f35edffccf659418ea90d6d3f77903cac1b32d
Instruction ID: 751fc6e598043963455575b09c583c2cdf58f85de5eeb90ed94565bf05c08f20
Opcode Fuzzy Hash: 0a8166482f665c38ca0f791316f35edffccf659418ea90d6d3f77903cac1b32d
Instruction Fuzzy Hash: 8AA2AC32558D5664DF236A7889722F5BFE6FF47744B60260AD0C9C705BCB288D02EB62

Uniqueness

Uniqueness Score: -1.00%

Function 0293BA6E, Relevance: 3.5, Strings: 2, Instructions: 1046
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]-vX, xrefs: 0293B30B
vl&, xrefs: 0293AF76

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: ]-vX$vl&
API String ID: 0-507981783
Opcode ID: 109b735d646f71039bd5d5594fdc80a03e5304a30c4219076261ed51b7fdc198
Instruction ID: a51fff7a01d0c6a363e4f105aa1b3f05920c381d369dc9b476bbc183297a21ac
Opcode Fuzzy Hash: 109b735d646f71039bd5d5594fdc80a03e5304a30c4219076261ed51b7fdc198
Instruction Fuzzy Hash: A782447160034A9FDF309E78CD997DA77B2BF55390F95422EDC899B214D3358A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 029303EC, Relevance: 1.8, Strings: 1, Instructions: 585COMMON

Download Yara Rule

Strings

;, xrefs: 02930410

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 1fa4f071f60f921c29c004aa077fbb073f9fcd481220cdd4f89b685045e43d64
Instruction ID: 656a4beb4e8930218823b1de79c0aa8351bc8190630f6389d12ee091609c07ac
Opcode Fuzzy Hash: 1fa4f071f60f921c29c004aa077fbb073f9fcd481220cdd4f89b685045e43d64
Instruction Fuzzy Hash: B3F1FD32458915A1DF13AA7885662F6BFE6FF43398B606516E0CDC7093DB29CC02D7A3

Uniqueness

Uniqueness Score: -1.00%

Function 0293C399, Relevance: 1.6, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

WGU$, xrefs: 0293C4FB

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: WGU$
API String ID: 0-4186193538
Opcode ID: ac7a88cfb8043f51a37d2a3c1feef64232236def2b17bea60c55bcd13f24f59c
Instruction ID: 40832d7ecaa7fcab896cb42e7d76d85f7bc75be0e48693f2054453236b770d93
Opcode Fuzzy Hash: ac7a88cfb8043f51a37d2a3c1feef64232236def2b17bea60c55bcd13f24f59c
Instruction Fuzzy Hash: 25D1E23160438A8FDF399E35CD647EE37A6EF85350F45452EDC8AAB654E7318984CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0293E876, Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

HNi, xrefs: 0293E656

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: HNi
API String ID: 0-709816660
Opcode ID: a9ad81906558226ec255e8a44810f774149eb107f5f20cf0c567571e15113760
Instruction ID: ae487f3bf5d1beaddd3ee96aaac30e16dfedb21b6214ea773ae108032cd328a1
Opcode Fuzzy Hash: a9ad81906558226ec255e8a44810f774149eb107f5f20cf0c567571e15113760
Instruction Fuzzy Hash: 23513B7560438A5FDF369E384DA47EB2BA3AF95384FC5442ADCC9CB246D7308585C721

Uniqueness

Uniqueness Score: -1.00%

Function 0293EC0A, Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

Cv, xrefs: 0293ECDB

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: Cv
API String ID: 0-602659376
Opcode ID: d580e4f49518ce2aa3cc1673afb6c60235c8bd327afe5e9964fc5a570eebc198
Instruction ID: f6251e5a7e16a338f5eb7452388befc06efa4b4ea296779f1e913b53447f9de9
Opcode Fuzzy Hash: d580e4f49518ce2aa3cc1673afb6c60235c8bd327afe5e9964fc5a570eebc198
Instruction Fuzzy Hash: FC31A73530438BDFCB31AEA9C9D17E723A2AF16350FC5952DDD9A8B282D7348985C706

Uniqueness

Uniqueness Score: -1.00%

Function 0293EE31, Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

%I, xrefs: 0293EEDE, 0293EEF2

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID: %I
API String ID: 0-1021495586
Opcode ID: bdbac00d87959216349a9ba15dcdc8e46d45e20290db8abda4e91e9dd18d3cdf
Instruction ID: dd93295c3465173a9c1eb37cff9cf1dd6494cec4bff96c3b9631f3f1fc71594d
Opcode Fuzzy Hash: bdbac00d87959216349a9ba15dcdc8e46d45e20290db8abda4e91e9dd18d3cdf
Instruction Fuzzy Hash: B21185716113969FDB39CF18C994BDA73A1BF1AB50F808129DC898B250C731EE41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0293B87D, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cef4ec3dee59725df78fb79291d6306825b80b4ec8bb1129473af742189923
Instruction ID: e861a4063fe9c5574ee8a3666211dcfb02c272544cdf3836f219f70fe867177a
Opcode Fuzzy Hash: e3cef4ec3dee59725df78fb79291d6306825b80b4ec8bb1129473af742189923
Instruction Fuzzy Hash: 7DC04C7A241580CFFB5ACE19D455B457362BF51994B8A4598E8029FA15D328ED028A40

Uniqueness

Uniqueness Score: -1.00%

Function 0293E553, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.781020135.0000000002930000.00000040.00000001.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_2GirCpksIO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499795edc607848eb9668e8247d9458b8667eed7756a090f52397c1f0e54bd7c
Instruction ID: 9985243dabde0853fb781a0612136c012a119f26e42387558ef3ccda5aa8f370
Opcode Fuzzy Hash: 499795edc607848eb9668e8247d9458b8667eed7756a090f52397c1f0e54bd7c
Instruction Fuzzy Hash: 5CC0923E621640CFCE62CE58C1C0FD077A0BF08A90F024880A441ABB21C224E800CA04

Uniqueness

Uniqueness Score: -1.00%

Function 00418010, Relevance: 119.4, APIs: 59, Strings: 9, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(660D9FF1,00000000,660E6BEC), ref: 00418098
__vbaStrCopy.MSVBVM60 ref: 004180A2
#712.MSVBVM60(?,004021E4,00000000,00000001,000000FF,00000000), ref: 004180B3
__vbaStrMove.MSVBVM60 ref: 004180BE
__vbaStrCmp.MSVBVM60(004021EC,?), ref: 004180CD
#554.MSVBVM60 ref: 004180DB
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 004180F3
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 0041811E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000140), ref: 0041814F
__vbaFreeObj.MSVBVM60 ref: 00418154
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 0041816C
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00418191
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000060), ref: 004181B1
__vbaStrMove.MSVBVM60 ref: 004181BC
__vbaFreeObj.MSVBVM60 ref: 004181C5
__vbaNew2.MSVBVM60(00401980, V`), ref: 004181DE
__vbaObjSet.MSVBVM60(?,00000000), ref: 004181F7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004021C4,00000130), ref: 0041821E
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041822A
__vbaStrVarMove.MSVBVM60(00000000), ref: 00418234
__vbaStrMove.MSVBVM60 ref: 0041823F
#690.MSVBVM60(teheran,medio,EVITED,00000000), ref: 00418255
__vbaFreeStr.MSVBVM60 ref: 0041825E
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041826E
__vbaFreeVar.MSVBVM60 ref: 0041827A
__vbaNew2.MSVBVM60(00401980, V`), ref: 00418292
__vbaObjSetAddref.MSVBVM60(?,00605620), ref: 004182A3
__vbaLateMemCall.MSVBVM60(?,GWdX3197,00000003), ref: 00418330
__vbaCastObj.MSVBVM60(?,00401F24), ref: 00418342
__vbaObjSet.MSVBVM60( V`,00000000), ref: 0041834E
__vbaFreeObj.MSVBVM60 ref: 0041835D
#610.MSVBVM60(?), ref: 0041837D
#661.MSVBVM60(?,004025F4,00000000,3FF00000,?), ref: 00418393
#610.MSVBVM60(?), ref: 004183A0
__vbaVarAdd.MSVBVM60(?,00000002,?,?), ref: 004183CF
__vbaVarTstNe.MSVBVM60(00000000), ref: 004183D6
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 004183F7
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 0041841C
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 00418441
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000140), ref: 0041846A
__vbaFreeObj.MSVBVM60 ref: 0041846F
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 00418484
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014), ref: 004184A9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000108), ref: 004184D2
__vbaFreeObj.MSVBVM60 ref: 004184D7
__vbaNew2.MSVBVM60(004021A4,004193C4), ref: 004184EC
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,0000004C), ref: 00418511
__vbaHresultCheckObj.MSVBVM60(00000000,?,004025F8,00000028), ref: 0041852D
__vbaFreeObj.MSVBVM60 ref: 00418532
__vbaOnError.MSVBVM60(00000000), ref: 00418536
__vbaVarDup.MSVBVM60 ref: 00418559
#666.MSVBVM60(?,?), ref: 00418567
__vbaVarMove.MSVBVM60 ref: 00418573
__vbaFreeVar.MSVBVM60 ref: 0041857C
__vbaFreeStr.MSVBVM60(004185FB), ref: 004185DC
__vbaFreeObj.MSVBVM60 ref: 004185E1
__vbaFreeStr.MSVBVM60 ref: 004185EA
__vbaFreeVar.MSVBVM60 ref: 004185EF
__vbaFreeStr.MSVBVM60 ref: 004185F8

Strings

V`, xrefs: 004181CB, 004181D4, 004181E4, 00418280, 00418288, 00418298, 00418349
GWdX3197, xrefs: 00418327
EVITED, xrefs: 00418246
v]I, xrefs: 004182C7
teheran, xrefs: 00418250
val, xrefs: 0041809A
INDARBEJDELSERNE, xrefs: 0041853C
MEDLEMSPROGRAMMER, xrefs: 004182BD
medio, xrefs: 0041824B

Memory Dump Source

Source File: 00000000.00000002.779462164.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.779441423.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.779677235.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2GirCpksIO.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#610CallCopyLateList$#554#661#666#690#712AddrefCastError
String ID: V`$EVITED$GWdX3197$INDARBEJDELSERNE$MEDLEMSPROGRAMMER$medio$teheran$v]I$val
API String ID: 2802715268-3235841462
Opcode ID: 97bd3af207e1f500babfe56ccb714f19d3fc76a35304b51a172b28e832416da8
Instruction ID: a090630445d6ec63fc85c45a3f5f26405e32e5a4604b8d4a20e126ba6f0a065e
Opcode Fuzzy Hash: 97bd3af207e1f500babfe56ccb714f19d3fc76a35304b51a172b28e832416da8
Instruction Fuzzy Hash: A8028E71900219AFCB14DF94DD88EDEBBB8FF08704F10816AE549B72A4DBB49985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00418670, Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#554.MSVBVM60(660D9FF1,00000000,660E6BEC,?,?,?,?,?,?,?,1D0EBDC0,004011B6,4202A2AC), ref: 004186A4
__vbaNew2.MSVBVM60(004021A4,004193C4,?,?,?,?,?,?,?,1D0EBDC0,004011B6,4202A2AC), ref: 004186BC
__vbaHresultCheckObj.MSVBVM60(00000000,020DE98C,00402194,00000014,?,?,?,?,?,?,?,1D0EBDC0,004011B6,4202A2AC), ref: 004186E1
__vbaHresultCheckObj.MSVBVM60(00000000,?,004021B4,00000110,?,?,?,?,?,?,?,1D0EBDC0,004011B6,4202A2AC), ref: 0041870B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,1D0EBDC0,004011B6,4202A2AC), ref: 0041871A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,1D0EBDC0,004011B6,4202A2AC), ref: 00418723
__vbaFreeStr.MSVBVM60(0041874D,?,?,?,?,?,?,?,1D0EBDC0,004011B6,4202A2AC), ref: 00418746

Memory Dump Source

Source File: 00000000.00000002.779462164.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.779441423.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.779677235.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2GirCpksIO.jbxd

Similarity

API ID: __vba$CheckFreeHresult$#554MoveNew2
String ID:
API String ID: 1843773685-0
Opcode ID: aba552d1d952085cd5269b2c85797af07b9fd11714bdd480de12717be04fb02f
Instruction ID: cd76f1e7e41fc4fed7cf68a4c9d1ed9a0a7d24824c11679ce07493adb2d3b98c
Opcode Fuzzy Hash: aba552d1d952085cd5269b2c85797af07b9fd11714bdd480de12717be04fb02f
Instruction Fuzzy Hash: 1F216270900609ABCB04DF94CE4DDEEBBB8FB18700F20412AF551B72E0D7785985CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00418620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(00401980, V`,004179BC), ref: 00418633
__vbaHresultCheckObj.MSVBVM60(00000000,00605620,00401EF4,000001D4), ref: 0041865D

Strings

V`, xrefs: 00418620, 00418629, 0041863A

Memory Dump Source

Source File: 00000000.00000002.779462164.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.779441423.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.779677235.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.779736362.000000000041B000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2GirCpksIO.jbxd

Similarity

API ID: __vba$CheckHresultNew2
String ID: V`
API String ID: 1998677070-1717503096
Opcode ID: f6e8211c0b3450e86813c49d84cc7cac925c1f9bc19cee608fff77dfcae36343
Instruction ID: 00980ae4a8e64860efe2635cfb60bd6d048e5abbd75b651c57490f61b13198a9
Opcode Fuzzy Hash: f6e8211c0b3450e86813c49d84cc7cac925c1f9bc19cee608fff77dfcae36343
Instruction Fuzzy Hash: 54E04630301220ABC7109F64AD08FC63AA8AB09764321457BF8A4B31E0CB7898849AAC

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 2GirCpksIO

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: 2GirCpksIO.exe PID: 6604 Parent PID: 6136

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: 2GirCpksIO.exe PID: 6604 Parent PID: 6136 2GirCpksIO.exeCOMMON

Execution Graph

Function 029418A6, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 322
COMMON

Function 0293BE72, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 307
memorynativeCOMMON

Function 00417C10, Relevance: 75.5, APIs: 36, Strings: 7, Instructions: 275
COMMON

Function 00417B60, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37
COMMON

Function 00401398, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Function 02041EF5, Relevance: .0, Instructions: 19
COMMON

Function 029402D0, Relevance: 8.1, Strings: 5, Instructions: 1844
COMMON

Function 0293BA6E, Relevance: 3.5, Strings: 2, Instructions: 1046
COMMON

Function 00418010, Relevance: 119.4, APIs: 59, Strings: 9, Instructions: 440
COMMON

Function 00418670, Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Function 00418620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
COMMON