Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
WCTBt2z7KE.exe

Overview

General Information

Sample Name:WCTBt2z7KE.exe
Analysis ID:708235
MD5:612955e16c4580bbc11798215426ff35
SHA1:016c2f953e1c7a1ba88c1812d70751925ab9e3e0
SHA256:2a39458d3161f7dae38dbad7e846ebecdbd802392f4cd0b845440914532a28d7
Tags:exemorpheus
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
PE file contains executable resources (Code or Archives)
Program does not show much activity (idle)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function

Classification

Process Tree

  • System is w10x64
  • WCTBt2z7KE.exe (PID: 1804 cmdline: "C:\Users\user\Desktop\WCTBt2z7KE.exe" MD5: 612955E16C4580BBC11798215426FF35)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: WCTBt2z7KE.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: WCTBt2z7KE.exeReversingLabs: Detection: 22%
Source: WCTBt2z7KE.exeVirustotal: Detection: 33%Perma Link
Machine Learning detection for sample
Source: WCTBt2z7KE.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_000000014000B64C NtdllDefWindowProc_W,GetWindowLongPtrW,GetWindowTextLengthW,RtlAllocateHeap,GetWindowTextW,EnableWindow,DestroyWindow,UnregisterClassW,0_2_000000014000B64C
Source: WCTBt2z7KE.exeStatic PE information: Resource name: RT_RCDATA type: DOS executable (COM, 0x8C-variant)
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400660A00_2_00000001400660A0
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_000000014000B7580_2_000000014000B758
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400138E50_2_00000001400138E5
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400154F00_2_00000001400154F0
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400151600_2_0000000140015160
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400151700_2_0000000140015170
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400131750_2_0000000140013175
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400102100_2_0000000140010210
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400162100_2_0000000140016210
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_000000014000EA480_2_000000014000EA48
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_000000014001366E0_2_000000014001366E
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_0000000140012FDD0_2_0000000140012FDD
Source: WCTBt2z7KE.exeReversingLabs: Detection: 22%
Source: WCTBt2z7KE.exeVirustotal: Detection: 33%
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: classification engineClassification label: mal60.winEXE@1/0@0/0
Source: WCTBt2z7KE.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400660A0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,0_2_00000001400660A0
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_004509C9 push ebx; retf 0_3_004509DC
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_00451C49 push edi; retf 0_3_00451C5C
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_00450A0A push edi; iretd 0_3_00450A0C
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_00450A19 push edi; iretd 0_3_00451ABC
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_00451B19 push edx; retf 0_3_00451B2C
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_00451C79 push es; iretd 0_3_00451D6C
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_00451B38 push edi; iretd 0_3_00451BEC
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_3_0045093A push edi; iretd 0_3_0045096C
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_000000014001BD3E push rbx; ret 0_2_000000014001BD3F
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeAPI call chain: ExitProcess graph end nodegraph_0-8847
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeAPI call chain: ExitProcess graph end nodegraph_0-8339
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_00000001400660A0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,0_2_00000001400660A0
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_000000014000C4D0 RtlRemoveVectoredExceptionHandler,RtlAddVectoredExceptionHandler,RtlAddVectoredContinueHandler,0_2_000000014000C4D0
Source: C:\Users\user\Desktop\WCTBt2z7KE.exeCode function: 0_2_000000014001F888 RtlAddVectoredExceptionHandler,0_2_000000014001F888

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Native API		Path InterceptionPath Interception1
Software Packing		OS Credential Dumping1
System Information Discovery		Remote Services1
Archive Collected Data		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
Obfuscated Files or Information		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
WCTBt2z7KE.exe22%ReversingLabs
WCTBt2z7KE.exe33%VirustotalBrowse
WCTBt2z7KE.exe17%MetadefenderBrowse
WCTBt2z7KE.exe100%AviraHEUR/AGEN.1226841
WCTBt2z7KE.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:36.0.0 Rainbow Opal
Analysis ID:708235
Start date and time:2022-09-23 07:54:01 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 3m 50s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:WCTBt2z7KE.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:1
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal60.winEXE@1/0@0/0
EGA Information:
  • Successful, ratio: 100%
HDC Information:
  • Successful, ratio: 65% (good quality ratio 39.1%)
  • Quality average: 38%
  • Quality standard deviation: 36.6%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 20
  • Number of non-executed functions: 39
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):3.06384833991322
TrID:
  • Win64 Executable GUI (202006/5) 81.25%
  • UPX compressed Win32 Executable (30571/9) 12.30%
  • Win64 Executable (generic) (12005/4) 4.83%
  • Generic Win/DOS Executable (2004/3) 0.81%
  • DOS Executable Generic (2002/1) 0.81%
File name:WCTBt2z7KE.exe
File size:325632
MD5:612955e16c4580bbc11798215426ff35
SHA1:016c2f953e1c7a1ba88c1812d70751925ab9e3e0
SHA256:2a39458d3161f7dae38dbad7e846ebecdbd802392f4cd0b845440914532a28d7
SHA512:1e766f005a182e6d5c1f8d83fef6a216935246501a6b175face5ee780daa660d75e5c314346ee1788ff0a4bb7a4320c93b3f37a9af6c20f5f153b40577113916
SSDEEP:1536:24dJooh0Wa0aer344Jw/ytUqVS5EkIijQ1fTN7nCcfrHc:24dzVTaer344JzthRZijQ1JWcfr
TLSH:B964AF8EFD64BCE8C41ED3720692087C61399116DA1B670DD5BFD5B7DBA2A843F40683
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...E.@]........../....2.....0.......`.........@...........................................................................

File Icon

Icon Hash:008039c4c4384000

Static PE Info

General

Entrypoint:0x1400660a0
Entrypoint Section:UPX1
Digitally signed:false
Imagebase:0x140000000
Subsystem:windows gui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:0x5D400545 [Tue Jul 30 08:52:21 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:a50e815adb2cfe3e58d388c791946db8

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FFFF3F7Ah]
dec eax
lea edi, dword ptr [esi-00059025h]
push edi
mov eax, 00064A7Fh
push eax
dec eax
mov ecx, esp
dec eax
mov edx, edi
dec eax
mov edi, esi
mov esi, 0000C075h
push ebp
dec eax
mov ebp, esp
inc esp
mov ecx, dword ptr [ecx]
dec ecx
mov eax, edx
dec eax
mov edx, esi
dec eax
lea esi, dword ptr [edi+02h]
push esi
mov al, byte ptr [edi]
dec edx
mov cl, al
and al, 07h
shr cl, 00000003h
dec eax
mov ebx, FFFFFD00h
dec eax
shl ebx, cl
mov cl, al
dec eax
lea ebx, dword ptr [esp+ebx*2-00000E78h]
dec eax
and ebx, FFFFFFC0h
push 00000000h
dec eax
cmp esp, ebx
jne 00007F759126C5BBh
push ebx
dec eax
lea edi, dword ptr [ebx+08h]
mov cl, byte ptr [esi-01h]
dec edx
mov byte ptr [edi+02h], al
mov al, cl
shr cl, 00000004h
mov byte ptr [edi+01h], cl
and al, 0Fh
mov byte ptr [edi], al
dec eax
lea ecx, dword ptr [edi-04h]
push eax
inc ecx
push edi
dec eax
lea eax, dword ptr [edi+04h]
inc ebp
xor edi, edi
inc ecx
push esi
inc ecx
mov esi, 00000001h
inc ecx
push ebp
inc ebp
xor ebp, ebp
inc ecx
push esp
push ebp
push ebx
dec eax
mov dword ptr [esp-10h], ecx
dec eax
mov dword ptr [esp-28h], eax
mov eax, 00000001h
dec eax
mov dword ptr [esp-08h], esi
dec esp
mov dword ptr [esp-18h], eax
mov ebx, eax
inc esp
mov dword ptr [esp-1Ch], ecx
movzx ecx, byte ptr [edi+02h]
shl ebx, cl
mov ecx, ebx
dec eax
mov ebx, dword ptr [esp+38h]

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0xa955c0x28c.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE0x670000x4255c.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1d0000x10d4UPX0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x00x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
UPX00x10000x590000x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX10x5a0000xd0000xce00False0.9676501820388349data7.969338587590873IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0x670000x430000x42800False0.03488457471804511data1.4954359032844007IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

NameRVASizeTypeLanguageCountry
RT_ICON0x672b00x42028data
RT_RCDATA0x642d40x93data
RT_RCDATA0x643680xdDOS executable (COM, 0x8C-variant)
RT_RCDATA0x643780xcfdata
RT_RCDATA0x644480x1very short file (no magic)
RT_GROUP_ICON0xa92dc0x14data
RT_MANIFEST0xa92f40x267XML 1.0 document, ASCII text

Imports

DLLImport
COMCTL32.DLLInitCommonControlsEx
GDI32.DLLGetStockObject
KERNEL32.DLLLoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
msvcrt.dllfree
OLE32.DLLCoInitialize
SHELL32.DLLShellExecuteExW
SHLWAPI.DLLPathRemoveArgsW
USER32.DLLSetFocus
WINMM.DLLtimeBeginPeriod

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

General

Target ID:0
Start time:07:55:00
Start date:23/09/2022
Path:C:\Users\user\Desktop\WCTBt2z7KE.exe
Wow64 process (32bit):false
Commandline:"C:\Users\user\Desktop\WCTBt2z7KE.exe"
Imagebase:0x140000000
File size:325632 bytes
MD5 hash:612955E16C4580BBC11798215426FF35
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:13.1%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:8.7%
    Total number of Nodes:846
    Total number of Limit Nodes:36
    execution_graph 9156 1400138e5 9159 14001364c 9156->9159 9157 140015060 3 API calls 9158 14001449c 9157->9158 9159->9156 9159->9157 9159->9158 9293 140016f67 9294 140016f79 TlsFree 9293->9294 9295 140016faf 9293->9295 9296 140016f87 9294->9296 9297 140016f9b RtlDeleteCriticalSection 9296->9297 9297->9295 8453 140001dea 8454 140001ded 8453->8454 8465 140012360 8454->8465 8457 140012360 HeapFree 8458 140001e11 8457->8458 8459 140012360 HeapFree 8458->8459 8460 140001e23 8459->8460 8461 140012360 HeapFree 8460->8461 8462 140001e35 8461->8462 8463 140012360 HeapFree 8462->8463 8464 140001e47 8463->8464 8466 140012371 HeapFree 8465->8466 8467 140001dfc 8465->8467 8466->8467 8467->8457 9298 140011f69 9299 14001202d 9298->9299 9300 140011f89 9298->9300 9300->9299 9301 140011fc4 9300->9301 9302 140011d30 4 API calls 9300->9302 9303 140011feb 9301->9303 9304 140011fcf memcpy 9301->9304 9302->9301 9303->9299 9305 140011ffb 9303->9305 9306 14001202f memcpy 9303->9306 9304->9303 9305->9299 9307 140016828 5 API calls 9305->9307 9306->9299 9307->9305 9160 1400016ed 9161 1400016f0 9160->9161 9162 140012360 HeapFree 9161->9162 9163 1400016ff 9162->9163 9164 140011ef4 2 API calls 9163->9164 9165 140001711 9164->9165 9166 140011ef4 2 API calls 9165->9166 9167 140001723 9166->9167 8853 140003c6e 8854 140003c71 8853->8854 8855 140012360 HeapFree 8854->8855 8856 140003c80 8855->8856 8857 140012360 HeapFree 8856->8857 8858 140003c92 8857->8858 8859 140012360 HeapFree 8858->8859 8860 140003ca7 8859->8860 8861 140012360 HeapFree 8860->8861 8862 140003cb9 8861->8862 8863 140010c70 8866 140010c98 8863->8866 8867 140010cd1 8866->8867 8868 140010ceb 8866->8868 8871 140010cd9 8866->8871 8872 1400174e0 8867->8872 8868->8871 8879 140017140 8868->8879 8885 140010f00 8871->8885 8873 140017506 WideCharToMultiByte 8872->8873 8874 14001758d _malloc_dbg 8872->8874 8873->8874 8877 14001754a _malloc_dbg 8873->8877 8875 14001759a 8874->8875 8875->8871 8877->8874 8878 14001755d WideCharToMultiByte 8877->8878 8878->8875 8880 140017166 WideCharToMultiByte 8879->8880 8882 1400171f2 8879->8882 8880->8882 8883 1400171ae _malloc_dbg 8880->8883 8882->8871 8883->8882 8884 1400171bf WideCharToMultiByte 8883->8884 8884->8882 8886 140010f1e 8885->8886 8887 1400126d0 3 API calls 8886->8887 8888 140010d5b 8887->8888 8450 14000c970 HeapDestroy 8468 14000e3f0 8469 14000e40a 8468->8469 8477 14000e4ee 8468->8477 8470 14000e483 8469->8470 8471 14000e41a 8469->8471 8469->8477 8498 14000e770 WideCharToMultiByte 8470->8498 8473 14000e451 8471->8473 8474 14000e425 8471->8474 8473->8473 8475 14000e45d WriteFile 8473->8475 8474->8474 8485 14000e620 8474->8485 8478 14000e4c5 WriteFile 8482 14000e4dc HeapFree 8478->8482 8479 14000e4b7 8481 14000e620 5 API calls 8479->8481 8484 14000e4bf 8481->8484 8482->8477 8483 14000e445 8484->8482 8486 14000e644 8485->8486 8487 14000e75e 8485->8487 8488 14000e673 8486->8488 8489 14000e64a SetFilePointer 8486->8489 8487->8483 8490 14000e6ff 8488->8490 8491 14000e67e 8488->8491 8489->8488 8502 14000ddc0 8490->8502 8493 14000e6b7 8491->8493 8495 14000e699 memcpy 8491->8495 8493->8483 8494 14000e707 8496 14000e711 WriteFile 8494->8496 8497 14000e739 memcpy 8494->8497 8495->8483 8496->8483 8497->8483 8499 14000e7b9 RtlAllocateHeap 8498->8499 8500 14000e4a0 8498->8500 8499->8500 8501 14000e7d8 WideCharToMultiByte 8499->8501 8500->8477 8500->8478 8500->8479 8501->8500 8503 14000de04 8502->8503 8504 14000ddd4 WriteFile 8502->8504 8503->8494 8504->8494 8505 14000e1f0 8512 1400112a8 RtlAcquirePebLock 8505->8512 8507 14000e21b 8508 14000e227 CreateFileW 8507->8508 8509 14000e27f 8507->8509 8508->8509 8510 14000e25c 8508->8510 8510->8509 8511 14000e267 RtlAllocateHeap 8510->8511 8511->8509 8513 1400112e3 8512->8513 8514 1400112d0 8512->8514 8516 140011312 8513->8516 8517 1400112e9 RtlReAllocateHeap 8513->8517 8515 140011cb0 RtlAllocateHeap 8514->8515 8519 1400112de RtlLeaveCriticalSection 8515->8519 8518 14001132d RtlAllocateHeap 8516->8518 8516->8519 8517->8516 8518->8519 8519->8507 8889 140014673 8890 140014682 8889->8890 8891 1400146ba 8889->8891 8892 1400148e1 memcpy 8891->8892 8893 140014747 8891->8893 8892->8893 9308 140013175 9309 14001317a 9308->9309 9312 14001340c memcpy 9309->9312 9313 1400130c8 9309->9313 9310 140015060 3 API calls 9311 14001449c 9310->9311 9312->9313 9313->9310 9313->9311 8525 1400113f8 RtlAcquirePebLock 8527 140011423 RtlLeaveCriticalSection 8525->8527 9168 14000d8f8 9169 14000d908 9168->9169 9170 14000d90d 9168->9170 9172 140011a50 9169->9172 9173 140011a81 9172->9173 9174 140011a60 9172->9174 9173->9170 9178 140011c48 RtlAcquirePebLock 9174->9178 9177 140011a65 9177->9173 9179 140011bdc 9177->9179 9178->9177 9182 140011be7 9179->9182 9180 140011c3c 9180->9177 9181 140011c32 RtlLeaveCriticalSection 9181->9180 9182->9180 9182->9181 8340 140010ffc 8341 140011009 8340->8341 8342 14001101f 8340->8342 8341->8342 8343 140011013 TlsFree 8341->8343 8343->8342 9314 140010b7c 9315 140010b85 memset 9314->9315 9316 140010b8d 9314->9316 9315->9316 9317 14000477e 9318 140012360 HeapFree 9317->9318 9319 140004790 9318->9319 9320 140012360 HeapFree 9319->9320 9321 1400047a2 9320->9321 9322 140012360 HeapFree 9321->9322 9323 1400047b4 9322->9323 9324 140012360 HeapFree 9323->9324 9325 1400047c6 9324->9325 9326 140012360 HeapFree 9325->9326 9327 1400047d8 9326->9327 9183 140016700 _malloc_dbg 8371 140001000 8372 14000101d 8371->8372 8423 140012060 HeapCreate TlsAlloc 8372->8423 8374 14000105b 8426 14000de20 8374->8426 8376 140001065 8429 14000c980 HeapCreate 8376->8429 8378 140001074 8430 14000c07c 8378->8430 8380 140001079 8381 14000b538 memset 00007FF88C9D0BD0 CoInitialize 8380->8381 8382 14000107e 8381->8382 8383 140007160 RtlInitializeCriticalSection 8382->8383 8384 140001083 8383->8384 8385 1400120d0 RtlAllocateHeap RtlReAllocateHeap HeapFree 8384->8385 8386 1400010a3 8385->8386 8387 14000ccd8 32 API calls 8386->8387 8388 1400010e6 8387->8388 8389 14000d524 16 API calls 8388->8389 8390 1400010fa 8389->8390 8391 14000d444 11 API calls 8390->8391 8392 14000111e 8391->8392 8393 14000d524 16 API calls 8392->8393 8394 14000112a 8393->8394 8395 14000d444 11 API calls 8394->8395 8396 14000114e 8395->8396 8397 140011d30 RtlAllocateHeap memset HeapFree HeapFree 8396->8397 8398 140001185 8397->8398 8399 1400120d0 RtlAllocateHeap RtlReAllocateHeap HeapFree 8398->8399 8400 1400011a6 8399->8400 8401 14000d524 16 API calls 8400->8401 8402 1400011b2 8401->8402 8403 14000d444 11 API calls 8402->8403 8404 1400011d6 8403->8404 8405 14000c4d0 RtlRemoveVectoredExceptionHandler RtlAddVectoredExceptionHandler 8404->8405 8406 1400011e5 8405->8406 8407 1400121c0 GetLastError TlsGetValue SetLastError 8406->8407 8408 1400011ef 8407->8408 8409 1400121c0 GetLastError TlsGetValue SetLastError 8408->8409 8410 1400011ff 8409->8410 8411 140004211 32 API calls 8410->8411 8412 14000120e 8411->8412 8413 140012210 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 8412->8413 8414 14000121f 8413->8414 8415 1400021ea 51 API calls 8414->8415 8416 140001224 8415->8416 8417 140001236 8416->8417 8419 14000433f 188 API calls 8416->8419 8418 14000593c 229 API calls 8417->8418 8420 14000123b 8418->8420 8419->8417 8421 1400120a0 HeapDestroy TlsFree 8420->8421 8422 140001245 HeapDestroy ExitProcess 8421->8422 8435 140012c50 RtlAllocateHeap RtlAllocateHeap TlsSetValue 8423->8435 8425 14001208c 8425->8374 8436 140011370 RtlAllocateHeap RtlAllocateHeap RtlInitializeCriticalSection 8426->8436 8428 14000de38 8428->8376 8429->8378 8437 1400110dc 8430->8437 8434 14000c0a8 RtlInitializeCriticalSection 8435->8425 8436->8428 8438 1400110fd 8437->8438 8439 140011112 TlsAlloc RtlAllocateHeap TlsSetValue 8438->8439 8440 140011149 TlsGetValue RtlReAllocateHeap TlsSetValue 8438->8440 8439->8440 8441 140011198 8440->8441 8442 14000c08d 8441->8442 8445 140011cb0 RtlAllocateHeap 8441->8445 8444 140011370 RtlAllocateHeap RtlAllocateHeap RtlInitializeCriticalSection 8442->8444 8444->8434 8446 140011cd3 8445->8446 8446->8442 8528 140007a00 8531 140007a50 8528->8531 8532 140007a79 8531->8532 8553 140012630 TlsGetValue 8532->8553 8535 140012630 TlsGetValue 8536 140007a9c 8535->8536 8555 1400126d0 TlsGetValue 8536->8555 8539 140007abf 8544 140007acf 8539->8544 8562 140012850 TlsGetValue 8539->8562 8542 140007c35 8563 140012900 TlsGetValue 8542->8563 8544->8542 8546 140007b20 RtlAllocateHeap 8544->8546 8547 140007b50 8544->8547 8545 140007a1c 8546->8547 8547->8547 8548 140007b91 wcsncpy 8547->8548 8551 140007bac 8547->8551 8548->8551 8549 140007c02 8549->8542 8550 140007c09 HeapFree 8549->8550 8550->8542 8551->8549 8552 140007bdf wcsncpy 8551->8552 8552->8549 8554 140007a92 8553->8554 8554->8535 8556 1400126f4 8555->8556 8557 140012772 8556->8557 8558 14001272d RtlReAllocateHeap 8556->8558 8559 140007ab1 8557->8559 8560 140012793 RtlReAllocateHeap 8557->8560 8558->8559 8559->8539 8561 140012850 TlsGetValue 8559->8561 8560->8559 8561->8539 8562->8544 8563->8545 8564 140008200 8567 140008260 8564->8567 8568 1400082e4 8567->8568 8569 140008397 8568->8569 8579 14000830a 8568->8579 8570 140012630 TlsGetValue 8569->8570 8572 14000839f 8570->8572 8571 140008221 8573 1400083ba 8572->8573 8574 1400083aa _wcsdup 8572->8574 8575 140012630 TlsGetValue 8573->8575 8574->8573 8576 1400083c2 8575->8576 8577 1400083d8 8576->8577 8578 1400083cd _wcsdup 8576->8578 8580 140012630 TlsGetValue 8577->8580 8578->8577 8579->8571 8582 140008363 wcsncpy 8579->8582 8581 1400083e0 8580->8581 8583 1400083eb _wcsdup 8581->8583 8586 1400083f8 8581->8586 8582->8579 8583->8586 8584 1400126d0 3 API calls 8585 140008481 8584->8585 8587 1400084ed wcsncpy 8585->8587 8588 14000850e 8585->8588 8591 140008488 8585->8591 8586->8584 8587->8588 8588->8591 8595 1400085c0 wcsncpy 8588->8595 8589 140008575 8592 140008587 8589->8592 8593 14000857f ??3@YAXPEAX 8589->8593 8590 14000856d ??3@YAXPEAX 8590->8589 8591->8589 8591->8590 8592->8571 8594 140008591 ??3@YAXPEAX 8592->8594 8593->8592 8594->8571 8595->8588 8900 14000d881 8901 14000d89d 8900->8901 8902 14000d8dc 8900->8902 8901->8902 8905 14000d8af 8901->8905 8907 14000d60c 8901->8907 8905->8902 8914 14000d6a0 8905->8914 8919 140016828 8905->8919 8908 14000d656 8907->8908 8912 14000d62f 8907->8912 8909 14000d654 8908->8909 8910 1400116f4 3 API calls 8908->8910 8909->8905 8910->8908 8911 140016bb0 HeapFree 8911->8912 8912->8909 8912->8911 8928 1400116f4 8912->8928 8915 14001147c 4 API calls 8914->8915 8916 14000d6b6 8915->8916 8917 14000d6c2 memset 8916->8917 8918 14000d6d6 8916->8918 8917->8918 8918->8905 8921 140016ba7 8919->8921 8925 140016831 8919->8925 8920 140016ba2 memcpy 8920->8921 8921->8905 8922 140016b50 memcpy 8922->8925 8923 140016b85 8923->8920 8923->8921 8924 140016828 wcslen RtlAllocateHeap HeapFree 8924->8925 8925->8922 8925->8923 8925->8924 8926 140012360 HeapFree 8925->8926 8935 1400122f0 8925->8935 8926->8925 8929 14001170a RtlAcquirePebLock 8928->8929 8932 140011714 8928->8932 8929->8932 8930 1400117f1 8930->8912 8931 1400117e7 RtlLeaveCriticalSection 8931->8930 8933 14001177b HeapFree 8932->8933 8934 140011794 8932->8934 8933->8934 8934->8930 8934->8931 8936 140012351 8935->8936 8937 140012306 wcslen RtlAllocateHeap 8935->8937 8936->8925 8937->8936 8596 140013801 8598 140013810 8596->8598 8597 1400144ee 8601 1400138d8 8597->8601 8602 140015060 8597->8602 8598->8597 8599 14001389e memcpy 8598->8599 8598->8601 8599->8601 8603 14001508d 8602->8603 8604 1400150ea memcpy 8603->8604 8605 1400150cf memcpy 8603->8605 8606 1400150a7 8603->8606 8604->8606 8607 14001510b memcpy 8604->8607 8605->8606 8606->8601 8607->8606 8608 14000bc0c 8609 14000bc19 EnableWindow 8608->8609 8610 14000bc2b 8608->8610 8609->8610 8611 140017410 8612 14001749e _malloc_dbg 8611->8612 8613 140017430 MultiByteToWideChar 8611->8613 8614 1400174ac 8612->8614 8613->8612 8616 14001745d _malloc_dbg MultiByteToWideChar 8613->8616 8616->8614 9192 140014d10 9194 140014d32 9192->9194 9195 140014d6a 9192->9195 9193 140015060 3 API calls 9193->9195 9194->9193 9194->9195 9196 140016710 ??3@YAXPEAX 9328 140014990 9329 1400149aa 9328->9329 9331 140014a09 9328->9331 9330 1400149df memcpy memcpy 9329->9330 9329->9331 9330->9331 9332 140012390 HeapFree HeapFree 8938 14000c490 8943 14000c6e0 8938->8943 8941 14000c4c6 8942 14000c4ab GetCurrentProcess TerminateProcess 8942->8941 8946 14000c4f0 8943->8946 8947 14000c510 8946->8947 8947->8947 8948 14000c562 RtlLookupFunctionEntry 8947->8948 8949 14000c5f3 8948->8949 8950 14000c5b4 RtlLookupFunctionEntry 8948->8950 8951 14000c61b RtlVirtualUnwind 8949->8951 8952 14000c499 8949->8952 8953 14000c664 RtlLookupFunctionEntry 8949->8953 8950->8949 8950->8952 8951->8949 8951->8952 8952->8941 8952->8942 8953->8949 8953->8952 8617 140011e11 8620 140011e56 8617->8620 8619 140011ec4 8620->8619 8621 140011d30 8620->8621 8627 140011ef4 8621->8627 8624 140011d6e RtlAllocateHeap 8625 140011d90 memset 8624->8625 8626 140011dc6 8624->8626 8625->8626 8626->8619 8628 140011d69 8627->8628 8629 140011ef9 8627->8629 8628->8624 8628->8626 8630 140011f38 HeapFree 8629->8630 8632 140016bb0 8629->8632 8630->8628 8636 140016bca 8632->8636 8633 140016ced 8633->8629 8634 140016bb0 HeapFree 8634->8636 8635 140012360 HeapFree 8635->8636 8636->8633 8636->8634 8636->8635 9197 140002914 9198 140012360 HeapFree 9197->9198 9199 140002926 9198->9199 8332 1400660a0 8333 1400660fc 8332->8333 8333->8333 8334 140066b81 LoadLibraryA 8333->8334 8335 140066bcb VirtualProtect VirtualProtect 8333->8335 8337 140066b9b 8334->8337 8336 140066c23 8335->8336 8336->8336 8337->8333 8338 140066ba4 GetProcAddress 8337->8338 8338->8337 8339 140066bc5 ExitProcess 8338->8339 8637 14000281c 8644 140012600 TlsGetValue 8637->8644 8639 140002821 8640 140012360 HeapFree 8639->8640 8641 140002835 8640->8641 8642 140012360 HeapFree 8641->8642 8643 140002847 8642->8643 8644->8639 9200 14001431b 9201 1400144ee 9200->9201 9203 140014324 9200->9203 9202 140015060 3 API calls 9201->9202 9201->9203 9202->9203 8645 140017220 8646 140017250 8645->8646 8646->8646 8647 14001725b MultiByteToWideChar 8646->8647 8648 1400126d0 3 API calls 8647->8648 8649 140017287 MultiByteToWideChar 8648->8649 8954 1400076a0 8955 1400076b4 8954->8955 8957 140007716 8954->8957 8956 140007702 wcsstr 8955->8956 8955->8957 8956->8957 8958 14000bea0 GetWindowThreadProcessId GetCurrentThreadId 8959 14000bf31 8958->8959 8960 14000bec1 IsWindowVisible 8958->8960 8960->8959 8961 14000bece 8960->8961 8962 140011cb0 RtlAllocateHeap 8961->8962 8963 14000bedf GetCurrentThreadId GetWindowLongPtrW 8962->8963 8964 14000bf06 8963->8964 8965 14000bf0a GetForegroundWindow 8963->8965 8964->8965 8965->8959 8966 14000bf15 IsWindowEnabled 8965->8966 8966->8959 8967 14000bf22 EnableWindow 8966->8967 8967->8959 8968 1400034a2 8981 140012600 TlsGetValue 8968->8981 8970 1400034a7 8971 140012360 HeapFree 8970->8971 8972 1400034bb 8971->8972 8973 140012360 HeapFree 8972->8973 8974 1400034cd 8973->8974 8975 140012360 HeapFree 8974->8975 8976 1400034df 8975->8976 8977 140012360 HeapFree 8976->8977 8978 1400034f1 8977->8978 8979 140012360 HeapFree 8978->8979 8980 140003503 8979->8980 8981->8970 8650 140011024 8651 140011032 TlsFree 8650->8651 8652 14001103e 8650->8652 8651->8652 8653 14000e824 8654 14000e8e4 8653->8654 8662 14000fee4 8654->8662 8663 14000ff0b 8662->8663 8664 14000ff92 8663->8664 8665 14000ff47 memcpy 8663->8665 8669 14000ea48 8665->8669 8667 14000ff70 8667->8664 8668 14000ea48 memcpy 8667->8668 8668->8667 8670 14000ea81 8669->8670 8671 14000ea71 memcpy 8669->8671 8670->8667 8671->8670 9347 140010fa8 9348 140010fbe 9347->9348 9349 140010fdd HeapFree 9348->9349 9350 140010fef 9348->9350 9349->9350 8672 140013227 8675 14001322c 8672->8675 8673 140015060 3 API calls 8674 14001449c 8673->8674 8676 14001340c memcpy 8675->8676 8677 14001341c 8675->8677 8676->8677 8677->8673 8677->8674 9351 1400021a8 9352 1400021ab 9351->9352 9353 140012360 HeapFree 9352->9353 9354 1400021ba 9353->9354 9355 140012360 HeapFree 9354->9355 9356 1400021cc 9355->9356 9357 140012360 HeapFree 9356->9357 9358 1400021de 9357->9358 8678 14001162c 8683 14001147c 8678->8683 8681 140011646 memset 8682 140011659 8681->8682 8684 1400114a4 8683->8684 8685 14001149a RtlAcquirePebLock 8683->8685 8686 14001155e RtlAllocateHeap 8684->8686 8690 1400114b1 8684->8690 8685->8684 8687 140011586 RtlAllocateHeap 8686->8687 8686->8690 8687->8690 8688 140011606 8688->8681 8688->8682 8689 1400115fc RtlLeaveCriticalSection 8689->8688 8690->8688 8690->8689 8691 14000b62c 8692 14000b635 HeapFree 8691->8692 8693 14000b647 8691->8693 8692->8693 8991 1400040ac 8992 1400123e0 21 API calls 8991->8992 8993 1400040ce 8992->8993 8994 14000d6a0 5 API calls 8993->8994 8995 1400040da 8994->8995 9004 1400121c0 GetLastError TlsGetValue SetLastError 8995->9004 8997 1400040e4 9005 1400121c0 GetLastError TlsGetValue SetLastError 8997->9005 8999 1400040f8 9006 14000ca00 8999->9006 9003 140004122 9004->8997 9005->8999 9007 14000ca20 9006->9007 9008 1400126d0 3 API calls 9007->9008 9009 14000ca34 9008->9009 9010 14000ca3b memcpy 9009->9010 9011 14000410d 9009->9011 9010->9011 9012 140012210 TlsGetValue 9011->9012 9013 140012251 RtlAllocateHeap 9012->9013 9014 140012276 RtlReAllocateHeap 9012->9014 9015 1400122a1 9013->9015 9014->9015 9015->9003 9204 14000432e 9207 140012600 TlsGetValue 9204->9207 9206 140004333 9207->9206 8694 140011a30 RtlInitializeCriticalSection 8447 14000c6b0 8448 14000c6d1 8447->8448 8449 14000c6c0 RtlRemoveVectoredExceptionHandler 8447->8449 8449->8448 8695 140007a30 8696 140007a50 10 API calls 8695->8696 8697 140007a49 8696->8697 8698 140008230 8699 140008260 13 API calls 8698->8699 8700 140008251 8699->8700 9208 140007730 9209 1400077e3 9208->9209 9210 140007743 9208->9210 9210->9209 9211 1400077b5 9210->9211 9212 1400077bc wcsstr 9210->9212 9215 1400085f0 9211->9215 9214 1400077ba 9212->9214 9216 140008617 CharLowerW 9215->9216 9219 14000869f 9215->9219 9217 140008630 9216->9217 9217->9217 9218 14000864c CharLowerW 9217->9218 9217->9219 9220 140008670 CharLowerW CharLowerW 9217->9220 9218->9217 9219->9214 9220->9217 9022 140008eb5 9023 140008ec9 9022->9023 9024 140008ee3 9022->9024 9027 140008ed4 9023->9027 9028 140009da0 9023->9028 9024->9027 9038 14000afc0 9024->9038 9029 140009dc9 9028->9029 9032 140009e0d 9028->9032 9048 14000b510 9029->9048 9031 140009de0 9031->9027 9032->9031 9032->9032 9033 140009da0 _wcsicmp 9032->9033 9034 140009e66 9033->9034 9035 140009da0 _wcsicmp 9034->9035 9036 140009e79 9035->9036 9036->9031 9037 14000b510 _wcsicmp 9036->9037 9037->9036 9039 14000afe9 9038->9039 9041 14000b02d 9038->9041 9040 14000b510 _wcsicmp 9039->9040 9045 14000b000 9040->9045 9041->9041 9042 14000afc0 _wcsicmp 9041->9042 9041->9045 9043 14000b086 9042->9043 9044 14000afc0 _wcsicmp 9043->9044 9047 14000b099 9044->9047 9045->9027 9046 14000b510 _wcsicmp 9046->9047 9047->9045 9047->9046 9049 14000b524 9048->9049 9050 14000b515 9048->9050 9049->9031 9051 1400070cc _wcsicmp 9050->9051 9052 14000b51e 9050->9052 9051->9031 9051->9048 9052->9031 8701 14000bc38 8702 14000bc84 8701->8702 8703 14000bc4c 8701->8703 8703->8702 8704 14000bc51 IsDlgButtonChecked Sleep PostMessageW 8703->8704 8704->8702 9053 1400146b7 9054 1400146d7 9053->9054 9055 140014747 9053->9055 9054->9055 9056 1400148e1 memcpy 9054->9056 9056->9055 8709 14000e83b RtlAllocateHeap 8710 14000e87d 8709->8710 8711 14000303f 8722 140012600 TlsGetValue 8711->8722 8713 140003044 8714 140012360 HeapFree 8713->8714 8715 140003058 8714->8715 8716 140012360 HeapFree 8715->8716 8717 14000306a 8716->8717 8718 140012360 HeapFree 8717->8718 8719 14000307c 8718->8719 8720 140012360 HeapFree 8719->8720 8721 14000308e 8720->8721 8722->8713 9057 1400172c0 9058 1400172f0 9057->9058 9058->9058 9059 1400172fb MultiByteToWideChar _malloc_dbg MultiByteToWideChar 9058->9059 8723 14000c040 8728 140011248 RtlAcquirePebLock 8723->8728 8726 14000c075 8727 14000c05d CloseHandle 8727->8726 8729 14001127a RtlLeaveCriticalSection 8728->8729 8730 14001126c 8728->8730 8731 14000c058 8729->8731 8730->8729 8731->8726 8731->8727 9060 1400048c0 9069 140012600 TlsGetValue 9060->9069 9062 1400048c5 9063 140012360 HeapFree 9062->9063 9064 1400048d9 9063->9064 9065 140012360 HeapFree 9064->9065 9066 1400048eb 9065->9066 9067 140012360 HeapFree 9066->9067 9068 1400048fd 9067->9068 9069->9062 9221 14000e540 9222 140011248 2 API calls 9221->9222 9223 14000e55f 9222->9223 9224 14000b740 9227 14000b758 9224->9227 9267 14000b5d8 9227->9267 9229 14000b790 9230 14000b5d8 2 API calls 9229->9230 9231 14000b79b 9230->9231 9232 14000b5d8 2 API calls 9231->9232 9233 14000b7a6 9232->9233 9234 14000b7b2 GetStockObject 9233->9234 9235 14000b7c3 LoadIconW LoadCursorW RegisterClassExW 9233->9235 9234->9235 9236 14000be5c 3 API calls 9235->9236 9237 14000b83f 9236->9237 9238 14000bf44 7 API calls 9237->9238 9239 14000b84d 9238->9239 9240 14000b859 IsWindowEnabled 9239->9240 9241 14000b87a 9239->9241 9240->9241 9242 14000b863 EnableWindow 9240->9242 9243 14000be5c 3 API calls 9241->9243 9242->9241 9244 14000b886 GetSystemMetrics GetSystemMetrics CreateWindowExW 9243->9244 9245 14000b902 6 API calls 9244->9245 9246 14000bb96 9244->9246 9248 14000ba12 IsDlgButtonChecked wcslen wcslen IsDlgButtonChecked 9245->9248 9249 14000ba53 CreateWindowExW IsDlgButtonChecked CreateAcceleratorTableW SetForegroundWindow BringWindowToTop 9245->9249 9247 14000bba4 9246->9247 9270 140012810 TlsGetValue 9246->9270 9251 14000bba9 HeapFree 9247->9251 9252 14000bbbb 9247->9252 9248->9249 9253 14000bb48 9249->9253 9251->9252 9254 14000bbd2 9252->9254 9255 14000bbc0 HeapFree 9252->9255 9256 14000bb51 9253->9256 9257 14000bb0a GetMessageW 9253->9257 9259 14000bbd7 HeapFree 9254->9259 9260 14000b751 9254->9260 9255->9254 9261 14000bb56 DestroyAcceleratorTable 9256->9261 9262 14000bb5f 9256->9262 9257->9256 9258 14000bb20 TranslateAcceleratorW 9257->9258 9258->9253 9263 14000bb34 TranslateMessage DispatchMessageW 9258->9263 9259->9260 9261->9262 9262->9246 9264 14000bb68 wcslen 9262->9264 9263->9253 9265 1400126d0 3 API calls 9264->9265 9266 14000bb77 wcscpy HeapFree 9265->9266 9266->9246 9268 14000b5ea wcslen RtlAllocateHeap 9267->9268 9269 14000b60e 9267->9269 9268->9269 9269->9229 9270->9247 8732 14000c444 8733 14000c455 8732->8733 8734 14000c44d SetEnvironmentVariableW 8732->8734 8734->8733 9070 14000cec4 9071 14000cee9 9070->9071 9073 14000cf4b 9070->9073 9071->9073 9076 14000cf02 9071->9076 9078 14000d140 9071->9078 9076->9073 9077 140016828 5 API calls 9076->9077 9085 14000d1f0 9076->9085 9094 14000d02c 9076->9094 9077->9076 9082 14000d15b 9078->9082 9079 14000d1b4 memset 9080 14000d1d0 9079->9080 9080->9076 9081 14000d163 HeapFree 9081->9082 9082->9079 9082->9081 9083 140016bb0 HeapFree 9082->9083 9084 1400116f4 3 API calls 9082->9084 9083->9082 9084->9082 9086 14000d230 9085->9086 9087 14000d210 9085->9087 9088 14001147c 4 API calls 9086->9088 9087->9086 9090 14000d21d 9087->9090 9089 14000d22e 9088->9089 9091 14000d281 memset 9089->9091 9093 14000d295 9089->9093 9090->9089 9092 140016bb0 HeapFree 9090->9092 9091->9093 9092->9089 9093->9076 9095 14000d073 9094->9095 9096 14000d04c 9094->9096 9100 14000d08f 9095->9100 9115 14000d3a4 9095->9115 9109 14000cf74 9096->9109 9099 14000d051 9099->9095 9101 14000d059 9099->9101 9102 14001147c 4 API calls 9100->9102 9103 14000d06e 9101->9103 9104 140016bb0 HeapFree 9101->9104 9105 14000d0a6 9102->9105 9106 14000d11c 9103->9106 9107 14000d108 memset 9103->9107 9104->9103 9105->9106 9108 14000d0ae wcslen RtlAllocateHeap wcscpy 9105->9108 9106->9076 9107->9106 9108->9103 9110 14000cfa2 9109->9110 9112 14000cfe2 9109->9112 9111 14000d3a4 tolower 9110->9111 9113 14000cfa7 9111->9113 9112->9113 9114 14000cff8 wcscmp 9112->9114 9113->9099 9114->9112 9114->9113 9116 14000d3c7 tolower 9115->9116 9117 14000d3b8 9116->9117 9118 14000d3d0 9116->9118 9117->9116 9118->9100 9271 140003144 9272 140003147 9271->9272 9273 140012360 HeapFree 9272->9273 9274 140003156 9273->9274 9275 140012360 HeapFree 9274->9275 9276 140003168 9275->9276 8735 140002648 8736 14000264f 8735->8736 8737 140012360 HeapFree 8736->8737 8738 140002666 8737->8738 8739 140012360 HeapFree 8738->8739 8740 140002678 8739->8740 8741 140012360 HeapFree 8740->8741 8742 14000268a 8741->8742 8743 140012360 HeapFree 8742->8743 8744 14000269c 8743->8744 8745 140012360 HeapFree 8744->8745 8746 1400026ae 8745->8746 9119 1400088c9 9120 1400088fa 9119->9120 9121 1400088e0 9119->9121 9122 14000afc0 _wcsicmp 9120->9122 9124 1400088eb 9120->9124 9123 140009da0 _wcsicmp 9121->9123 9121->9124 9122->9124 9123->9124 8344 14000b64c 8345 14000b667 8344->8345 8346 14000b70e UnregisterClassW 8344->8346 8348 14000b68b 8345->8348 8349 14000b674 NtdllDefWindowProc_W 8345->8349 8350 14000b67f 8345->8350 8347 14000b72c 8346->8347 8348->8347 8351 14000b6ea EnableWindow 8348->8351 8352 14000b6fc 8348->8352 8349->8347 8350->8348 8354 14000b695 GetWindowLongPtrW GetWindowTextLengthW RtlAllocateHeap GetWindowTextW 8350->8354 8351->8352 8356 14000bf44 8352->8356 8354->8348 8357 14000bf57 EnumWindows 8356->8357 8362 14000bfbb 8356->8362 8358 14000bf77 GetCurrentThreadId 8357->8358 8359 14000b703 DestroyWindow 8357->8359 8361 14000bf85 8358->8361 8359->8347 8360 14000bfc7 GetCurrentThreadId 8360->8362 8361->8358 8361->8359 8363 14000bf8b SetWindowPos 8361->8363 8362->8359 8362->8360 8364 14000bfdb EnableWindow 8362->8364 8365 14000bff0 SetWindowPos 8362->8365 8367 140011c68 8362->8367 8363->8361 8364->8362 8365->8362 8368 140011c74 HeapFree 8367->8368 8370 14001f820 8368->8370 8370->8370 9281 140002b4c 9282 1400123e0 21 API calls 9281->9282 9283 140002b6a 9282->9283 9125 140012cd0 TlsGetValue HeapFree HeapFree 8747 14000de50 8748 1400112a8 5 API calls 8747->8748 8749 14000de98 8748->8749 8750 14000e04d 8749->8750 8751 14000deb6 CreateFileW 8749->8751 8752 14000defb 8749->8752 8757 14000dfb7 8751->8757 8754 14000df42 8752->8754 8755 14000df00 CreateFileW 8752->8755 8754->8757 8758 14000df5f CreateFileW 8754->8758 8755->8757 8757->8750 8760 14000dff9 8757->8760 8761 14000dfe1 RtlAllocateHeap 8757->8761 8758->8757 8759 14000df8d CreateFileW 8758->8759 8759->8757 8760->8750 8762 14000e036 SetFilePointer 8760->8762 8761->8760 8762->8750 9126 1400086d0 9127 140008701 9126->9127 9128 1400086ee 9126->9128 9129 140008710 CharLowerW CharLowerW 9127->9129 9130 14000873e 9127->9130 9129->9127 9129->9130 8763 140002853 8784 1400123e0 8763->8784 8767 14000286b 8796 1400121c0 GetLastError TlsGetValue SetLastError 8767->8796 8769 140002889 8797 140012450 8769->8797 8771 140002898 8802 1400121c0 GetLastError TlsGetValue SetLastError 8771->8802 8773 1400028a6 8803 1400121c0 GetLastError TlsGetValue SetLastError 8773->8803 8775 1400028ba 8804 14000c8e0 8775->8804 8779 1400028d4 8809 1400125d0 TlsGetValue 8779->8809 8781 1400028e5 8810 14000b574 8781->8810 8783 1400028fb 8785 1400123ed 8784->8785 8786 14001240f TlsGetValue 8784->8786 8788 140012060 5 API calls 8785->8788 8787 140012420 8786->8787 8794 140002861 8786->8794 8826 140012c50 RtlAllocateHeap RtlAllocateHeap TlsSetValue 8787->8826 8790 1400123f2 TlsGetValue 8788->8790 8817 140016fb4 8790->8817 8791 140012425 TlsGetValue 8793 140016fb4 13 API calls 8791->8793 8793->8794 8795 1400121c0 GetLastError TlsGetValue SetLastError 8794->8795 8795->8767 8796->8769 8798 140012477 8797->8798 8799 140012469 wcslen 8797->8799 8800 1400126d0 3 API calls 8798->8800 8799->8798 8801 140012485 8800->8801 8801->8771 8802->8773 8803->8775 8805 14000c8f0 8804->8805 8806 1400126d0 3 API calls 8805->8806 8807 1400028ca 8806->8807 8808 140012520 TlsGetValue 8807->8808 8808->8779 8809->8781 8827 14000be5c GetForegroundWindow 8810->8827 8813 14000bf44 7 API calls 8814 14000b5a3 MessageBoxW 8813->8814 8815 14000bf44 7 API calls 8814->8815 8816 14000b5bf 8815->8816 8816->8783 8818 140016fe2 TlsAlloc RtlInitializeCriticalSection 8817->8818 8819 140017001 TlsGetValue 8817->8819 8818->8819 8820 1400170d6 RtlAllocateHeap 8819->8820 8821 140017019 RtlAllocateHeap 8819->8821 8822 1400170ee 8820->8822 8821->8822 8823 140017039 RtlAcquirePebLock 8821->8823 8822->8794 8824 140017051 7 API calls 8823->8824 8825 14001704e 8823->8825 8824->8820 8825->8824 8826->8791 8828 14000b596 8827->8828 8829 14000be76 GetWindowThreadProcessId GetCurrentProcessId 8827->8829 8828->8813 8829->8828 8842 140066054 8848 140066094 8842->8848 8843 140066b81 LoadLibraryA 8843->8848 8844 140066bcb VirtualProtect VirtualProtect 8845 140066c23 8844->8845 8845->8845 8846 140066ba4 GetProcAddress 8847 140066bc5 ExitProcess 8846->8847 8846->8848 8848->8843 8848->8844 8848->8846 9131 14000c2d8 9136 14000c188 9131->9136 9134 1400126d0 3 API calls 9135 14000c30c 9134->9135 9140 140011044 TlsGetValue 9136->9140 9139 14000c1c5 9139->9134 9141 14000c1a9 GetCommandLineW 9140->9141 9142 14001106a RtlAllocateHeap TlsSetValue 9140->9142 9141->9139 9143 14001109c 9142->9143 9144 140016fb4 13 API calls 9143->9144 9144->9141 9359 1400031d9 9360 1400031dc 9359->9360 9361 140012360 HeapFree 9360->9361 9362 1400031eb 9361->9362 9363 14000c3dc GetEnvironmentVariableW 9364 14000c408 9363->9364 9365 1400126d0 3 API calls 9364->9365 9366 14000c413 GetEnvironmentVariableW 9365->9366 9367 140012fdd 9370 140012fe5 9367->9370 9368 140015060 3 API calls 9369 14001449c 9368->9369 9370->9368 9370->9369 9284 140017360 9285 1400173e8 9284->9285 9286 140017387 MultiByteToWideChar 9284->9286 9287 1400126d0 3 API calls 9285->9287 9286->9285 9289 1400173b9 9286->9289 9290 1400173f1 9287->9290 9291 1400126d0 3 API calls 9289->9291 9292 1400173c2 MultiByteToWideChar 9291->9292 9292->9290 9149 14000e2e0 9150 1400112a8 5 API calls 9149->9150 9151 14000e30b 9150->9151 9152 14000e317 CreateFileW 9151->9152 9153 14000e36f 9151->9153 9152->9153 9154 14000e34c 9152->9154 9154->9153 9155 14000e357 RtlAllocateHeap 9154->9155 9155->9153

    Executed Functions

    Function 000000014000B758 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 272windowmemoryregistryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 0 14000b758-14000b7b0 call 14000b5d8 * 3 7 14000b7b2-14000b7bc GetStockObject 0->7 8 14000b7c3-14000b857 LoadIconW LoadCursorW RegisterClassExW call 14000be5c call 14000bf44 0->8 7->8 13 14000b859-14000b861 IsWindowEnabled 8->13 14 14000b87a 8->14 13->14 16 14000b863-14000b878 EnableWindow 13->16 15 14000b881-14000b8fc call 14000be5c GetSystemMetrics * 2 CreateWindowExW 14->15 19 14000b902-14000ba10 SetWindowLongPtrW CreateWindowExW IsDlgButtonChecked CreateWindowExW IsDlgButtonChecked SetFocus 15->19 20 14000bb96-14000bb9a 15->20 16->15 23 14000ba12-14000ba4d IsDlgButtonChecked wcslen * 2 IsDlgButtonChecked 19->23 24 14000ba53-14000bb08 CreateWindowExW IsDlgButtonChecked CreateAcceleratorTableW SetForegroundWindow BringWindowToTop 19->24 21 14000bba4-14000bba7 20->21 22 14000bb9c-14000bb9f call 140012810 20->22 26 14000bba9-14000bbb5 HeapFree 21->26 27 14000bbbb-14000bbbe 21->27 22->21 23->24 28 14000bb48-14000bb4f 24->28 26->27 29 14000bbd2-14000bbd5 27->29 30 14000bbc0-14000bbcc HeapFree 27->30 31 14000bb51-14000bb54 28->31 32 14000bb0a-14000bb1e GetMessageW 28->32 34 14000bbd7-14000bbe3 HeapFree 29->34 35 14000bbe9-14000bc09 29->35 30->29 36 14000bb56-14000bb59 DestroyAcceleratorTable 31->36 37 14000bb5f-14000bb66 31->37 32->31 33 14000bb20-14000bb32 TranslateAcceleratorW 32->33 33->28 38 14000bb34-14000bb42 TranslateMessage DispatchMessageW 33->38 34->35 36->37 37->22 39 14000bb68-14000bb90 wcslen call 1400126d0 wcscpy HeapFree 37->39 38->28 39->20
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Window$ButtonCheckedCreateHeap$Freewcslen$AcceleratorMessage$LoadMetricsSystemTableTranslate$AllocateBringClassCursorDestroyDispatchEnableEnabledFocusForegroundIconLongObjectRegisterStockwcscpy
    • String ID: BUTTON$C$EDIT$P$STATIC$n
    • API String ID: 3940601472-1690119102
    • Opcode ID: 002200ebb1e1213bc04a13eb1c4ef8fb9e0871078b3e41863b1eb0bca815023c
    • Instruction ID: 503d67efbf07ff6f248b06a67c50be69490569a40db1ce31eb7df8f18fb995d6
    • Opcode Fuzzy Hash: 002200ebb1e1213bc04a13eb1c4ef8fb9e0871078b3e41863b1eb0bca815023c
    • Instruction Fuzzy Hash: 59D134B5605B4086EB12DB62F8447AA77A5FB8CBC8F404129AF4A47B79DF7DC4498B00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000B64C Relevance: 12.1, APIs: 8, Instructions: 56nativeCOMMON
    Download Yara Rule

    Control-flow Graph

    C-Code - Quality: 40%
    			E0000000114000B64C(void* __edx, long long __rax, long long __rbx, void* __rcx, long long __rsi, long long _a8, long long _a16) {
				void* __rdi;
				void* _t6;
				void* _t16;
				void* _t26;
				void* _t27;
				void* _t28;
				void* _t31;
				void* _t34;
				void* _t46;
				void* _t49;
				void* _t52;
				void* _t57;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t64;

				_t35 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t52 = __rcx;
				if (__edx == 2) goto 0x4000b70e;
				if (__edx == 0x10) goto 0x4000b6e1;
				_t31 = __edx - 0x111;
				if (_t31 == 0) goto 0x4000b67f; // executed
				_t6 =  *0x4001f9d8(); // executed
				goto 0x4000b72e;
				if (_t31 == 0) goto 0x4000b695;
				if (_t31 != 0) goto 0x4000b72c;
				goto 0x4000b6e1;
				E0000000114001F9E0(_t6, _t16, (r8w & 0xffffffff) - 0x3e7, 0xffffffeb, _t26, _t27, _t28, _t31, _t34, __rax, __rbx, _t46, _t49, __rcx, _t57, _t60, _t61, _t62, _t63, _t64);
				GetWindowTextLengthW(??);
				_t3 = _t35 + 1; // 0x1
				RtlAllocateHeap(??, ??, ??);
				r8d = _t3;
				 *((long long*)(__rax)) = __rax;
				GetWindowTextW(??, ??, ??);
				if ( *0x400205d4 == 0) goto 0x4000b6fc;
				EnableWindow(??, ??);
				E0000000114000BF44(0, __rbx, _t52, _t60);
				DestroyWindow(??); // executed
				goto 0x4000b72c;
				UnregisterClassW(??, ??);
				 *0x400205d0 = 1;
				return 0;
			}




















    0x14000b64c
    0x14000b64c
    0x14000b651
    0x14000b65b
    0x14000b661
    0x14000b66a
    0x14000b66c
    0x14000b672
    0x14000b674
    0x14000b67a
    0x14000b689
    0x14000b68d
    0x14000b693
    0x14000b69d
    0x14000b6ad
    0x14000b6ba
    0x14000b6c5
    0x14000b6d2
    0x14000b6d8
    0x14000b6db
    0x14000b6e8
    0x14000b6f6
    0x14000b6fe
    0x14000b706
    0x14000b70c
    0x14000b71c
    0x14000b722
    0x14000b73d

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Window$ClassDestroyEnableNtdllProc_Unregister
    • String ID:
    • API String ID: 1396861415-0
    • Opcode ID: fc5dfa83332df02ed0060d8fb174e8f27900349cc90facb9f358c39e73375a0a
    • Instruction ID: a4636e2d5cbf899b35d7322a6c98c02ffc5b8df7e19630505cb7187d8542c3a3
    • Opcode Fuzzy Hash: fc5dfa83332df02ed0060d8fb174e8f27900349cc90facb9f358c39e73375a0a
    • Instruction Fuzzy Hash: 4A210BB4204A5182FB56DB27F8483B923A1E78CBC1F549026FB4A4B7B5DF3DC8859700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400660A0 Relevance: 6.8, APIs: 4, Instructions: 849librarymemoryloaderCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: ProtectVirtual$AddressLibraryLoadProc
    • String ID:
    • API String ID: 3300690313-0
    • Opcode ID: c25f904b91756b564ae4e4d611b894f4f4e97ac30ac0731ed066fa0602f64562
    • Instruction ID: 6bb76d3c2453bf3c1b612fb08a50cc9b860740acdf28209d87ad7921728ace4b
    • Opcode Fuzzy Hash: c25f904b91756b564ae4e4d611b894f4f4e97ac30ac0731ed066fa0602f64562
    • Instruction Fuzzy Hash: 6362073222459186E71ACE79E8403AC7AA2E31C7C5F285526FF9FD37D4E638DA45CB00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000C4D0 Relevance: 3.0, APIs: 2, Instructions: 20COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: ExceptionHandlerVectored$Remove
    • String ID:
    • API String ID: 3670940754-0
    • Opcode ID: 0dbb201c92fdbfd16906955aa4fa060f1c021823dd79c5672f57428599eb5e74
    • Instruction ID: 54ed52b0d94e107c171475cce83a86a7777a808cb3853d4771323e3d57a36066
    • Opcode Fuzzy Hash: 0dbb201c92fdbfd16906955aa4fa060f1c021823dd79c5672f57428599eb5e74
    • Instruction Fuzzy Hash: 8AF0ED7061370485FE5BDB93B8987F472A0AB4C7C0F184029BB49076719F3C88A48348
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000BF44 Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Window$CurrentThread$EnableEnumWindows
    • String ID:
    • API String ID: 2527101397-0
    • Opcode ID: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
    • Instruction ID: 08829170a8ee5f1b49cfdf050f6537c1ef42b3a6330418e8cb94bb4851fba9f1
    • Opcode Fuzzy Hash: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
    • Instruction Fuzzy Hash: 6D3171B261064182FB62CF22F5487A977A1F75CBE9F484215FB6947AF9CB79C844CB00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000593C Relevance: 7.0, APIs: 4, Instructions: 980COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 75 14000593c-14000593e 76 140005945-140005954 75->76 76->76 77 140005956-140005979 call 1400123e0 76->77 80 14000597b-140005987 77->80 81 140005a39-140005a53 80->81 82 14000598d-140005a33 call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 80->82 84 140005a55-140005a61 81->84 82->80 82->81 86 140005b13-140005b2d 84->86 87 140005a67-140005b0d call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 84->87 90 140005b2f-140005b3b 86->90 87->84 87->86 93 140005b41-140005be7 call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 90->93 94 140005bed-140005c07 90->94 93->90 93->94 98 140005c09-140005c15 94->98 102 140005cc7-140005ce1 98->102 103 140005c1b-140005cc1 call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 98->103 108 140005ce3-140005cef 102->108 103->98 103->102 113 140005da1-140005dbb 108->113 114 140005cf5-140005d91 call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 108->114 115 140005dbd-140005dc9 113->115 237 140005d96-140005d9b 114->237 122 140005e7f-140005e99 115->122 123 140005dcf-140005e6f call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 115->123 131 140005e9b-140005ea7 122->131 244 140005e74-140005e79 123->244 139 140005f5d-140005f77 131->139 140 140005ead-140005f57 call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 131->140 149 140005f79-140005f85 139->149 140->131 140->139 158 14000603b-140006055 149->158 159 140005f8b-140006035 call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 149->159 168 140006057-140006063 158->168 159->149 159->158 177 140006119-14000657b call 1400121c0 call 140012450 * 2 call 140012210 call 1400121c0 * 2 call 1400047e2 call 140012210 call 14000c2bc GetModuleHandleW call 1400121c0 * 4 call 140010ba0 call 1400125d0 call 140007dc0 call 140012210 call 1400121c0 * 4 call 140010ba0 call 1400125d0 call 140007dc0 call 140012210 call 140004134 call 1400121c0 * 2 call 140002c46 call 140006a58 call 140001e57 call 1400067aa call 1400121c0 * 2 call 14000ca70 call 1400049ea call 140012210 PathRemoveBackslashW call 140002bab call 1400121c0 * 3 call 140003cc9 call 140012520 call 1400125d0 call 14000c45c call 140006a58 call 1400121c0 call 140012450 * 2 call 140012210 call 1400121c0 * 2 call 1400026bb call 140012210 call 140004ee2 call 1400121c0 call 140012450 call 140012210 PathQuoteSpacesW call 1400121c0 call 140012450 * 3 call 140012210 PathQuoteSpacesW 168->177 178 140006069-140006113 call 1400121c0 * 2 call 140007c90 call 140012210 call 1400121c0 call 140012450 * 2 call 140012210 168->178 377 1400065a1-1400065a6 call 140003ddc 177->377 378 14000657d-14000659f call 140007284 177->378 178->168 178->177 237->108 237->113 244->115 244->122 382 1400065ab-1400067a9 call 1400121c0 * 2 call 140012450 * 3 call 140012520 call 1400121c0 * 2 call 14000daa8 call 140012520 call 1400121c0 call 140012450 * 2 call 1400125d0 * 3 call 1400029c8 call 140006a58 call 140002930 call 140012360 * 10 377->382 378->382
    C-Code - Quality: 31%
    			E0000000114000593C(void* __edx, void* __eflags, void* __rcx, void* __r9, char _a8, intOrPtr _a12, long long _a16, long long _a20, long long _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40, intOrPtr _a44, char _a48, long long _a52, signed long long _a56, intOrPtr _a60, long long _a68, char _a72, long long _a76, long long _a84, long long _a92, long long _a100, long long _a108) {
				char _v0;
				signed int _v8;
				long long _v16;
				intOrPtr _v68;
				char _v76;
				void* _t137;
				void* _t145;
				void* _t153;
				void* _t161;
				void* _t169;
				void* _t177;
				void* _t185;
				void* _t193;
				void* _t201;
				void* _t205;
				void* _t232;
				void* _t237;
				void* _t248;
				void* _t250;
				void* _t251;
				void* _t259;
				void* _t262;
				void* _t270;
				void* _t272;
				void* _t279;
				void* _t285;
				void* _t298;
				void* _t299;
				void* _t301;
				void* _t302;
				void* _t304;
				void* _t305;
				void* _t306;
				void* _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				void* _t311;
				void* _t312;
				char* _t319;
				signed int _t320;
				char* _t324;
				signed int _t325;
				char* _t329;
				signed int _t330;
				char* _t334;
				signed int _t335;
				char* _t339;
				signed int _t340;
				char* _t344;
				signed int _t345;
				char* _t349;
				signed int _t350;
				char* _t354;
				signed int _t355;
				char* _t359;
				signed int _t360;
				signed long long _t361;
				void* _t362;
				long long _t363;
				void* _t364;
				void* _t365;
				void* _t366;
				void* _t367;
				void* _t370;
				void* _t371;
				void* _t372;
				long long _t373;
				long long _t376;
				void* _t377;
				void* _t378;
				void* _t383;
				char* _t385;
				void* _t386;
				void* _t391;
				char* _t393;
				void* _t394;
				void* _t399;
				char* _t401;
				void* _t402;
				void* _t407;
				char* _t409;
				void* _t410;
				void* _t415;
				char* _t417;
				void* _t418;
				intOrPtr _t422;
				void* _t423;
				intOrPtr _t430;
				void* _t431;
				intOrPtr _t438;
				void* _t439;
				intOrPtr _t446;
				void* _t447;
				intOrPtr _t450;
				void* _t451;
				void* _t456;
				void* _t458;
				void* _t459;
				void* _t460;
				void* _t461;
				void* _t464;
				char* _t465;
				void* _t466;
				void* _t467;
				void* _t468;
				void* _t471;
				void* _t473;
				void* _t474;
				void* _t476;
				void* _t477;
				void* _t478;
				void* _t479;
				void* _t481;
				void* _t482;
				void* _t485;
				void* _t486;
				void* _t487;
				void* _t489;
				void* _t490;
				void* _t491;
				intOrPtr _t492;
				void* _t493;
				intOrPtr _t494;
				void* _t498;
				intOrPtr _t500;
				void* _t501;
				void* _t505;
				void* _t510;
				void* _t511;
				void* _t514;
				intOrPtr _t516;
				void* _t517;
				void* _t521;
				void* _t523;
				void* _t524;
				void* _t525;
				void* _t564;
				void* _t574;
				void* _t577;
				void* _t582;
				void* _t586;
				void* _t587;
				void* _t588;
				void* _t589;
				intOrPtr* _t731;
				void* _t851;
				void* _t852;
				intOrPtr _t873;

				_t852 = __r9;
				_t377 = __rcx;
				_t300 = __edx;
				_v16 = 0;
				if (__eflags != 0) goto 0x40005945;
				E000000011400123E0(0xe);
				 *0x40020494 = 0x4001f0a6;
				_v16 = 0;
				goto 0x4000597b;
				_t304 = 0x19 - _v16;
				if (_t304 < 0) goto 0x40005a39;
				_t319 =  *0x40020494; // 0x14001f11b
				_t320 =  *_t319;
				_v8 = _t320;
				 *0x40020494 =  *0x40020494 + 1;
				E000000011400121C0(_t320);
				_t378 = _t377;
				_push(_t320);
				_push(_t378);
				E000000011400121C0(_t320);
				_push(_t320);
				_t321 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(__edx, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_push(_a8);
				_t137 = E000000011400121C0(_t321);
				_pop(_t383);
				E00000001140012450(E00000001140012450(_t137, _t321, _t383), _t321, _v0);
				_t385 =  &_a8;
				E00000001140012210(_t300, _t321, _t385, _t321);
				_v16 = _v16 + 1;
				if (_t304 >= 0) goto 0x4000597b;
				 *0x40020494 = 0x4001f10a;
				_v16 = 0;
				goto 0x40005a55;
				_t305 = 2 - _v16;
				if (_t305 < 0) goto 0x40005b13;
				_t324 =  *0x40020494; // 0x14001f11b
				_t325 =  *_t324;
				_v8 = _t325;
				 *0x40020494 =  *0x40020494 + 1;
				E000000011400121C0(_t325);
				_t386 = _t385;
				_push(_t325);
				_push(_t386);
				E000000011400121C0(_t325);
				_push(_t325);
				_t326 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(_t300, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_push(_a16);
				_t145 = E000000011400121C0(_t326);
				_pop(_t391);
				E00000001140012450(E00000001140012450(_t145, _t326, _t391), _t326, _v0);
				_t393 =  &_a16;
				E00000001140012210(_t300, _t326, _t393, _t326);
				_v16 = _v16 + 1;
				if (_t305 >= 0) goto 0x40005a55;
				 *0x40020494 = 0x4001f10f;
				_v16 = 0;
				goto 0x40005b2f;
				_t306 = 3 - _v16;
				if (_t306 < 0) goto 0x40005bed;
				_t329 =  *0x40020494; // 0x14001f11b
				_t330 =  *_t329;
				_v8 = _t330;
				 *0x40020494 =  *0x40020494 + 1;
				E000000011400121C0(_t330);
				_t394 = _t393;
				_push(_t330);
				_push(_t394);
				E000000011400121C0(_t330);
				_push(_t330);
				_t331 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(_t300, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_push(_a24);
				_t153 = E000000011400121C0(_t331);
				_pop(_t399);
				E00000001140012450(E00000001140012450(_t153, _t331, _t399), _t331, _v0);
				_t401 =  &_a24;
				E00000001140012210(_t300, _t331, _t401, _t331);
				_v16 = _v16 + 1;
				if (_t306 >= 0) goto 0x40005b2f;
				 *0x40020494 = 0x4001f10d;
				_v16 = 0;
				goto 0x40005c09;
				_t307 = 1 - _v16;
				if (_t307 < 0) goto 0x40005cc7;
				_t334 =  *0x40020494; // 0x14001f11b
				_t335 =  *_t334;
				_v8 = _t335;
				 *0x40020494 =  *0x40020494 + 1;
				E000000011400121C0(_t335);
				_t402 = _t401;
				_push(_t335);
				_push(_t402);
				E000000011400121C0(_t335);
				_push(_t335);
				_t336 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(_t300, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_push(_a32);
				_t161 = E000000011400121C0(_t336);
				_pop(_t407);
				E00000001140012450(E00000001140012450(_t161, _t336, _t407), _t336, _v0);
				_t409 =  &_a32;
				E00000001140012210(_t300, _t336, _t409, _t336);
				_v16 = _v16 + 1;
				if (_t307 >= 0) goto 0x40005c09;
				 *0x40020494 = 0x4001f0e3;
				_v16 = 0;
				goto 0x40005ce3;
				_t308 = 0xd - _v16;
				if (_t308 < 0) goto 0x40005da1;
				_t339 =  *0x40020494; // 0x14001f11b
				_t340 =  *_t339;
				_v8 = _t340;
				 *0x40020494 =  *0x40020494 + 1;
				E000000011400121C0(_t340);
				_t410 = _t409;
				_push(_t340);
				_push(_t410);
				E000000011400121C0(_t340);
				_push(_t340);
				_t341 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(_t300, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_push(_a40);
				_t169 = E000000011400121C0(_t341);
				_pop(_t415);
				E00000001140012450(E00000001140012450(_t169, _t341, _t415), _t341, _v0);
				_t417 =  &_a40;
				E00000001140012210(_t300, _t341, _t417, _t341); // executed
				_v16 = _v16 + 1;
				if (_t308 >= 0) goto 0x40005ce3;
				 *0x40020494 = 0x4001f0f1;
				_v16 = 0;
				goto 0x40005dbd;
				_t309 = 0xe - _v16;
				if (_t309 < 0) goto 0x40005e7f;
				_t344 =  *0x40020494; // 0x14001f11b
				_t345 =  *_t344;
				_v8 = _t345;
				 *0x40020494 =  *0x40020494 + 1;
				E000000011400121C0(_t345);
				_t418 = _t417;
				_push(_t345);
				_push(_t418);
				E000000011400121C0(_t345);
				_push(_t345);
				_t346 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(_t300, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_t422 =  *0x4002049c; // 0x910730
				_t177 = E000000011400121C0(_t346);
				_t423 = _t422;
				E00000001140012450(E00000001140012450(_t177, _t346, _t423), _t346, _v0);
				E00000001140012210(_t300, _t346, 0x4002049c, _t346); // executed
				_v16 = _v16 + 1;
				if (_t309 >= 0) goto 0x40005dbd;
				 *0x40020494 = 0x4001f100;
				_v16 = 0;
				goto 0x40005e9b;
				_t310 = 9 - _v16;
				if (_t310 < 0) goto 0x40005f5d;
				_t349 =  *0x40020494; // 0x14001f11b
				_t350 =  *_t349;
				_v8 = _t350;
				 *0x40020494 =  *0x40020494 + 1;
				_push(0x4002049c);
				E000000011400121C0(_t350);
				_pop(_t426);
				_push(_t350);
				E000000011400121C0(_t350);
				_push(_t350);
				_t351 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(_t300, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_t430 =  *0x4002053c; // 0x910770
				_t185 = E000000011400121C0(_t351);
				_t431 = _t430;
				E00000001140012450(E00000001140012450(_t185, _t351, _t431), _t351, _v0);
				E00000001140012210(_t300, _t351, 0x4002053c, _t351);
				_v16 = _v16 + 1;
				if (_t310 >= 0) goto 0x40005e9b;
				 *0x40020494 = 0x4001f098;
				_v16 = 0;
				goto 0x40005f79;
				_t311 = 4 - _v16;
				if (_t311 < 0) goto 0x4000603b;
				_t354 =  *0x40020494; // 0x14001f11b
				_t355 =  *_t354;
				_v8 = _t355;
				 *0x40020494 =  *0x40020494 + 1;
				_push(0x4002053c);
				E000000011400121C0(_t355);
				_pop(_t434);
				_push(_t355);
				E000000011400121C0(_t355);
				_push(_t355);
				_t356 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _v8 * 0xffffffff);
				E00000001140012210(_t300, _v8 * 0xffffffff,  &_v0, _v8 * 0xffffffff);
				_t438 =  *0x400204f4; // 0x917190
				_t193 = E000000011400121C0(_t356);
				_t439 = _t438;
				E00000001140012450(E00000001140012450(_t193, _t356, _t439), _t356, _v0);
				E00000001140012210(_t300, _t356, 0x400204f4, _t356);
				_v16 = _v16 + 1;
				if (_t311 >= 0) goto 0x40005f79;
				 *0x40020494 = 0x4001f117;
				_v16 = 0;
				goto 0x40006057;
				_t312 = 3 - _v16;
				if (_t312 < 0) goto 0x40006119;
				_t359 =  *0x40020494; // 0x14001f11b
				_t360 =  *_t359;
				_v8 = _t360;
				 *0x40020494 =  *0x40020494 + 1;
				_push(0x400204f4);
				E000000011400121C0(_t360);
				_pop(_t442);
				_push(_t360);
				E000000011400121C0(_t360);
				_push(_t360);
				_t361 = _v8 * 0xffffffff;
				E00000001140007C90(_t299, _t361);
				E00000001140012210(_t300, _t361,  &_v0, _t361);
				_t446 =  *0x400204ec; // 0x9107a0
				_t201 = E000000011400121C0(_t361);
				_t447 = _t446;
				E00000001140012450(E00000001140012450(_t201, _t361, _t447), _t361, _v0);
				E00000001140012210(_t300, _t361, 0x400204ec, _t361);
				_v16 = _v16 + 1;
				if (_t312 >= 0) goto 0x40006057;
				_t450 =  *0x400204ec; // 0x9107a0
				_t205 = E000000011400121C0(_t361);
				_t451 = _t450;
				E00000001140012450(E00000001140012450(_t205, _t361, _t451), _t361, _a24);
				E00000001140012210(_t300, _t361, 0x400204ec, _t361);
				_push(0x400204ec);
				E000000011400121C0(_t361);
				_pop(_t454);
				_push(_t361);
				E000000011400121C0(_t361);
				_push(_t361);
				_push(_a24);
				_push(_a16);
				_pop(_t456);
				_pop(_t564);
				E000000011400047E2(_t456, _t564);
				E00000001140012210(_t300, _t361,  &_a48);
				E0000000114000C2BC(_t302, _t312, _t376, _t587, _t588);
				_a56 = _t361;
				_push(0);
				_pop(_t458);
				GetModuleHandleW(??);
				 *0x400204d4 = _t361;
				E000000011400121C0(_t361);
				_t459 = _t458;
				_push(_t361);
				E000000011400121C0(_t361);
				_t460 = _t459;
				_push(_t361);
				E000000011400121C0(_t361);
				_t461 = _t460;
				_push(_t361);
				_push(_t461);
				E000000011400121C0(_t361);
				E00000001140010BA0( *0x400204bc, 1);
				_t731 = _t589 - 0xffffffffffffffb8 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x20 - 0x28 + 0x28 - 0x20 + 0x20;
				E000000011400125D0(_t361);
				_t362 = _t361;
				 *_t731 =  *_t731 + _t361;
				_t464 = _t361;
				E00000001140007DC0(_t300, _t301, _t362, _t376, _t464, _t587, _t588);
				_t465 =  &_a72;
				E00000001140012210(_t300, _t362, _t465);
				E000000011400121C0(_t362);
				_t466 = _t465;
				_push(_t362);
				E000000011400121C0(_t362);
				_t467 = _t466;
				_push(_t362);
				E000000011400121C0(_t362);
				_t468 = _t467;
				_push(_t362);
				_push(_t468);
				E000000011400121C0(_t362);
				E00000001140010BA0(_a76, 1);
				E000000011400125D0(_t362);
				_t363 = _t362;
				_v76 = _v76 + _t362;
				_t471 = _t362;
				E00000001140007DC0(_t300, _t301, _t363, _t376, _t471, _t587, _t588);
				E00000001140012210(_t300, _t363,  &_a76);
				_push(_a76);
				_pop(_t473);
				E00000001140004134(_t473);
				_a84 = _t363;
				E000000011400121C0(_t363);
				_t474 = _t473;
				_push(_t363);
				_push(_t474);
				E000000011400121C0(_t363);
				_push(_a84);
				_pop(_t476);
				_t232 = E00000001140002C46(_t476);
				_t477 = _t363;
				E00000001140006A58(_t232, _t363, _t477);
				_t364 = _t363;
				E00000001140001E57(_t312, _t477);
				_push(_a84);
				_pop(_t478);
				E000000011400067AA(_t478);
				E000000011400121C0(_t364);
				_t479 = _t478;
				_push(_t364);
				_push(_t479);
				_t237 = E000000011400121C0(_t364);
				_push(_t364);
				_push(_a20);
				_t365 = _a84 + 4;
				_t481 = _t365;
				E0000000114000CA70(_t237, _t481);
				_t482 = _t365;
				_pop(_t574);
				E000000011400049EA(_t482, _t574);
				E00000001140012210(_t300, _t365, 0x400204cc);
				0x4000709c( *0x400204cc);
				_push(_a84);
				_pop(_t485);
				E00000001140002BAB(_t485);
				E000000011400121C0(_t365);
				_t486 = _t485;
				_push(_t365);
				E000000011400121C0(_t365);
				_t487 = _t486;
				_push(_t365);
				E000000011400121C0(_t365);
				_push( *0x400204cc);
				_pop(_t489);
				E00000001140003CC9(_t489);
				E00000001140012520(_t365);
				_push(_a52);
				E000000011400125D0(_t365);
				_t366 = _t365;
				_v68 = _v68 + _t365;
				_pop(_t490);
				_t577 = _t365;
				_t248 = E0000000114000C45C(_t490, _t577);
				_t491 = _t487;
				E00000001140006A58(_t248, _t366, _t491);
				_t367 = _t366;
				_t492 =  *0x40020484; // 0x0
				_t250 = E000000011400121C0(_t367);
				_t493 = _t492;
				_t251 = E00000001140012450(_t250, _t367, _t493);
				_t494 =  *0x400204ec; // 0x9107a0
				E00000001140012450(_t251, _t367, _t494);
				E00000001140012210(_t300, _t367, 0x400204ec, _t367);
				_push(0x400204ec);
				E000000011400121C0(_t367);
				_pop(_t496);
				_push(_t367);
				E000000011400121C0(_t367);
				_push(_t367);
				_push(_a68);
				_pop(_t498);
				E000000011400026BB(_t312, _t498);
				E00000001140012210(_t300, _t367,  &_a92);
				E00000001140004EE2(_t312,  &_a92);
				_t500 =  *0x400204ac; // 0x0
				_t259 = E000000011400121C0(_t367);
				_t501 = _t500;
				E00000001140012450(_t259, _t367, _t501);
				E00000001140012210(_t300, _t367,  &_a100, _t367);
				0x40007090(_a100);
				_push(_a100);
				_t262 = E000000011400121C0(_t367);
				_pop(_t505);
				E00000001140012450(E00000001140012450(E00000001140012450(_t262, _t367, _t505), _t367, 0x4001f02e), _t367, _a92);
				E00000001140012210(_t300, _t367,  &_a92, _t367);
				0x40007090(_a92);
				_t873 =  *0x400204fc; // 0x0
				if (_t873 != 1) goto 0x400065a1;
				_push(_a76);
				_push(0x140003ddc);
				_pop(_t510);
				_pop(_t582);
				E00000001140007284(_t376, _t510, _t582, _t587, _t588);
				 *0x4002045c = 0x140003ddc;
				goto 0x400065ab;
				_push(_a76);
				_pop(_t511);
				E00000001140003DDC(_t300, _t873 - 1, _t511, _t852);
				_push(_t511);
				E000000011400121C0(0x140003ddc);
				_push(0x140003ddc);
				_push(_a44);
				_t270 = E000000011400121C0(0x140003ddc);
				_pop(_t514);
				_push(0x140003ddc);
				_t272 = E00000001140012450(E00000001140012450(_t270, 0x140003ddc, _t514), 0x140003ddc, 0x4001f02e);
				_t516 = _a92;
				E00000001140012450(_t272, 0x140003ddc, _t516);
				E00000001140012520(0x140003ddc);
				E000000011400121C0(0x140003ddc);
				_t517 = _t516;
				_push(0x140003ddc);
				E000000011400121C0(0x140003ddc);
				_push(0x140003ddc);
				E0000000114000DAA8(_t298, _t299, 0x140003ddc, _t376, _t587);
				E00000001140012520(0x140003ddc);
				_push(_a60);
				_t279 = E000000011400121C0(0x140003ddc);
				_pop(_t521);
				_push(0x140003ddc);
				E00000001140012450(E00000001140012450(_t279, 0x140003ddc, _t521), 0x140003ddc, _a28);
				_push(0x140003ddc);
				E000000011400125D0(0x140003ddc);
				_pop(_t370);
				 *((intOrPtr*)(_t731 - 0x20 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x20 - 0x28 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0xffffffffffffffe8 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0x28 + 0x28 - 0x20 + 0x20 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28)) =  *((intOrPtr*)(_t731 - 0x20 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x20 - 0x28 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0xffffffffffffffe8 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0x20 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0xffffffffffffffe0 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28 - 0x20 + 0x20 - 0x28 + 0x28 - 0x20 + 0x20 - 0x28 + 0x28 - 0x28 + 0x28 - 0x28 + 0x28)) + 0x140003ddc;
				E000000011400125D0(_t370);
				_t371 = _t370;
				_v76 = _v76 + _t370;
				E000000011400125D0(_t371);
				_t372 = _t371;
				_v68 = _v68 + _t371;
				_pop(_t523);
				_pop(_t586);
				_t851 = _t517;
				_t285 = E000000011400029C8(_t873 - 1, _t523, _t586, _t851);
				_pop(_t524);
				E00000001140006A58(_t285, _t372, _t524);
				_t373 = _t372;
				_a108 = _t373;
				_push(_a108);
				_pop(_t525);
				E00000001140002930(_t525);
				_push(0);
				E00000001140012360(_a76);
				E00000001140012360(_a92);
				E00000001140012360(_a20);
				E00000001140012360(_a28);
				E00000001140012360(_a12);
				E00000001140012360(_a36);
				E00000001140012360(_a100);
				E00000001140012360(_a60);
				E00000001140012360(_a52);
				return E00000001140012360(_a44);
			}
























































































































































    0x14000593c
    0x14000593c
    0x14000593c
    0x140005949
    0x140005954
    0x14000595a
    0x140005969
    0x140005970
    0x140005979
    0x140005982
    0x140005987
    0x14000598d
    0x140005994
    0x140005998
    0x14000599d
    0x1400059a9
    0x1400059b2
    0x1400059b3
    0x1400059b8
    0x1400059bd
    0x1400059c7
    0x1400059d1
    0x1400059db
    0x1400059ea
    0x1400059f4
    0x1400059f9
    0x140005a02
    0x140005a1a
    0x140005a23
    0x140005a29
    0x140005a2e
    0x140005a33
    0x140005a43
    0x140005a4a
    0x140005a53
    0x140005a5c
    0x140005a61
    0x140005a67
    0x140005a6e
    0x140005a72
    0x140005a77
    0x140005a83
    0x140005a8c
    0x140005a8d
    0x140005a92
    0x140005a97
    0x140005aa1
    0x140005aab
    0x140005ab5
    0x140005ac4
    0x140005ace
    0x140005ad3
    0x140005adc
    0x140005af4
    0x140005afd
    0x140005b03
    0x140005b08
    0x140005b0d
    0x140005b1d
    0x140005b24
    0x140005b2d
    0x140005b36
    0x140005b3b
    0x140005b41
    0x140005b48
    0x140005b4c
    0x140005b51
    0x140005b5d
    0x140005b66
    0x140005b67
    0x140005b6c
    0x140005b71
    0x140005b7b
    0x140005b85
    0x140005b8f
    0x140005b9e
    0x140005ba8
    0x140005bad
    0x140005bb6
    0x140005bce
    0x140005bd7
    0x140005bdd
    0x140005be2
    0x140005be7
    0x140005bf7
    0x140005bfe
    0x140005c07
    0x140005c10
    0x140005c15
    0x140005c1b
    0x140005c22
    0x140005c26
    0x140005c2b
    0x140005c37
    0x140005c40
    0x140005c41
    0x140005c46
    0x140005c4b
    0x140005c55
    0x140005c5f
    0x140005c69
    0x140005c78
    0x140005c82
    0x140005c87
    0x140005c90
    0x140005ca8
    0x140005cb1
    0x140005cb7
    0x140005cbc
    0x140005cc1
    0x140005cd1
    0x140005cd8
    0x140005ce1
    0x140005cea
    0x140005cef
    0x140005cf5
    0x140005cfc
    0x140005d00
    0x140005d05
    0x140005d11
    0x140005d1a
    0x140005d1b
    0x140005d20
    0x140005d25
    0x140005d2f
    0x140005d39
    0x140005d43
    0x140005d52
    0x140005d5c
    0x140005d61
    0x140005d6a
    0x140005d82
    0x140005d8b
    0x140005d91
    0x140005d96
    0x140005d9b
    0x140005dab
    0x140005db2
    0x140005dbb
    0x140005dc4
    0x140005dc9
    0x140005dcf
    0x140005dd6
    0x140005dda
    0x140005ddf
    0x140005deb
    0x140005df4
    0x140005df5
    0x140005dfa
    0x140005dff
    0x140005e09
    0x140005e13
    0x140005e1d
    0x140005e2c
    0x140005e31
    0x140005e3d
    0x140005e46
    0x140005e5e
    0x140005e6f
    0x140005e74
    0x140005e79
    0x140005e89
    0x140005e90
    0x140005e99
    0x140005ea2
    0x140005ea7
    0x140005ead
    0x140005eb4
    0x140005eb8
    0x140005ebd
    0x140005ec4
    0x140005ec9
    0x140005ed2
    0x140005ed3
    0x140005edd
    0x140005ee7
    0x140005ef1
    0x140005efb
    0x140005f0a
    0x140005f0f
    0x140005f1b
    0x140005f24
    0x140005f3c
    0x140005f4d
    0x140005f52
    0x140005f57
    0x140005f67
    0x140005f6e
    0x140005f77
    0x140005f80
    0x140005f85
    0x140005f8b
    0x140005f92
    0x140005f96
    0x140005f9b
    0x140005fa2
    0x140005fa7
    0x140005fb0
    0x140005fb1
    0x140005fbb
    0x140005fc5
    0x140005fcf
    0x140005fd9
    0x140005fe8
    0x140005fed
    0x140005ff9
    0x140006002
    0x14000601a
    0x14000602b
    0x140006030
    0x140006035
    0x140006045
    0x14000604c
    0x140006055
    0x14000605e
    0x140006063
    0x140006069
    0x140006070
    0x140006074
    0x140006079
    0x140006080
    0x140006085
    0x14000608e
    0x14000608f
    0x140006099
    0x1400060a3
    0x1400060ad
    0x1400060b7
    0x1400060c6
    0x1400060cb
    0x1400060d7
    0x1400060e0
    0x1400060f8
    0x140006109
    0x14000610e
    0x140006113
    0x140006119
    0x140006125
    0x14000612e
    0x140006146
    0x140006157
    0x14000615c
    0x140006161
    0x14000616a
    0x14000616b
    0x140006171
    0x14000617b
    0x14000617c
    0x140006180
    0x140006184
    0x140006185
    0x14000618a
    0x140006199
    0x14000619e
    0x1400061a3
    0x1400061a8
    0x1400061ad
    0x1400061ae
    0x1400061b3
    0x1400061bf
    0x1400061c8
    0x1400061c9
    0x1400061d3
    0x1400061dc
    0x1400061dd
    0x1400061e3
    0x1400061ec
    0x1400061ed
    0x1400061ee
    0x1400061f3
    0x140006211
    0x140006216
    0x14000621b
    0x140006223
    0x140006224
    0x140006228
    0x14000622e
    0x140006237
    0x140006240
    0x14000624a
    0x140006253
    0x140006254
    0x14000625e
    0x140006267
    0x140006268
    0x14000626e
    0x140006277
    0x140006278
    0x140006279
    0x14000627e
    0x14000629d
    0x1400062a7
    0x1400062af
    0x1400062b0
    0x1400062b4
    0x1400062ba
    0x1400062cc
    0x1400062d1
    0x1400062d5
    0x1400062d6
    0x1400062db
    0x1400062e8
    0x1400062f1
    0x1400062f2
    0x1400062f3
    0x1400062f8
    0x140006303
    0x14000630a
    0x14000630f
    0x140006318
    0x14000631e
    0x140006327
    0x140006328
    0x14000632d
    0x140006334
    0x140006335
    0x14000633f
    0x140006348
    0x140006349
    0x14000634a
    0x14000634f
    0x140006359
    0x14000635a
    0x14000636e
    0x140006372
    0x140006377
    0x140006384
    0x140006385
    0x14000638a
    0x14000639b
    0x1400063a7
    0x1400063ac
    0x1400063b3
    0x1400063b4
    0x1400063be
    0x1400063c7
    0x1400063c8
    0x1400063d2
    0x1400063db
    0x1400063dc
    0x1400063e2
    0x1400063ed
    0x1400063f3
    0x1400063f8
    0x140006401
    0x140006406
    0x14000640b
    0x140006413
    0x140006414
    0x140006419
    0x14000641a
    0x14000641f
    0x140006428
    0x14000642e
    0x140006437
    0x140006438
    0x140006444
    0x14000644d
    0x140006453
    0x14000645c
    0x140006467
    0x140006478
    0x14000647d
    0x140006482
    0x14000648b
    0x14000648c
    0x140006492
    0x14000649c
    0x14000649d
    0x1400064a4
    0x1400064a9
    0x1400064bb
    0x1400064c0
    0x1400064c5
    0x1400064d1
    0x1400064da
    0x1400064e0
    0x1400064f2
    0x1400064ff
    0x14000650c
    0x140006511
    0x14000651a
    0x14000654c
    0x14000655e
    0x14000656b
    0x140006570
    0x14000657b
    0x140006585
    0x140006590
    0x140006591
    0x140006592
    0x140006593
    0x140006598
    0x14000659f
    0x1400065a1
    0x1400065a5
    0x1400065a6
    0x1400065ab
    0x1400065b0
    0x1400065ba
    0x1400065c4
    0x1400065c9
    0x1400065d2
    0x1400065d3
    0x1400065ef
    0x1400065f8
    0x140006604
    0x14000660d
    0x140006617
    0x140006620
    0x140006621
    0x140006627
    0x140006631
    0x140006637
    0x140006640
    0x14000664d
    0x140006652
    0x14000665b
    0x14000665c
    0x140006673
    0x14000667c
    0x14000667d
    0x140006685
    0x140006686
    0x14000668b
    0x140006693
    0x140006694
    0x14000669a
    0x1400066a2
    0x1400066a3
    0x1400066a8
    0x1400066a9
    0x1400066aa
    0x1400066b0
    0x1400066b9
    0x1400066bf
    0x1400066c8
    0x1400066c9
    0x1400066d1
    0x1400066d8
    0x1400066d9
    0x1400066e1
    0x1400066ee
    0x140006703
    0x140006715
    0x140006727
    0x140006739
    0x14000674b
    0x140006760
    0x140006772
    0x140006784
    0x1400067a9

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Value$HeapPath$AllocateErrorLastQuoteSpaces$AcquireBackslashCharCreateCriticalEnvironmentFileFreeHandleLeaveLockModuleNameRemoveSectionTempThreadUpperVariablewcslen
    • String ID:
    • API String ID: 3908483694-0
    • Opcode ID: 28957f72086f8def3e7dbb772c7d74339bd3591795105a85fc13db025a3012f9
    • Instruction ID: 8b331e692c67017886d6c7239b17c9f9d27d3c51ffaf72a1bb59c68ee6c0545e
    • Opcode Fuzzy Hash: 28957f72086f8def3e7dbb772c7d74339bd3591795105a85fc13db025a3012f9
    • Instruction Fuzzy Hash: 83723BB6E25548D6EA16B7B7B8877E91220A3AD394F500411FF4C0B363EE39C5F64B10
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400126D0 Relevance: 4.6, APIs: 3, Instructions: 71memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 585 1400126d0-1400126f2 TlsGetValue 586 1400126f4-1400126fc 585->586 587 140012700-14001272b 585->587 586->587 588 140012772-14001277f 587->588 589 14001272d-140012770 RtlReAllocateHeap 587->589 590 1400127d0-140012802 588->590 591 140012781-140012789 588->591 589->590 592 140012793-1400127cd RtlReAllocateHeap 591->592 593 14001278b 591->593 592->590 593->592
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AllocateHeap$Value
    • String ID:
    • API String ID: 2497967046-0
    • Opcode ID: 988988ada6dc82bff9e9c7669f10d32680ca5bffd2b02ccc7cf7ef26e6a306a8
    • Instruction ID: 7cab8ebf5e8be7cca61280ad2f22e4d1c3948fe97e6d3aaf46f0ca18481b9e55
    • Opcode Fuzzy Hash: 988988ada6dc82bff9e9c7669f10d32680ca5bffd2b02ccc7cf7ef26e6a306a8
    • Instruction Fuzzy Hash: E7317336609B4486DB21CB5AE49035AB7A0F7CCBE8F144216EB8D47B78DF79C691CB40
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140012210 Relevance: 4.6, APIs: 3, Instructions: 51memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AllocateHeap$Value
    • String ID:
    • API String ID: 2497967046-0
    • Opcode ID: 30ed22d9c32a89c2cfd42ea85ebcc15196c91459ae3e4d92826612402d9637be
    • Instruction ID: c44eb9ef2cf98d3488e4d96c7e244cbf8e5b64558ad0ce04898d2a75112beb9a
    • Opcode Fuzzy Hash: 30ed22d9c32a89c2cfd42ea85ebcc15196c91459ae3e4d92826612402d9637be
    • Instruction Fuzzy Hash: 1521A336609B40C6DA25CB5AE89136AB7A1F7CDBD4F108126EB8D87B38DF3DC5518B00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000BE5C Relevance: 4.5, APIs: 3, Instructions: 19threadCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: ProcessWindow$CurrentForegroundThread
    • String ID:
    • API String ID: 3477312055-0
    • Opcode ID: ac8a7ad1aa8fa4fc89b11f7ee17d399c905eb083a75c1899034b88008855a7ff
    • Instruction ID: 1454032c9808d1f2b992da3862653b6a936510b4f7172b87df8db3b4ab0b3e5c
    • Opcode Fuzzy Hash: ac8a7ad1aa8fa4fc89b11f7ee17d399c905eb083a75c1899034b88008855a7ff
    • Instruction Fuzzy Hash: DCE01A32615A4086EE41DB26B8443A9A2A1FF8CBC1F885025FB5E0BA34DF3CC489C600
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000B538 Relevance: 4.5, APIs: 3, Instructions: 13COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 603 14000b538-14000b573 memset 00007FF88C9D0BD0 CoInitialize
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: 00007Initializememset
    • String ID:
    • API String ID: 4074414449-0
    • Opcode ID: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
    • Instruction ID: 449a974473b47bcf77cc2e9d1d873e7016711834fb404a36d393ff203d460c1f
    • Opcode Fuzzy Hash: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
    • Instruction Fuzzy Hash: E0E0E27263658092E785EB22E8857AEB260FB88748FC06105F38B469A5CF3DC659CF00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140001000 Relevance: 3.1, APIs: 2, Instructions: 112memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    C-Code - Quality: 20%
    			E00000001140001000(long long __rax) {
				void* _t1;
				void* _t33;
				long long _t34;
				void* _t35;
				long long _t41;
				intOrPtr _t49;
				intOrPtr _t51;
				intOrPtr _t55;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				intOrPtr _t103;

				0x40007000();
				0x40007006();
				 *0x4002044c = __rax;
				0x4000700c(); // executed
				 *0x40020444 = __rax;
				 *0x40020494 = 0x4001f090; // executed
				_t1 = E00000001140012060(0x4001f090); // executed
				E00000001140011CF4(_t1);
				E0000000114000CCAC(E0000000114000D418(E0000000114000DE20(0x4001f090, 0x1000))); // executed
				E0000000114000C980(0x4001f090); // executed
				E0000000114000C07C(); // executed
				E0000000114000B538(0x1000); // executed
				E00000001140007160();
				E00000001140010028(0x4001f090);
				E0000000114000E88C(0x4001f090);
				E000000011400120D0(0x4001f090, 0x40020464, 0x4001f032);
				0x40007012();
				 *0x400204a4 = 0x4001f090;
				_push(0x200);
				E0000000114000CCD8(_t34, 0x4001f090, _t41, 8, 0x15, _t74, _t75, 0, 0x4002059c);
				_t49 =  *0x4002056c; // 0x451b50
				E0000000114000D524(_t41, _t49);
				E0000000114000D444(_t41, 0xc, 0x4002056c, _t73, _t74, _t75, 0x4001f070);
				_t51 =  *0x4002057c; // 0x451c60
				E0000000114000D524(_t41, _t51);
				E0000000114000D444(_t41, 8, 0x4002057c, _t73, _t74, _t75, 0x4001f060);
				E00000001140011D30(0x4002055c, _t41, 0x14, 0x186a1, _t74, 0x4001f080); // executed
				 *0x4002055c = 0x4002055c;
				E000000011400120D0(0x4002055c, 0x40020504, 0x4001f03e, 0x4002055c);
				_t55 =  *0x4002058c; // 0x451cd0
				E0000000114000D524(_t41, _t55);
				E0000000114000D444(_t41, 8, 0x4002058c, _t73, _t74, _t75, 0x4001f060);
				E0000000114000C4D0(_t35, E00000001140002853, _t73);
				_push(E00000001140002853);
				E000000011400121C0(E00000001140002853);
				_pop(_t58);
				_push(E00000001140002853);
				E000000011400121C0(E00000001140002853);
				_push(E00000001140002853);
				E00000001140004211();
				_pop(_t72);
				E00000001140012210(_t34, E00000001140002853, 0x400204bc);
				E000000011400021EA(_t35, 0x400204bc);
				_t103 =  *0x400204dc; // 0x0
				if (_t103 != 1) goto 0x40001236;
				E0000000114000433F(_t34, _t103 - 1, 0x400204bc, 8);
				E0000000114000593C(_t34, _t103 - 1, 0x400204bc, 8);
				L1();
				E000000011400120A0();
				HeapDestroy(??);
				ExitProcess(??); // executed
				0x40007110();
				E0000000114000C6B0();
				E0000000114000D8F8();
				E0000000114000DE10(E00000001140002853, _t72);
				_t33 = E00000001140010FFC(); // executed
				E0000000114000C970(); // executed
				return _t33;
			}
















    0x140001018
    0x140001020
    0x140001025
    0x140001039
    0x14000103e
    0x14000104f
    0x140001056
    0x14000105b
    0x14000106a
    0x14000106f
    0x140001074
    0x140001079
    0x14000107e
    0x140001083
    0x140001088
    0x14000109e
    0x1400010ad
    0x1400010b2
    0x1400010c4
    0x1400010e1
    0x1400010ee
    0x1400010f5
    0x140001119
    0x14000111e
    0x140001125
    0x140001149
    0x140001180
    0x140001189
    0x1400011a1
    0x1400011a6
    0x1400011ad
    0x1400011d1
    0x1400011e0
    0x1400011e5
    0x1400011ea
    0x1400011f3
    0x1400011f4
    0x1400011fa
    0x140001204
    0x140001209
    0x140001219
    0x14000121a
    0x14000121f
    0x140001224
    0x14000122f
    0x140001231
    0x140001236
    0x14000123b
    0x140001240
    0x14000124c
    0x140001258
    0x140001261
    0x140001266
    0x14000126b
    0x140001270
    0x140001275
    0x14000127a
    0x140001283

    APIs
      • Part of subcall function 0000000140012060: HeapCreate.KERNEL32 ref: 000000014001206E
      • Part of subcall function 0000000140012060: TlsAlloc.KERNEL32 ref: 000000014001207B
      • Part of subcall function 000000014000C980: HeapCreate.KERNEL32 ref: 000000014000C98E
      • Part of subcall function 000000014000B538: memset.MSVCRT ref: 000000014000B547
      • Part of subcall function 000000014000B538: 00007FF88C9D0BD0.COMCTL32 ref: 000000014000B561
      • Part of subcall function 000000014000B538: CoInitialize.OLE32 ref: 000000014000B569
      • Part of subcall function 00000001400120D0: RtlAllocateHeap.NTDLL ref: 0000000140012123
      • Part of subcall function 000000014000CCD8: RtlAllocateHeap.NTDLL ref: 000000014000CD11
      • Part of subcall function 000000014000CCD8: RtlAllocateHeap.NTDLL ref: 000000014000CD42
      • Part of subcall function 000000014000CCD8: RtlAllocateHeap.NTDLL ref: 000000014000CDB2
      • Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D56E
      • Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D58F
      • Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D5A1
      • Part of subcall function 000000014000D444: RtlAllocateHeap.NTDLL ref: 000000014000D476
      • Part of subcall function 000000014000D444: RtlAllocateHeap.NTDLL ref: 000000014000D491
      • Part of subcall function 0000000140011D30: RtlAllocateHeap.NTDLL ref: 0000000140011D82
      • Part of subcall function 0000000140011D30: memset.MSVCRT ref: 0000000140011DB6
      • Part of subcall function 00000001400120D0: RtlReAllocateHeap.NTDLL ref: 0000000140012151
      • Part of subcall function 00000001400120D0: HeapFree.KERNEL32 ref: 0000000140012194
      • Part of subcall function 000000014000C4D0: RtlRemoveVectoredExceptionHandler.NTDLL ref: 000000014000C8A5
      • Part of subcall function 000000014000C4D0: RtlAddVectoredExceptionHandler.NTDLL ref: 000000014000C8C0
      • Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
      • Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
      • Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1
      • Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
      • Part of subcall function 0000000140012210: RtlAllocateHeap.NTDLL ref: 0000000140012266
    • HeapDestroy.KERNEL32 ref: 000000014000124C
    • ExitProcess.KERNEL32 ref: 0000000140001258
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Heap$Allocate$Free$CreateErrorExceptionHandlerLastValueVectoredmemset$00007AllocDestroyExitInitializeProcessRemove
    • String ID:
    • API String ID: 292962939-0
    • Opcode ID: 2bd4ac64ce37956d62c495f4d76aaa381f28d5a4dee65c1e7f61e08c1a6cf2f1
    • Instruction ID: f14933b67cb23f8d7438bd3232522d16ce9264245af44939dd0cca49c0d9e1bd
    • Opcode Fuzzy Hash: 2bd4ac64ce37956d62c495f4d76aaa381f28d5a4dee65c1e7f61e08c1a6cf2f1
    • Instruction Fuzzy Hash: 7A5108F0A11A4481FA03F7A3F8527E926159B9D7D4F808129BF1D1B3F3DD3A85598B22
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140011D30 Relevance: 3.1, APIs: 2, Instructions: 67memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 676 140011d30-140011d6c call 140011ef4 679 140011dec-140011e0b 676->679 680 140011d6e-140011d8e RtlAllocateHeap 676->680 680->679 681 140011d90-140011dc9 memset call 1400167c0 680->681 681->679 684 140011dcb-140011dce 681->684 684->679 685 140011dd0 684->685 686 140011dd2-140011dea call 140016cfc 685->686 686->679
    C-Code - Quality: 58%
    			E00000001140011D30(signed long long __rax, long long __rbx, signed long long __rcx, long long __rdx, long long __rsi, long long __r9) {
				void* _t20;
				signed long long _t31;
				void* _t47;
				long long _t50;
				long long _t52;
				void* _t56;
				long _t62;
				long _t65;
				void* _t67;
				signed long long _t68;
				void* _t70;
				long long* _t71;

				_t31 = __rax;
				 *((long long*)(_t56 + 8)) = __rbx;
				 *((long long*)(_t56 + 0x10)) = _t52;
				 *((long long*)(_t56 + 0x18)) = __rsi;
				_t71 =  *((intOrPtr*)(_t56 - 0x20 + 0x70));
				_t68 = __rcx;
				r13d = r8d;
				_t50 = __rdx;
				E00000001140011EF4(__rbx,  *_t71, __rdx, _t70);
				if (_t50 <= 0) goto 0x40011dec;
				RtlAllocateHeap(_t67, _t65, _t62); // executed
				if (_t31 == 0) goto 0x40011dec;
				 *(_t31 + 8) = _t68;
				 *((long long*)(_t31 + 0x20)) = _t50;
				 *((intOrPtr*)(_t31 + 0x28)) = r13d;
				 *((long long*)(_t31 + 0x10)) = __r9;
				 *((long long*)(_t31 + 0x18)) = _t71;
				 *_t31 = 1;
				memset(_t47, ??);
				 *_t71 = _t31 + 0x30;
				E000000011400167C0(_t31, __r9);
				if (_t31 == 0) goto 0x40011dec;
				if (_t50 <= 0) goto 0x40011dec;
				_t20 = E00000001140016CFC(_t31 + 0x30 + _t31 * _t68, __r9);
				if (1 - _t50 < 0) goto 0x40011dd2;
				return _t20;
			}















    0x140011d30
    0x140011d30
    0x140011d35
    0x140011d3a
    0x140011d4c
    0x140011d51
    0x140011d5c
    0x140011d5f
    0x140011d64
    0x140011d6c
    0x140011d82
    0x140011d8e
    0x140011d9c
    0x140011da0
    0x140011da4
    0x140011da8
    0x140011dac
    0x140011db0
    0x140011db6
    0x140011dbe
    0x140011dc1
    0x140011dc9
    0x140011dce
    0x140011ddd
    0x140011dea
    0x140011e0b

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Heap$AllocateFreememset
    • String ID:
    • API String ID: 2774703448-0
    • Opcode ID: b0a2c0981b5be639708a6f3d132545d6a9b78e5287bbc147a43e1ebb83c57dbc
    • Instruction ID: a75182db50c1f984f89b78753495ac0ab196a1c9ad642d63c8067afd0bb8a22e
    • Opcode Fuzzy Hash: b0a2c0981b5be639708a6f3d132545d6a9b78e5287bbc147a43e1ebb83c57dbc
    • Instruction Fuzzy Hash: 12213B32605B5086EA1ADB53BC4179AA6A8F7C8FD0F498025AF584BB66DE79C852C340
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140002930 Relevance: 3.0, APIs: 2, Instructions: 36COMMON
    Download Yara Rule

    Control-flow Graph

    C-Code - Quality: 41%
    			E00000001140002930(long long __rcx, long long _a8) {
				intOrPtr _v16;
				int _t11;
				void* _t12;
				void* _t21;
				void* _t22;
				void* _t23;

				_a8 = __rcx;
				_push(0);
				E000000011400123E0(0);
				_t12 = _v16 - 1;
				if (_t12 != 0) goto 0x4000296c;
				_push( *0x4002045c);
				E00000001140007170(0);
				if (_t12 == 0) goto 0x4000296c;
				_push( *0x4002045c);
				E0000000114000720C();
				_push( *0x4002050c);
				_pop(_t21);
				E0000000114000DA6C(0, _t21);
				_push( *0x400204ec);
				_pop(_t22); // executed
				E0000000114000DA6C(0, _t22); // executed
				E00000001140004907();
				_push( *0x400204ac);
				_pop(_t23);
				E0000000114000DA6C(0, _t23);
				RemoveDirectoryW( *0x40020484);
				_t11 = RemoveDirectoryW( *0x4002051c);
				 *0x40020454 = _a8;
				return _t11;
			}









    0x140002930
    0x14000293a
    0x14000293f
    0x140002949
    0x14000294d
    0x14000294f
    0x140002956
    0x14000295e
    0x140002960
    0x140002967
    0x14000296c
    0x140002972
    0x140002973
    0x140002978
    0x14000297e
    0x14000297f
    0x140002984
    0x140002989
    0x14000298f
    0x140002990
    0x14000299c
    0x1400029a8
    0x1400029b2
    0x1400029c7

    APIs
      • Part of subcall function 00000001400123E0: TlsGetValue.KERNEL32 ref: 00000001400123F8
    • RemoveDirectoryW.KERNEL32(00000000,?,0000000140003010), ref: 000000014000299C
    • RemoveDirectoryW.KERNEL32(?,0000000140003010), ref: 00000001400029A8
      • Part of subcall function 0000000140007170: WaitForSingleObject.KERNEL32 ref: 0000000140007187
      • Part of subcall function 000000014000720C: TerminateThread.KERNEL32 ref: 0000000140007223
      • Part of subcall function 000000014000720C: RtlAcquirePebLock.NTDLL ref: 0000000140007230
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: DirectoryRemove$AcquireLockObjectSingleTerminateThreadValueWait
    • String ID:
    • API String ID: 1746984992-0
    • Opcode ID: 39c47122b991e67b33ce1a45d27d1d4d4948b9f6b7a16ec8041f053e7a9c3778
    • Instruction ID: 7a41e47de86a43ff34abb2becfbad555fd020f9bfb046cc2ed969e3c0c855493
    • Opcode Fuzzy Hash: 39c47122b991e67b33ce1a45d27d1d4d4948b9f6b7a16ec8041f053e7a9c3778
    • Instruction Fuzzy Hash: 0F01FFF5509B01E5F923BB63BC02BDA6B61E74E3E0F409405BB89131B3DE3DD9849610
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000DA6C Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 712 14000da6c-14000da80 714 14000da82-14000da85 712->714 715 14000da9f 712->715 716 14000da92-14000da9d DeleteFileW 714->716 717 14000da87-14000da8c SetFileAttributesW 714->717 718 14000daa1-14000daa6 715->718 716->718 717->716
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: File$AttributesDelete
    • String ID:
    • API String ID: 2910425767-0
    • Opcode ID: 036e778028f9a2f60c1584536ec92df41b6a86006e51627c404f5c10ce335c68
    • Instruction ID: adf2a79140fabccb03c20fd21f07aa3af446659453137af282c5310bbe8ffc9f
    • Opcode Fuzzy Hash: 036e778028f9a2f60c1584536ec92df41b6a86006e51627c404f5c10ce335c68
    • Instruction Fuzzy Hash: 48E05BB471910195FB6BD7A778153F521419F8D7D1F184121AB42071B0EF3D44C55222
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140012060 Relevance: 3.0, APIs: 2, Instructions: 11memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 719 140012060-140012090 HeapCreate TlsAlloc call 140012c50
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Heap$Allocate$AllocCreateValue
    • String ID:
    • API String ID: 3361498153-0
    • Opcode ID: 1b0d72df29ce6564ac22208b59af7006679a658f7d576f5e4767aae600ecf03e
    • Instruction ID: 1c20f48a7e0d63c5f07c3edeff385a7070e23dcbb2ee76a36a736f2f2e91a8b3
    • Opcode Fuzzy Hash: 1b0d72df29ce6564ac22208b59af7006679a658f7d576f5e4767aae600ecf03e
    • Instruction Fuzzy Hash: F9D0C939A1175092E746AB72A81A3E922A0F75C3C1F901419B70947771DF7E81965A40
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400120A0 Relevance: 3.0, APIs: 2, Instructions: 7memoryCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 722 1400120a0-1400120c1 HeapDestroy TlsFree
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: DestroyFreeHeap
    • String ID:
    • API String ID: 3293292866-0
    • Opcode ID: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
    • Instruction ID: 71a10d3d5b3131d437c50284ad1bfb95f0c128dd24e11de8e9b8b88d768efc2d
    • Opcode Fuzzy Hash: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
    • Instruction Fuzzy Hash: 4CC04C34611400D2E606EB13EC953A42362B79C7C5F801414E70E1B671CE394955E700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140014B30 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
    Download Yara Rule
    C-Code - Quality: 37%
    			E00000001140014B30(long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, long long __r14, long long _a8, long long _a16, long long _a24, long long _a32) {
				intOrPtr* _t63;
				void* _t67;
				intOrPtr* _t70;
				long long* _t78;

				r9d = r8d;
				_a24 = __rbx;
				_a32 = __rsi;
				if (__rcx == 0) goto 0x40014c47;
				if ( *((long long*)(__rcx + 0x30)) == 0) goto 0x40014c47;
				_t78 =  *((intOrPtr*)(__rcx + 0x38));
				if (_t78 == 0) goto 0x40014c47;
				_t70 =  *((intOrPtr*)(__rcx + 0x28));
				if (_t70 == 0) goto 0x40014c47;
				if ( *_t70 != __rcx) goto 0x40014c47;
				if ( *((intOrPtr*)(_t70 + 8)) - 0x3f34 - 0x1f > 0) goto 0x40014c47;
				_a8 = __rbp;
				_a16 = __r14;
				r14d = 0;
				if (0xf >= 0) goto 0x40014bb4;
				goto 0x40014bc4;
				if (0xf - 0x30 >= 0) goto 0x40014bc4;
				if (0xf == 0) goto 0x40014bd0;
				_t9 = _t67 - 8; // 0x7
				if (_t9 - 7 > 0) goto 0x40014c40;
				if ( *((intOrPtr*)(_t70 + 0x40)) == 0) goto 0x40014be9;
				if ( *((intOrPtr*)(_t70 + 0x30)) == 0xf) goto 0x40014be9;
				 *_t78(_t67);
				 *((long long*)(_t70 + 0x40)) = __r14;
				 *((intOrPtr*)(_t70 + 0x10)) = 0xbadbb2;
				 *((intOrPtr*)(_t70 + 0x30)) = 0xd;
				if ( *((intOrPtr*)(__rcx + 0x30)) == __r14) goto 0x40014c40;
				if ( *((intOrPtr*)(__rcx + 0x38)) == __r14) goto 0x40014c40;
				_t63 =  *((intOrPtr*)(__rcx + 0x28));
				if (_t63 == 0) goto 0x40014c40;
				if ( *_t63 != __rcx) goto 0x40014c40;
				if ( *((intOrPtr*)(_t63 + 8)) - 0x3f34 - 0x1f > 0) goto 0x40014c40;
				 *((long long*)(_t63 + 0x34)) = __r14;
				 *((intOrPtr*)(_t63 + 0x3c)) = r14d;
				return E00000001140014C60(__rcx, _t78);
			}







    0x140014b30
    0x140014b40
    0x140014b45
    0x140014b57
    0x140014b62
    0x140014b68
    0x140014b6f
    0x140014b75
    0x140014b7c
    0x140014b85
    0x140014b96
    0x140014b9c
    0x140014ba1
    0x140014ba6
    0x140014bab
    0x140014bb2
    0x140014bbf
    0x140014bc6
    0x140014bc8
    0x140014bce
    0x140014bd7
    0x140014bdc
    0x140014be2
    0x140014be5
    0x140014be9
    0x140014bec
    0x140014bf3
    0x140014bf9
    0x140014bfb
    0x140014c02
    0x140014c07
    0x140014c14
    0x140014c16
    0x140014c1a
    0x140014c3f

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: _malloc_dbg
    • String ID:
    • API String ID: 1527718024-0
    • Opcode ID: f91dfcb78baaf3eb184097d72464d64ba9b4c956806081a3f1735ad003580fac
    • Instruction ID: f85c36bcffe19875c98b69cd213e143f3ab23699f52048757d9b3da9a79dc3da
    • Opcode Fuzzy Hash: f91dfcb78baaf3eb184097d72464d64ba9b4c956806081a3f1735ad003580fac
    • Instruction Fuzzy Hash: 9D216B72208B408ADB62CF16F48039972A8F74CBD8F691025EB494B7A5DB36C892C304
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140010FFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Free
    • String ID:
    • API String ID: 3978063606-0
    • Opcode ID: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
    • Instruction ID: 3be53cbf4efc602c07d04e61f546686734bccd281855bf9d316eb8d3f4bb89d6
    • Opcode Fuzzy Hash: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
    • Instruction Fuzzy Hash: E3D0E97091558096F66BA747EC857E422A2B7AC3C5F500419E3050B1B28ABE49DDEA15
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000C980 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: CreateHeap
    • String ID:
    • API String ID: 10892065-0
    • Opcode ID: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
    • Instruction ID: 2c080862c33f0b7fb519294060e944d109da0d65108c87cfa11e07f441f421b0
    • Opcode Fuzzy Hash: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
    • Instruction Fuzzy Hash: 40C02B34712690C2E3492323AC033991090F34C3C0FD02018F60102770CE3D80A70B00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000C6B0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: ExceptionHandlerRemoveVectored
    • String ID:
    • API String ID: 1340492425-0
    • Opcode ID: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
    • Instruction ID: 43e8ab96d0ef540813763e0684213002212cef3b8ee59004a75f8fb70944dace
    • Opcode Fuzzy Hash: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
    • Instruction Fuzzy Hash: 30C08C78B03B0085FA4AEB03B8883A422606B8C7C1F800008E60E037328E3C04A54780
    Uniqueness

    Uniqueness Score: -1.00%

    Non-executed Functions

    Function 00000001400138E5 Relevance: 12.0, Strings: 9, Instructions: 745COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 46%
    			E000000011400138E5(signed int __ebx, void* __esi, signed int __rax, signed long long __rcx, void* __rdi, long long __r8, void* __r10, void* __r13, signed char* __r14) {
				signed int _t294;
				unsigned int _t300;
				unsigned int _t306;
				signed int _t325;
				signed int _t327;
				signed int _t338;
				signed char _t344;
				signed int _t361;
				signed char _t367;
				void* _t375;
				intOrPtr _t376;
				signed char _t379;
				void* _t386;
				intOrPtr _t387;
				void* _t399;
				signed int _t400;
				void* _t401;
				signed int _t402;
				void* _t403;
				signed int _t404;
				void* _t405;
				signed int _t407;
				signed int _t408;
				void* _t409;
				signed int _t411;
				signed int _t412;
				void* _t413;
				signed int _t415;
				void* _t416;
				signed int _t417;
				signed int _t418;
				void* _t419;
				signed int _t421;
				void* _t422;
				signed int _t423;
				signed int _t425;
				signed int _t426;
				signed int _t430;
				signed char _t446;
				signed char _t448;
				signed char _t480;
				signed char _t483;
				signed char _t489;
				signed char _t513;
				signed char _t516;
				signed char _t522;
				unsigned int _t523;
				void* _t524;
				void* _t525;
				signed char _t526;
				void* _t527;
				signed int _t540;
				unsigned int _t542;
				void* _t544;
				void* _t548;
				void* _t552;
				signed char _t559;
				signed char _t561;
				void* _t564;
				void* _t565;
				void* _t567;
				void* _t568;
				void* _t569;
				void* _t570;
				void* _t571;
				intOrPtr _t572;
				intOrPtr _t573;
				void* _t574;
				void* _t575;
				void* _t576;
				void* _t577;
				void* _t578;
				void* _t579;
				void* _t580;
				void* _t582;
				void* _t600;
				void* _t613;
				long long _t677;
				signed long long _t680;
				signed long long _t681;
				signed long long _t682;
				long long _t685;
				signed long long _t688;
				signed long long _t691;
				void* _t698;
				signed long long _t700;
				signed long long _t701;
				long long _t703;
				signed long long _t704;
				signed long long _t705;
				signed long long _t706;
				signed long long _t707;
				signed long long _t708;
				void* _t710;
				signed long long _t723;
				void* _t726;
				void* _t728;
				long long _t732;
				signed long long _t733;
				long long* _t734;
				signed long long _t738;
				signed long long _t739;
				signed long long _t740;
				signed long long _t741;
				void* _t744;
				intOrPtr _t745;
				intOrPtr _t746;
				void* _t747;
				long long _t748;
				signed char* _t753;
				signed char* _t754;
				signed char* _t755;
				signed char* _t756;
				signed char* _t757;
				signed char* _t759;
				signed char* _t760;
				signed char* _t761;
				signed char* _t762;
				signed char* _t763;
				signed char* _t764;
				signed char* _t765;
				signed char* _t766;

				_t700 = __rcx;
				if (__ebx - 0xe >= 0) goto 0x40013910;
				asm("o16 nop [eax+eax]");
				if (__esi == 0) goto 0x400144ee;
				_t399 = __ebx + 8;
				_t567 = __esi - 1;
				_t753 =  &(__r14[1]);
				r15d = r15d + (( *__r14 & 0x000000ff) << __ebx);
				if (_t399 - 0xe < 0) goto 0x400138f0;
				r15d = r15d >> 5;
				_t400 = _t399 + 0xfffffff2;
				r15d = r15d >> 5;
				_t430 = (r15d & 0x0000001f) + 0x101;
				_t540 = (r15d & 0x0000001f) + 1;
				r15d = r15d >> 4;
				 *(__r13 + 0x7c) = _t430;
				 *(__r13 + 0x80) = _t540;
				 *((intOrPtr*)(__r13 + 0x78)) = (r15d & 0x0000000f) + 4;
				if (_t430 - 0x11e > 0) goto 0x40013a7b;
				if (_t540 - 0x1e > 0) goto 0x40013a7b;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f45;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) >= 0) goto 0x400139e3;
				if (_t400 - 3 >= 0) goto 0x400139a8;
				if (_t567 == 0) goto 0x400144ee;
				_t401 = _t400 + 8;
				_t568 = _t567 - 1;
				_t754 =  &(_t753[1]);
				r15d = r15d + (( *_t753 & 0x000000ff) << _t400);
				if (_t401 - 3 < 0) goto 0x40013988;
				_t402 = _t401 + 0xfffffffd;
				r15d = r15d >> 3;
				 *(__r13 + 0x90 + __rax * 2) = r15w & 7;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) < 0) goto 0x40013983;
				if ( *(__r13 + 0x84) - 0x13 >= 0) goto 0x40013a19;
				 *(__r13 + 0x90 + __rax * 2) = r12w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) - 0x13 < 0) goto 0x400139f0;
				_t677 = __r13 + 0x550;
				_t734 = __r13 + 0x88;
				 *_t734 = _t677;
				 *((long long*)(__r13 + 0x60)) = _t677;
				 *((long long*)(_t728 + 0x28)) = __r13 + 0x310;
				 *((intOrPtr*)(__r8)) = 7;
				 *((long long*)(_t728 + 0x20)) = __r8;
				_t37 = _t700 + 0x13; // 0x13
				r8d = _t37;
				_t710 = __r13 + 0x90;
				_t294 = E00000001140015DD0(0, _t565, _t582, __r13 + 0x310, _t710, __r8, _t734, __r10, _t747);
				r11d =  *(_t726 + 0x38);
				 *(_t726 + 0x30) = _t294;
				if (_t294 == 0) goto 0x40013a93;
				 *(__rdi + 0x20) = "invalid code lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t680 = "too many length or distance symbols";
				 *(__rdi + 0x20) = _t680;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f46;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) >= 0) goto 0x40013cca;
				asm("o16 nop [eax+eax]");
				_t701 = _t700 & _t680;
				_t681 =  *((intOrPtr*)(__r13 + 0x60));
				_t300 =  *(_t681 + _t701 * 4);
				 *(_t726 - 0x48) = _t300;
				if ((_t300 >> 0x00000008 & 0x000000ff) - _t402 <= 0) goto 0x40013b44;
				if (_t568 == 0) goto 0x400144ee;
				_t403 = _t402 + 8;
				_t569 = _t568 - 1;
				r15d = r15d + (( *_t754 & 0x000000ff) << _t402);
				_t755 =  &(_t754[1]);
				_t682 =  *((intOrPtr*)(__r13 + 0x60));
				_t306 =  *(_t682 + (_t701 & _t681) * 4);
				 *(_t726 - 0x48) = _t306;
				if ((_t306 >> 0x00000008 & 0x000000ff) - _t403 > 0) goto 0x40013b00;
				_t542 = _t306 >> 0x10;
				_t600 = _t542 - 0x10;
				if (_t600 >= 0) goto 0x40013b72;
				_t446 = _t306 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x90 + _t682 * 2) = _t542;
				r15d = r15d >> _t446;
				_t404 = _t403 - _t446;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				goto 0x40013caf;
				if (_t600 != 0) goto 0x40013bd4;
				_t544 = (r10d >> 0x00000008 & 0x000000ff) + 2;
				if (_t404 - _t544 >= 0) goto 0x40013ba0;
				if (_t569 == 0) goto 0x400144ee;
				_t405 = _t404 + 8;
				_t570 = _t569 - 1;
				_t756 =  &(_t755[1]);
				r15d = r15d + (( *_t755 & 0x000000ff) << _t404);
				if (_t405 - _t544 < 0) goto 0x40013b81;
				_t448 =  *(_t726 - 0x47) & 0x000000ff;
				r15d = r15d >> _t448;
				if (r10d == 0) goto 0x40013cfb;
				r15d = r15d >> 2;
				r8d =  *(__r13 + 0x90 + _t682 * 2) & 0x0000ffff;
				_t407 = _t405 - _t448 + 0xfffffffe;
				goto 0x40013c6f;
				r9d =  *(_t726 - 0x47) & 0x000000ff;
				if ( *(_t726 - 0x46) != 0x11) goto 0x40013c21;
				_t548 = _t734 + 3;
				if (_t407 - _t548 >= 0) goto 0x40013c07;
				if (_t570 == 0) goto 0x400144ee;
				_t408 = _t407 + 8;
				_t571 = _t570 - 1;
				_t757 =  &(_t756[1]);
				r15d = r15d + (( *_t756 & 0x000000ff) << _t407);
				if (_t408 - _t548 < 0) goto 0x40013be8;
				r15d = r15d >> r9d;
				r15d = r15d >> 3;
				goto 0x40013c67;
				_t552 = _t734 + 7;
				if (_t408 - _t552 >= 0) goto 0x40013c4f;
				if (_t571 == 0) goto 0x400144ee;
				_t409 = _t408 + 8;
				_t572 = _t571 - 1;
				r15d = r15d + (( *_t757 & 0x000000ff) << _t408);
				if (_t409 - _t552 < 0) goto 0x40013c30;
				r15d = r15d >> r9d;
				r15d = r15d >> 7;
				r8d = r12d;
				if (__r10 + _t710 -  *(__r13 + 0x80) +  *(__r13 + 0x7c) > 0) goto 0x40013cfb;
				_t613 = (r15d & 0x0000007f) + 0xb;
				if (_t613 == 0) goto 0x40013cab;
				asm("o16 nop [eax+eax]");
				 *(__r13 + 0x90 + _t682 * 2) = r8w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if (_t613 != 0) goto 0x40013c90;
				_t732 = __r13 + 0x70;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) < 0) goto 0x40013ad0;
				if ( *((intOrPtr*)(__r13 + 8)) == 0x3f51) goto 0x4001364c;
				if ( *((short*)(__r13 + 0x290)) != 0) goto 0x40013d13;
				 *(__rdi + 0x20) = "invalid code -- missing end-of-block";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				 *(__rdi + 0x20) = "invalid bit length repeat";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t685 = __r13 + 0x550;
				 *_t732 = 9;
				_t748 = __r13 + 0x310;
				 *((long long*)(_t728 + 0x28)) = _t748;
				 *((long long*)(_t728 + 0x20)) = _t732;
				r8d =  *(__r13 + 0x7c);
				 *((long long*)(__r13 + 0x88)) = _t685;
				 *((long long*)(__r13 + 0x60)) = _t685;
				_t325 = E00000001140015DD0(1, _t565, _t582, _t685, __r13 + 0x90, _t732, __r13 + 0x88, __r10, _t748);
				 *(_t726 + 0x30) = _t325;
				if (_t325 == 0) goto 0x40013d7c;
				 *((long long*)( *((intOrPtr*)(_t726 + 0x20)) + 0x20)) = "invalid literal/lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				_t687 =  *((intOrPtr*)(__r13 + 0x88));
				r8d =  *(__r13 + 0x80);
				_t703 = __r13 + 0x74;
				 *((long long*)(__r13 + 0x68)) =  *((intOrPtr*)(__r13 + 0x88));
				 *_t703 = 6;
				 *((long long*)(_t728 + 0x28)) = _t748;
				 *((long long*)(_t728 + 0x20)) = _t703;
				_t327 = E00000001140015DD0(2, _t565, _t582,  *((intOrPtr*)(__r13 + 0x88)), 0x90 + _t687 * 2 + __r13, _t732, __r13 + 0x88, __r10, _t748);
				r12d = _t327;
				 *(_t726 + 0x30) = _t327;
				if (_t327 == 0) goto 0x40013dd5;
				_t688 = "invalid distances set";
				goto 0x40013d67;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				if ( *((intOrPtr*)(_t726 + 0x28)) == 6) goto 0x400144f5;
				_t723 =  *((intOrPtr*)(_t726 + 0x20));
				r10d =  *(_t726 - 0x4c);
				r11d =  *(_t726 + 0x38);
				r12d = 0;
				_t733 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (_t572 - 6 < 0) goto 0x40013e73;
				if (r11d - 0x102 < 0) goto 0x40013e73;
				 *((long long*)(_t723 + 0x10)) =  *(_t726 - 0x40);
				 *(_t723 + 0x18) = r11d;
				 *_t723 =  &(_t757[1]);
				 *((intOrPtr*)(_t723 + 8)) = _t572;
				_t704 = _t723;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t409 + 0xfffffff9 - r9d;
				E00000001140016210(r10d, _t688, _t704, 0x90 + _t687 * 2 + __r13,  *(_t726 - 0x40), __r10, _t744);
				_t738 =  *((intOrPtr*)(_t723 + 0x10));
				r11d =  *(_t723 + 0x18);
				_t759 =  *_t723;
				_t573 =  *((intOrPtr*)(_t723 + 8));
				r15d =  *(__r13 + 0x48);
				_t411 =  *(__r13 + 0x4c);
				 *(_t726 - 0x40) = _t738;
				 *(_t726 + 0x38) = r11d;
				if ( *((intOrPtr*)(__r13 + 8)) != 0x3f3f) goto 0x40013650;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013650;
				_t745 =  *((intOrPtr*)(__r13 + 0x60));
				 *(__r13 + 0x1be4) = r12d;
				_t705 = _t704 & _t688;
				if (( *(_t745 + _t705 * 4) >> 0x00000008 & 0x000000ff) - _t411 <= 0) goto 0x40013ee2;
				if (_t573 == 0) goto 0x400144ee;
				_t412 = _t411 + 8;
				_t574 = _t573 - 1;
				r15d = r15d + (( *_t759 & 0x000000ff) << _t411);
				_t760 =  &(_t759[1]);
				_t706 = _t705 & _t688;
				_t338 =  *( *((intOrPtr*)(__r13 + 0x60)) + _t706 * 4);
				if ((_t338 >> 0x00000008 & 0x000000ff) - _t412 > 0) goto 0x40013ea1;
				if (_t338 == 0) goto 0x40013fb0;
				if ((_t338 & 0x000000f0) != 0) goto 0x40013fb0;
				r10d = _t338;
				 *(_t726 - 0x48) = _t338;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t338 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t338 >> 0x10);
				r11d =  *(_t726 - 0x47) & 0x000000ff;
				r8d =  *(_t745 + _t738 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t412 <= 0) goto 0x40013fa0;
				r10d =  *(_t726 - 0x46) & 0x0000ffff;
				if (_t574 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t760 & 0x000000ff) << _t412);
				r8d = r8d << (_t338 & 0x000000ff) + r9d;
				_t413 = _t412 + 8;
				r8d = r8d - 1;
				_t575 = _t574 - 1;
				_t761 =  &(_t760[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t344 =  *( *((intOrPtr*)(__r13 + 0x60)) + _t733 * 4);
				r8d = _t344 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t413 > 0) goto 0x40013f46;
				_t480 = r11b & 0xffffffff;
				r15d = r15d >> _t480;
				 *(__r13 + 0x1be4) = _t480;
				_t483 = _t344 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t483;
				r15d = r15d >> _t483;
				_t415 = _t413 - _t480 - _t483;
				 *(__r13 + 0x50) = _t344 >> 0x10;
				if (_t344 != 0) goto 0x40013fde;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4d;
				goto 0x40013648;
				if ((_t344 & 0x00000020) == 0) goto 0x40013ff2;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013640;
				if ((_t344 & 0x00000040) == 0) goto 0x4001400e;
				_t691 = "invalid literal/length code";
				 *(_t723 + 0x20) = _t691;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f49;
				 *(__r13 + 0x58) = _t344 & 0xf;
				_t559 =  *(__r13 + 0x58);
				if (_t559 == 0) goto 0x4001406d;
				if (_t415 - _t559 >= 0) goto 0x4001404f;
				if (_t575 == 0) goto 0x400144ee;
				_t416 = _t415 + 8;
				_t576 = _t575 - 1;
				_t762 =  &(_t761[1]);
				r15d = r15d + (( *_t761 & 0x000000ff) << _t415);
				if (_t416 - _t559 < 0) goto 0x40014030;
				_t489 = _t559;
				_t417 = _t416 - _t559;
				r15d = r15d >> _t489;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + ((0x00000001 << _t489) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t559;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4a;
				 *(__r13 + 0x1be8) =  *(__r13 + 0x50);
				_t746 =  *((intOrPtr*)(__r13 + 0x68));
				_t707 = _t706 & _t691;
				if (( *(_t746 + _t707 * 4) >> 0x00000008 & 0x000000ff) - _t417 <= 0) goto 0x400140f0;
				asm("o16 nop [eax+eax]");
				if (_t576 == 0) goto 0x400144ee;
				_t418 = _t417 + 8;
				_t577 = _t576 - 1;
				r15d = r15d + (( *_t762 & 0x000000ff) << _t417);
				_t763 =  &(_t762[1]);
				_t708 = _t707 & _t691;
				_t361 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t708 * 4);
				if ((_t361 >> 0x00000008 & 0x000000ff) - _t418 > 0) goto 0x400140b0;
				if ((_t361 & 0x000000f0) != 0) goto 0x400141ba;
				r10d = _t361;
				 *(_t726 - 0x48) = _t361;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t361 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t361 >> 0x10);
				r11d =  *(_t726 - 0x47) & 0x000000ff;
				r8d =  *(_t746 + _t738 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t418 <= 0) goto 0x400141aa;
				r10d =  *(_t726 - 0x46) & 0x0000ffff;
				if (_t577 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t763 & 0x000000ff) << _t418);
				r8d = r8d << (_t361 & 0x000000ff) + r9d;
				_t419 = _t418 + 8;
				r8d = r8d - 1;
				_t578 = _t577 - 1;
				_t764 =  &(_t763[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t367 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t733 * 4);
				r8d = _t367 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t419 > 0) goto 0x40014150;
				_t513 = r11b & 0xffffffff;
				r15d = r15d >> _t513;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t513;
				_t739 =  *(_t726 - 0x40);
				r11d =  *(_t726 + 0x38);
				_t516 = _t367 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t516;
				r15d = r15d >> _t516;
				_t421 = _t419 - _t513 - _t516;
				if ((_t367 & 0x00000040) == 0) goto 0x400141f2;
				 *(_t723 + 0x20) = "invalid distance code";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r10d =  *(_t726 - 0x4c);
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4b;
				 *(__r13 + 0x54) = _t367 >> 0x10;
				 *(__r13 + 0x58) = _t367 & 0xf;
				_t561 =  *(__r13 + 0x58);
				if (_t561 == 0) goto 0x4001425d;
				if (_t421 - _t561 >= 0) goto 0x4001423f;
				if (_t578 == 0) goto 0x400144ee;
				_t422 = _t421 + 8;
				_t579 = _t578 - 1;
				_t765 =  &(_t764[1]);
				r15d = r15d + (( *_t764 & 0x000000ff) << _t421);
				if (_t422 - _t561 < 0) goto 0x40014220;
				_t522 = _t561;
				_t423 = _t422 - _t561;
				r15d = r15d >> _t522;
				 *(__r13 + 0x54) =  *(__r13 + 0x54) + ((0x00000001 << _t522) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t561;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4c;
				if (r11d == 0) goto 0x400144ee;
				_t523 =  *(__r13 + 0x54);
				_t375 = r10d - r11d;
				if (_t523 - _t375 <= 0) goto 0x400142ca;
				_t524 = _t523 - _t375;
				if (_t524 -  *((intOrPtr*)(__r13 + 0x38)) <= 0) goto 0x400142a6;
				if ( *((intOrPtr*)(__r13 + 0x1be0)) == 0) goto 0x400142a6;
				 *(_t723 + 0x20) = "invalid distance too far back";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				_t376 =  *((intOrPtr*)(__r13 + 0x3c));
				if (_t524 - _t376 <= 0) goto 0x400142b8;
				_t525 = _t524 - _t376;
				goto 0x400142bc;
				_t564 = _t376 - _t525;
				if (_t525 -  *(__r13 + 0x50) <= 0) goto 0x400142d6;
				goto 0x400142d4;
				_t379 =  *(__r13 + 0x50);
				_t526 = _t379;
				_t527 =  >  ? r11d : _t526;
				r11d = r11d - _t527;
				 *(_t726 + 0x38) = r11d;
				 *(__r13 + 0x50) = _t379 - _t527;
				_t740 = _t739 + 1;
				 *((char*)(_t740 - 1)) =  *(_t739 - _t708 - _t739 + _t739) & 0x000000ff;
				if (_t526 != r11d) goto 0x400142f0;
				 *(_t726 - 0x40) = _t740;
				if ( *(__r13 + 0x50) != _t527 - 1) goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (r11d == 0) goto 0x400144ee;
				_t741 = _t740 + 1;
				r11d = r11d - 1;
				 *((char*)(_t741 - 1)) =  *(__r13 + 0x50) & 0x000000ff;
				 *(_t726 + 0x38) = r11d;
				 *(_t726 - 0x40) = _t741;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				goto 0x40013650;
				if ( *((intOrPtr*)(_t726 + 0x10)) == 0) goto 0x40014420;
				if (_t423 - 0x20 >= 0) goto 0x40014378;
				if (_t579 == 0) goto 0x400144ee;
				_t580 = _t579 - 1;
				_t766 =  &(_t765[1]);
				r15d = r15d + (( *_t765 & 0x000000ff) << _t423);
				if (_t423 + 8 - 0x20 < 0) goto 0x40014358;
				r10d = r10d - r11d;
				 *((intOrPtr*)(_t723 + 0x1c)) =  *((intOrPtr*)(_t723 + 0x1c)) + r10d;
				 *((intOrPtr*)(__r13 + 0x24)) =  *((intOrPtr*)(__r13 + 0x24)) + r10d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400143c1;
				if (r10d == 0) goto 0x400143c1;
				r8d = r10d;
				if ( *((intOrPtr*)(__r13 + 0x18)) == 0) goto 0x400143ad;
				_t386 = E00000001140015160(_t741 - "invalid distance too far back");
				goto 0x400143b2;
				_t387 = E00000001140015A00(_t386,  *((intOrPtr*)(__r13 + 0x20)), _t564, _t698, _t733);
				r11d =  *(_t726 + 0x38);
				 *((intOrPtr*)(__r13 + 0x20)) = _t387;
				 *((intOrPtr*)(_t723 + 0x4c)) = _t387;
				 *(_t726 - 0x4c) = r11d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x4001441a;
				if ( *((intOrPtr*)(__r13 + 0x18)) != 0) goto 0x400143fc;
				if (((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + (r15d >> 0x00000008 & 0x0000ff00) + (r15d >> 0x18) ==  *((intOrPtr*)(__r13 + 0x20))) goto 0x4001441a;
				 *(_t723 + 0x20) = "incorrect data check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t425 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4f;
				if ( *(__r13 + 0x10) == 0) goto 0x400144c7;
				if ( *((intOrPtr*)(__r13 + 0x18)) == 0) goto 0x400144c7;
				if (_t425 - 0x20 >= 0) goto 0x40014463;
				if (_t580 == 0) goto 0x400144ee;
				_t426 = _t425 + 8;
				r15d = r15d + (( *_t766 & 0x000000ff) << _t425);
				if (_t426 - 0x20 < 0) goto 0x40014443;
				if (r15d ==  *((intOrPtr*)(__r13 + 0x24))) goto 0x400144c1;
				 *(_t723 + 0x20) = "incorrect length check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *((long long*)(_t723 + 0x10)) =  *(_t726 - 0x40);
				 *(_t723 + 0x18) = r11d;
				 *_t723 =  &(_t766[1]);
				 *((intOrPtr*)(_t723 + 8)) = _t580 - 1;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t426;
				return 2;
			}





























































































































    0x1400138e5
    0x1400138e8
    0x1400138ea
    0x1400138f2
    0x1400138fe
    0x140013903
    0x140013905
    0x140013908
    0x14001390e
    0x140013913
    0x140013917
    0x14001391d
    0x14001392a
    0x140013933
    0x140013935
    0x14001393c
    0x140013940
    0x140013947
    0x140013951
    0x14001395a
    0x140013960
    0x140013967
    0x140013981
    0x140013986
    0x14001398a
    0x140013996
    0x14001399b
    0x14001399d
    0x1400139a0
    0x1400139a6
    0x1400139b3
    0x1400139c2
    0x1400139c6
    0x1400139cf
    0x1400139e1
    0x1400139eb
    0x1400139ff
    0x140013a08
    0x140013a17
    0x140013a19
    0x140013a20
    0x140013a29
    0x140013a2c
    0x140013a37
    0x140013a3c
    0x140013a43
    0x140013a48
    0x140013a48
    0x140013a4c
    0x140013a53
    0x140013a58
    0x140013a5c
    0x140013a61
    0x140013a6a
    0x140013a6e
    0x140013a76
    0x140013a7b
    0x140013a82
    0x140013a86
    0x140013a8e
    0x140013a93
    0x140013a9a
    0x140013aad
    0x140013abb
    0x140013ac5
    0x140013ae0
    0x140013ae3
    0x140013ae7
    0x140013aec
    0x140013af7
    0x140013b02
    0x140013b0e
    0x140013b16
    0x140013b18
    0x140013b20
    0x140013b2e
    0x140013b32
    0x140013b37
    0x140013b42
    0x140013b46
    0x140013b49
    0x140013b4d
    0x140013b52
    0x140013b58
    0x140013b61
    0x140013b64
    0x140013b66
    0x140013b6d
    0x140013b72
    0x140013b7a
    0x140013b7f
    0x140013b83
    0x140013b8f
    0x140013b94
    0x140013b96
    0x140013b99
    0x140013b9e
    0x140013ba0
    0x140013ba4
    0x140013bac
    0x140013bb9
    0x140013bbd
    0x140013bcc
    0x140013bcf
    0x140013bd9
    0x140013bde
    0x140013be0
    0x140013be6
    0x140013bea
    0x140013bf6
    0x140013bfb
    0x140013bfd
    0x140013c00
    0x140013c05
    0x140013c0f
    0x140013c1b
    0x140013c1f
    0x140013c21
    0x140013c27
    0x140013c32
    0x140013c3e
    0x140013c43
    0x140013c48
    0x140013c4d
    0x140013c57
    0x140013c63
    0x140013c6a
    0x140013c80
    0x140013c82
    0x140013c84
    0x140013c86
    0x140013c97
    0x140013ca0
    0x140013ca9
    0x140013cab
    0x140013cb6
    0x140013cc4
    0x140013cd2
    0x140013ce1
    0x140013cea
    0x140013cee
    0x140013cf6
    0x140013d02
    0x140013d06
    0x140013d0e
    0x140013d13
    0x140013d1a
    0x140013d21
    0x140013d28
    0x140013d2d
    0x140013d32
    0x140013d49
    0x140013d50
    0x140013d54
    0x140013d59
    0x140013d5e
    0x140013d6b
    0x140013d6f
    0x140013d77
    0x140013d7c
    0x140013d83
    0x140013d8a
    0x140013d8e
    0x140013d96
    0x140013da4
    0x140013da9
    0x140013dbd
    0x140013dc2
    0x140013dc5
    0x140013dca
    0x140013dcc
    0x140013dd3
    0x140013dd8
    0x140013de3
    0x140013de9
    0x140013df1
    0x140013df5
    0x140013df9
    0x140013dfc
    0x140013e00
    0x140013e0b
    0x140013e14
    0x140013e16
    0x140013e1a
    0x140013e1e
    0x140013e21
    0x140013e27
    0x140013e2a
    0x140013e2e
    0x140013e32
    0x140013e3f
    0x140013e43
    0x140013e47
    0x140013e4a
    0x140013e4d
    0x140013e51
    0x140013e55
    0x140013e59
    0x140013e5d
    0x140013e63
    0x140013e6e
    0x140013e76
    0x140013e81
    0x140013e8e
    0x140013e9f
    0x140013ea3
    0x140013eaf
    0x140013eb7
    0x140013eb9
    0x140013ec1
    0x140013ecc
    0x140013ed3
    0x140013ee0
    0x140013ee4
    0x140013eec
    0x140013ef2
    0x140013ef8
    0x140013efb
    0x140013eff
    0x140013f07
    0x140013f11
    0x140013f17
    0x140013f1a
    0x140013f1d
    0x140013f20
    0x140013f27
    0x140013f31
    0x140013f39
    0x140013f3f
    0x140013f41
    0x140013f48
    0x140013f54
    0x140013f5a
    0x140013f66
    0x140013f6d
    0x140013f73
    0x140013f76
    0x140013f79
    0x140013f7b
    0x140013f7e
    0x140013f81
    0x140013f84
    0x140013f8b
    0x140013f94
    0x140013f98
    0x140013f9e
    0x140013fa0
    0x140013fa4
    0x140013fa9
    0x140013fb5
    0x140013fb8
    0x140013fbf
    0x140013fc2
    0x140013fc9
    0x140013fcf
    0x140013fd1
    0x140013fd9
    0x140013fe0
    0x140013fe2
    0x140013fed
    0x140013ff4
    0x140013ff6
    0x140013ffd
    0x140014001
    0x140014009
    0x140014011
    0x14001401c
    0x140014020
    0x140014026
    0x14001402a
    0x140014032
    0x14001403e
    0x140014043
    0x140014045
    0x140014048
    0x14001404d
    0x14001404f
    0x140014056
    0x14001405f
    0x140014062
    0x140014066
    0x140014071
    0x14001407d
    0x140014086
    0x140014097
    0x1400140a8
    0x1400140aa
    0x1400140b2
    0x1400140be
    0x1400140c5
    0x1400140c7
    0x1400140cf
    0x1400140da
    0x1400140e1
    0x1400140ee
    0x1400140f2
    0x1400140f8
    0x1400140fe
    0x140014101
    0x140014105
    0x14001410d
    0x140014117
    0x14001411d
    0x140014120
    0x140014123
    0x140014126
    0x14001412d
    0x140014137
    0x14001413f
    0x140014145
    0x140014147
    0x140014152
    0x14001415e
    0x140014164
    0x140014170
    0x140014177
    0x14001417d
    0x140014180
    0x140014183
    0x140014185
    0x140014188
    0x14001418b
    0x14001418e
    0x140014195
    0x14001419e
    0x1400141a2
    0x1400141a8
    0x1400141aa
    0x1400141ae
    0x1400141b3
    0x1400141ba
    0x1400141be
    0x1400141c7
    0x1400141ca
    0x1400141d1
    0x1400141d4
    0x1400141d8
    0x1400141e1
    0x1400141e5
    0x1400141ed
    0x1400141f2
    0x1400141f8
    0x140014203
    0x14001420d
    0x140014211
    0x140014217
    0x14001421b
    0x140014222
    0x14001422e
    0x140014233
    0x140014235
    0x140014238
    0x14001423d
    0x14001423f
    0x140014246
    0x14001424f
    0x140014252
    0x140014256
    0x14001425d
    0x140014268
    0x14001426e
    0x140014275
    0x14001427a
    0x14001427c
    0x140014282
    0x14001428c
    0x140014295
    0x140014299
    0x1400142a1
    0x1400142a6
    0x1400142ac
    0x1400142b2
    0x1400142b6
    0x1400142ba
    0x1400142c6
    0x1400142c8
    0x1400142ca
    0x1400142d4
    0x1400142d9
    0x1400142dd
    0x1400142e5
    0x1400142e9
    0x1400142f5
    0x1400142f8
    0x1400142fe
    0x140014300
    0x140014308
    0x14001430e
    0x14001431e
    0x140014329
    0x14001432c
    0x14001432f
    0x140014333
    0x140014337
    0x14001433b
    0x140014343
    0x14001434d
    0x140014356
    0x14001435a
    0x14001436b
    0x14001436d
    0x140014370
    0x140014376
    0x140014378
    0x14001437b
    0x14001437f
    0x140014388
    0x14001438d
    0x1400143a1
    0x1400143a4
    0x1400143a6
    0x1400143ab
    0x1400143ad
    0x1400143b6
    0x1400143ba
    0x1400143be
    0x1400143c6
    0x1400143ca
    0x1400143d4
    0x140014400
    0x140014409
    0x14001440d
    0x140014415
    0x14001441a
    0x14001441d
    0x140014420
    0x14001442d
    0x140014438
    0x140014441
    0x140014445
    0x140014451
    0x14001445b
    0x140014461
    0x140014467
    0x140014470
    0x140014474
    0x14001447c
    0x140014481
    0x140014485
    0x140014489
    0x14001448c
    0x140014494
    0x140014498
    0x1400144c0

    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
    • API String ID: 0-2665694366
    • Opcode ID: 022d8aec80773364c7782894b492e5bf51f6f0f1ab81dba49e519fa5dfe17589
    • Instruction ID: 63a129330255db97eb1aabb126bfc5b4551e8f686405ea2d62c327762663274b
    • Opcode Fuzzy Hash: 022d8aec80773364c7782894b492e5bf51f6f0f1ab81dba49e519fa5dfe17589
    • Instruction Fuzzy Hash: FB620572A106A48BE799CF25D498BED3BF9F748780F518129FB468B7A0E739C845C740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140013175 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 399COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 48%
    			E00000001140013175(signed int __ebx, void* __esi, void* __rdi, void* __r10, long long __r12, void* __r13, signed char* __r14) {
				signed short _t516;
				signed short _t527;
				signed short _t528;
				signed int _t559;
				unsigned int _t565;
				unsigned int _t571;
				signed int _t590;
				signed int _t592;
				signed int _t603;
				signed char _t609;
				signed int _t626;
				signed char _t632;
				void* _t640;
				intOrPtr _t641;
				signed char _t644;
				void* _t651;
				signed short _t652;
				signed int _t665;
				signed int _t667;
				signed int _t669;
				signed int _t671;
				signed int _t673;
				signed int _t675;
				signed int _t676;
				void* _t677;
				signed int _t682;
				signed int _t683;
				signed int _t685;
				void* _t686;
				signed int _t687;
				void* _t688;
				signed int _t689;
				void* _t690;
				signed int _t691;
				void* _t692;
				signed int _t694;
				signed int _t695;
				void* _t696;
				signed int _t698;
				signed int _t699;
				void* _t700;
				signed int _t702;
				void* _t703;
				signed int _t704;
				signed int _t705;
				void* _t706;
				signed int _t708;
				void* _t709;
				signed int _t710;
				signed int _t712;
				signed int _t713;
				signed char _t743;
				signed char _t747;
				signed int _t749;
				signed int _t754;
				signed char _t770;
				signed char _t772;
				signed char _t804;
				signed char _t807;
				signed char _t813;
				signed char _t837;
				signed char _t840;
				signed char _t846;
				unsigned int _t847;
				void* _t848;
				void* _t849;
				signed char _t850;
				void* _t851;
				signed int _t868;
				unsigned int _t870;
				void* _t872;
				signed int* _t876;
				signed int* _t880;
				signed char _t887;
				signed char _t889;
				void* _t892;
				signed int _t894;
				signed int _t896;
				signed int _t898;
				signed int _t899;
				void* _t901;
				void* _t902;
				void* _t903;
				void* _t904;
				void* _t905;
				void* _t906;
				void* _t907;
				void* _t908;
				void* _t909;
				void* _t910;
				void* _t911;
				void* _t912;
				void* _t913;
				void* _t914;
				void* _t915;
				void* _t916;
				void* _t917;
				intOrPtr _t918;
				intOrPtr _t919;
				void* _t920;
				void* _t921;
				void* _t922;
				void* _t923;
				void* _t924;
				void* _t925;
				void* _t926;
				void* _t928;
				void* _t1004;
				void* _t1032;
				void* _t1045;
				intOrPtr _t1109;
				intOrPtr _t1111;
				intOrPtr _t1112;
				intOrPtr _t1113;
				intOrPtr _t1114;
				intOrPtr _t1115;
				intOrPtr _t1116;
				intOrPtr _t1117;
				signed long long _t1123;
				signed int _t1124;
				signed long long _t1127;
				signed long long _t1128;
				signed long long _t1129;
				signed int _t1132;
				signed long long _t1135;
				signed long long _t1138;
				void* _t1145;
				signed int* _t1147;
				intOrPtr _t1148;
				void* _t1149;
				intOrPtr _t1150;
				signed long long _t1151;
				signed long long _t1152;
				long long _t1154;
				signed long long _t1155;
				signed long long _t1156;
				signed long long _t1157;
				signed long long _t1158;
				signed long long _t1159;
				void* _t1163;
				intOrPtr _t1166;
				intOrPtr _t1168;
				void* _t1173;
				intOrPtr _t1185;
				intOrPtr _t1186;
				signed long long _t1188;
				void* _t1191;
				void* _t1193;
				void* _t1195;
				long long _t1196;
				long long _t1198;
				signed long long _t1199;
				intOrPtr _t1200;
				signed long long _t1203;
				signed int* _t1206;
				signed long long _t1210;
				signed long long _t1211;
				signed long long _t1212;
				signed long long _t1213;
				void* _t1215;
				void* _t1216;
				signed int _t1217;
				intOrPtr _t1218;
				long long _t1220;
				signed char* _t1225;
				signed char* _t1226;
				signed char* _t1227;
				signed char* _t1228;
				signed char* _t1229;
				signed char* _t1230;
				signed char* _t1231;
				signed char* _t1232;
				signed char* _t1233;
				signed char* _t1234;
				signed char* _t1236;
				signed char* _t1237;
				signed char* _t1238;
				signed char* _t1239;
				signed char* _t1240;
				signed char* _t1241;
				signed char* _t1243;
				signed char* _t1244;
				signed char* _t1245;
				signed char* _t1246;
				signed char* _t1247;
				signed char* _t1248;
				signed char* _t1249;
				signed char* _t1250;

				_t1215 = __r10;
				if (__ebx - 0x10 >= 0) goto 0x400131a0;
				asm("o16 nop [eax+eax]");
				if (__esi == 0) goto 0x400144e5;
				_t901 = __esi - 1;
				_t1225 =  &(__r14[1]);
				r15d = r15d + (( *__r14 & 0x000000ff) << __ebx);
				if (__ebx + 8 - 0x10 < 0) goto 0x40013180;
				 *(__r13 + 0x18) = r15d;
				if (r15b != 8) goto 0x400130c8;
				if ((r15d & 0x0000e000) == 0) goto 0x400131cf;
				 *((long long*)(__rdi + 0x20)) = "unknown header flags set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				_t1147 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1147 == 0) goto 0x400131e3;
				 *_t1147 = r15d >> 0x00000008 & 0x00000001;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013217;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013217;
				 *(_t1191 - 0x50) = r15b;
				r15d = r15d >> 8;
				 *(_t1191 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1191 - 0x50);
				r15d = r12d;
				_t665 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f36;
				if (_t665 - 0x20 >= 0) goto 0x40013250;
				if (_t901 == 0) goto 0x400144ee;
				_t902 = _t901 - 1;
				_t1226 =  &(_t1225[1]);
				r15d = r15d + (( *_t1225 & 0x000000ff) << _t665);
				if (_t665 + 8 - 0x20 < 0) goto 0x40013230;
				_t1109 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1109 == 0) goto 0x4001325d;
				 *(_t1109 + 4) = r15d;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400132a3;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400132a3;
				 *(_t1191 - 0x50) = r15b;
				r8d = 4;
				 *(_t1191 - 0x4f) = r15d >> 8;
				r15d = r15d >> 0x18;
				 *(_t1191 - 0x4d) = r15b;
				 *((char*)(_t1191 - 0x4e)) = r15d >> 0x10;
				 *(__r13 + 0x20) = E00000001140015160(_t1191 - 0x50);
				r15d = r12d;
				_t667 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f37;
				if (_t667 - 0x10 >= 0) goto 0x400132d8;
				if (_t902 == 0) goto 0x400144ee;
				_t903 = _t902 - 1;
				_t1227 =  &(_t1226[1]);
				r15d = r15d + (( *_t1226 & 0x000000ff) << _t667);
				if (_t667 + 8 - 0x10 < 0) goto 0x400132b8;
				_t1148 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1148 == 0) goto 0x400132f5;
				 *(_t1148 + 8) = r15b & 0xffffffff;
				 *( *((intOrPtr*)(__r13 + 0x28)) + 0xc) = r15d >> 8;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013329;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013329;
				 *(_t1191 - 0x50) = r15b;
				r15d = r15d >> 8;
				 *(_t1191 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1191 - 0x50);
				r15d = r12d;
				_t669 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f38;
				if (( *(__r13 + 0x18) & 0x00000400) == 0) goto 0x400133b3;
				if (_t669 - 0x10 >= 0) goto 0x40013366;
				if (_t903 == 0) goto 0x400144ee;
				_t904 = _t903 - 1;
				_t1228 =  &(_t1227[1]);
				r15d = r15d + (( *_t1227 & 0x000000ff) << _t669);
				if (_t669 + 8 - 0x10 < 0) goto 0x40013346;
				_t1111 =  *((intOrPtr*)(__r13 + 0x28));
				 *(__r13 + 0x50) = r15d;
				if (_t1111 == 0) goto 0x40013377;
				 *(_t1111 + 0x18) = r15d;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400133ab;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400133ab;
				 *(_t1191 - 0x50) = r15b;
				r15d = r15d >> 8;
				_t1163 = _t1191 - 0x50;
				 *(_t1191 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1163);
				r15d = r12d;
				_t671 = r12d;
				goto 0x400133c0;
				_t1112 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1112 == 0) goto 0x400133c0;
				 *((long long*)(_t1112 + 0x10)) = __r12;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f39;
				if (( *(__r13 + 0x18) & 0x00000400) == 0) goto 0x40013456;
				_t894 =  >  ? _t904 :  *(__r13 + 0x50);
				if (_t894 == 0) goto 0x4001344b;
				_t1113 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1113 == 0) goto 0x4001341c;
				_t1200 =  *((intOrPtr*)(_t1113 + 0x10));
				if (_t1200 == 0) goto 0x4001341c;
				if (__rdi + _t1163 -  *((intOrPtr*)(_t1113 + 0x1c)) <= 0) goto 0x4001340a;
				goto 0x4001340c;
				r8d = _t894;
				_t1149 = _t1148 + _t1200;
				memcpy(??, ??, ??);
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013440;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013440;
				r8d = _t894;
				 *(__r13 + 0x20) = E00000001140015160(_t1228);
				_t905 = _t904 - _t894;
				_t1229 =  &(_t1228[_t1113]);
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - _t894;
				if ( *(__r13 + 0x50) != 0) goto 0x400144ee;
				 *(__r13 + 0x50) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3a;
				if (( *(__r13 + 0x18) & 0x00000800) == 0) goto 0x400134ee;
				if (_t905 == 0) goto 0x400144ee;
				_t896 = r12d + 1;
				r12d =  *(_t1113 + _t1229) & 0x000000ff;
				_t1114 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1114 == 0) goto 0x400134ac;
				_t1166 =  *((intOrPtr*)(_t1114 + 0x20));
				if (_t1166 == 0) goto 0x400134ac;
				if ( *(__r13 + 0x50) -  *((intOrPtr*)(_t1114 + 0x28)) >= 0) goto 0x400134ac;
				 *((intOrPtr*)(_t1149 + _t1166)) = r12b;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + 1;
				if (r12d == 0) goto 0x400134b5;
				if (_t896 - _t905 < 0) goto 0x40013480;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400134d9;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400134d9;
				r8d = _t896;
				 *(__r13 + 0x20) = E00000001140015160(_t1229);
				_t906 = _t905 - _t896;
				_t1230 =  &(_t1229[_t1114]);
				if (r12d != 0) goto 0x400144ee;
				r12d = 0;
				goto 0x400134fb;
				_t1115 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1115 == 0) goto 0x400134fb;
				 *((long long*)(_t1115 + 0x20)) = __r12;
				 *(__r13 + 0x50) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3b;
				if (( *(__r13 + 0x18) & 0x00001000) == 0) goto 0x4001358e;
				if (_t906 == 0) goto 0x400144ee;
				_t898 = r12d + 1;
				r12d =  *(_t1115 + _t1230) & 0x000000ff;
				_t1116 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1116 == 0) goto 0x4001354c;
				_t1168 =  *((intOrPtr*)(_t1116 + 0x30));
				if (_t1168 == 0) goto 0x4001354c;
				if ( *(__r13 + 0x50) -  *((intOrPtr*)(_t1116 + 0x38)) >= 0) goto 0x4001354c;
				 *((intOrPtr*)(_t1149 + _t1168)) = r12b;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + 1;
				if (r12d == 0) goto 0x40013555;
				if (_t898 - _t906 < 0) goto 0x40013520;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013579;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013579;
				r8d = _t898;
				 *(__r13 + 0x20) = E00000001140015160(_t1230);
				_t907 = _t906 - _t898;
				_t1231 =  &(_t1230[_t1116]);
				if (r12d != 0) goto 0x400144ee;
				r12d = 0;
				goto 0x4001359b;
				_t1117 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1117 == 0) goto 0x4001359b;
				 *((long long*)(_t1117 + 0x30)) = __r12;
				_t1185 =  *((intOrPtr*)(_t1191 + 0x20));
				r11d =  *(_t1191 + 0x38);
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3c;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x4001360c;
				if (_t671 - 0x10 >= 0) goto 0x400135e0;
				if (_t907 == 0) goto 0x400144ee;
				_t908 = _t907 - 1;
				_t1232 =  &(_t1231[1]);
				r15d = r15d + (( *_t1231 & 0x000000ff) << _t671);
				if (_t671 + 8 - 0x10 < 0) goto 0x400135c0;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013606;
				if (r15d == ( *(__r13 + 0x20) & 0x0000ffff)) goto 0x40013606;
				 *(_t1185 + 0x20) = "header crc mismatch";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t673 = r12d;
				_t1150 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1150 == 0) goto 0x4001362d;
				 *(_t1150 + 0x3c) =  *(__r13 + 0x18) >> 0x00000009 & 0x00000001;
				 *( *((intOrPtr*)(__r13 + 0x28)) + 0x40) = 1;
				r8d = 0;
				_t516 = E00000001140015160(_t1230);
				 *(__r13 + 0x20) = _t516;
				 *(_t1185 + 0x4c) = _t516;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				r11d =  *(_t1191 + 0x38);
				if ( *((intOrPtr*)(__r13 + 8)) - 0x3f34 - 0x1e > 0) goto 0x40014626;
				r10d =  *(_t1191 - 0x4c);
				r12d = 0;
				if (_t673 - 0x20 >= 0) goto 0x40013693;
				if (_t908 == 0) goto 0x400144ee;
				_t909 = _t908 - 1;
				_t1233 =  &(_t1232[1]);
				r15d = r15d + (( *_t1232 & 0x000000ff) << _t673);
				if (_t673 + 8 - 0x20 < 0) goto 0x40013673;
				_t675 = r12d;
				r15d = r15d >> 0x18;
				_t527 = (r15d >> 0x00000008 & 0x0000ff00) + ((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + r15d;
				r15d = r12d;
				 *(__r13 + 0x20) = _t527;
				 *(_t1185 + 0x4c) = _t527;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3e;
				if ( *((intOrPtr*)(__r13 + 0x14)) == 0) goto 0x40014481;
				r8d = 0;
				_t528 = E00000001140015A00(_t527, 0, 0, _t1145, _t1195);
				_t1203 =  *(_t1191 - 0x40);
				r11d =  *(_t1191 + 0x38);
				 *(__r13 + 0x20) = _t528;
				 *(_t1185 + 0x4c) = _t528;
				_t1196 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				if ( *((intOrPtr*)(_t1191 + 0x28)) + 0xfffffffb - 1 <= 0) goto 0x400144ee;
				if ( *(__r13 + 0xc) == 0) goto 0x40013733;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4e;
				_t743 = _t675 & 0x00000007;
				r15d = r15d >> _t743;
				_t676 = _t675 - _t743;
				goto 0x40013650;
				if (_t676 - 3 >= 0) goto 0x40013758;
				if (_t909 == 0) goto 0x400144ee;
				_t677 = _t676 + 8;
				_t910 = _t909 - 1;
				_t1234 =  &(_t1233[1]);
				r15d = r15d + (( *_t1233 & 0x000000ff) << _t676);
				_t1004 = _t677 - 3;
				if (_t1004 < 0) goto 0x40013738;
				r15d = r15d >> 1;
				 *(__r13 + 0xc) = r15d & 0x00000001;
				if (_t1004 == 0) goto 0x400137ed;
				if (_t1004 == 0) goto 0x400137ae;
				if (_t1004 == 0) goto 0x4001379a;
				if (_t1004 != 0) goto 0x400137f5;
				r15d = r15d >> 2;
				 *(_t1185 + 0x20) = "invalid block type";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r15d >> 2;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f44;
				goto 0x40013650;
				 *_t1196 = 9;
				 *(__r13 + 0x60) = 0x40019e70;
				 *((intOrPtr*)(__r13 + 0x74)) = 5;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				 *((long long*)(__r13 + 0x68)) = 0x4001a670;
				if ( *((intOrPtr*)(_t1191 + 0x28)) != 6) goto 0x400137f5;
				r15d = r15d >> 2;
				goto 0x400144f1;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f41;
				r15d = r15d >> 2;
				_t682 = _t677 - 1 + 0x3fffffff8;
				_t747 = _t682 & 0x00000007;
				_t683 = _t682 - _t747;
				r15d = r15d >> _t747;
				if (_t683 - 0x20 >= 0) goto 0x40013830;
				if (_t910 == 0) goto 0x400144ee;
				_t911 = _t910 - 1;
				r15d = r15d + (( *_t1234 & 0x000000ff) << _t683);
				if (_t683 + 8 - 0x20 < 0) goto 0x40013810;
				_t749 = r15w & 0xffffffff;
				if (_t749 ==  !r15d >> 0x10) goto 0x40013858;
				_t1123 = "invalid stored block lengths";
				 *(_t1185 + 0x20) = _t1123;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x50) = _t749;
				r15d = r12d;
				_t685 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f42;
				if ( *((intOrPtr*)(_t1191 + 0x28)) == 6) goto 0x400144f1;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f43;
				r12d =  *(__r13 + 0x50);
				if (r12d == 0) goto 0x400138d8;
				r12d =  >  ? _t911 : r12d;
				r12d =  >  ? r11d : r12d;
				if (r12d == 0) goto 0x400144ee;
				r8d = r12d;
				_t1151 = _t1203;
				_t899 = r12d;
				memcpy(??, ??, ??);
				r11d =  *(_t1191 + 0x38);
				r11d = r11d - r12d;
				_t1236 =  &(( &(_t1234[1]))[_t1185]);
				_t1186 =  *((intOrPtr*)(_t1191 + 0x20));
				_t912 = _t911 - r12d;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - r12d;
				 *(_t1191 + 0x38) = r11d;
				 *(_t1191 - 0x40) =  *(_t1191 - 0x40) + _t1185;
				goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				if (_t685 - 0xe >= 0) goto 0x40013910;
				asm("o16 nop [eax+eax]");
				if (_t912 == 0) goto 0x400144ee;
				_t686 = _t685 + 8;
				_t913 = _t912 - 1;
				_t1237 =  &(_t1236[1]);
				r15d = r15d + (( *_t1236 & 0x000000ff) << _t685);
				if (_t686 - 0xe < 0) goto 0x400138f0;
				r15d = r15d >> 5;
				_t687 = _t686 + 0xfffffff2;
				r15d = r15d >> 5;
				_t754 = (r15d & 0x0000001f) + 0x101;
				_t868 = (r15d & 0x0000001f) + 1;
				r15d = r15d >> 4;
				 *(__r13 + 0x7c) = _t754;
				 *(__r13 + 0x80) = _t868;
				 *((intOrPtr*)(__r13 + 0x78)) = (r15d & 0x0000000f) + 4;
				if (_t754 - 0x11e > 0) goto 0x40013a7b;
				if (_t868 - 0x1e > 0) goto 0x40013a7b;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f45;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) >= 0) goto 0x400139e3;
				if (_t687 - 3 >= 0) goto 0x400139a8;
				if (_t913 == 0) goto 0x400144ee;
				_t688 = _t687 + 8;
				_t914 = _t913 - 1;
				_t1238 =  &(_t1237[1]);
				r15d = r15d + (( *_t1237 & 0x000000ff) << _t687);
				if (_t688 - 3 < 0) goto 0x40013988;
				_t689 = _t688 + 0xfffffffd;
				r15d = r15d >> 3;
				 *(__r13 + 0x90 + _t1123 * 2) = r15w & 7;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) < 0) goto 0x40013983;
				if ( *(__r13 + 0x84) - 0x13 >= 0) goto 0x40013a19;
				 *(__r13 + 0x90 + _t1123 * 2) = r12w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) - 0x13 < 0) goto 0x400139f0;
				_t1124 = __r13 + 0x550;
				_t1206 = __r13 + 0x88;
				 *_t1206 = _t1124;
				 *(__r13 + 0x60) = _t1124;
				 *((long long*)(_t1193 + 0x28)) = __r13 + 0x310;
				 *_t1196 = 7;
				 *((long long*)(_t1193 + 0x20)) = _t1196;
				_t236 = _t1151 + 0x13; // 0x13
				r8d = _t236;
				_t1173 = __r13 + 0x90;
				_t559 = E00000001140015DD0(0, _t899, _t928, __r13 + 0x310, _t1173, _t1196, _t1206, _t1215, __r12);
				r11d =  *(_t1191 + 0x38);
				 *(_t1191 + 0x30) = _t559;
				if (_t559 == 0) goto 0x40013a93;
				 *(_t1186 + 0x20) = "invalid code lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t1127 = "too many length or distance symbols";
				 *(_t1186 + 0x20) = _t1127;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f46;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) >= 0) goto 0x40013cca;
				asm("o16 nop [eax+eax]");
				_t1152 = _t1151 & _t1127;
				_t1128 =  *(__r13 + 0x60);
				_t565 =  *(_t1128 + _t1152 * 4);
				 *(_t1191 - 0x48) = _t565;
				if ((_t565 >> 0x00000008 & 0x000000ff) - _t689 <= 0) goto 0x40013b44;
				if (_t914 == 0) goto 0x400144ee;
				_t690 = _t689 + 8;
				_t915 = _t914 - 1;
				r15d = r15d + (( *_t1238 & 0x000000ff) << _t689);
				_t1239 =  &(_t1238[1]);
				_t1129 =  *(__r13 + 0x60);
				_t571 =  *(_t1129 + (_t1152 & _t1128) * 4);
				 *(_t1191 - 0x48) = _t571;
				if ((_t571 >> 0x00000008 & 0x000000ff) - _t690 > 0) goto 0x40013b00;
				_t870 = _t571 >> 0x10;
				_t1032 = _t870 - 0x10;
				if (_t1032 >= 0) goto 0x40013b72;
				_t770 = _t571 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x90 + _t1129 * 2) = _t870;
				r15d = r15d >> _t770;
				_t691 = _t690 - _t770;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				goto 0x40013caf;
				if (_t1032 != 0) goto 0x40013bd4;
				_t872 = (r10d >> 0x00000008 & 0x000000ff) + 2;
				if (_t691 - _t872 >= 0) goto 0x40013ba0;
				if (_t915 == 0) goto 0x400144ee;
				_t692 = _t691 + 8;
				_t916 = _t915 - 1;
				_t1240 =  &(_t1239[1]);
				r15d = r15d + (( *_t1239 & 0x000000ff) << _t691);
				if (_t692 - _t872 < 0) goto 0x40013b81;
				_t772 =  *(_t1191 - 0x47) & 0x000000ff;
				r15d = r15d >> _t772;
				if (r10d == 0) goto 0x40013cfb;
				r15d = r15d >> 2;
				r8d =  *(__r13 + 0x90 + _t1129 * 2) & 0x0000ffff;
				_t694 = _t692 - _t772 + 0xfffffffe;
				goto 0x40013c6f;
				r9d =  *(_t1191 - 0x47) & 0x000000ff;
				if ( *(_t1191 - 0x46) != 0x11) goto 0x40013c21;
				_t876 =  &(_t1206[0]);
				if (_t694 - _t876 >= 0) goto 0x40013c07;
				if (_t916 == 0) goto 0x400144ee;
				_t695 = _t694 + 8;
				_t917 = _t916 - 1;
				_t1241 =  &(_t1240[1]);
				r15d = r15d + (( *_t1240 & 0x000000ff) << _t694);
				if (_t695 - _t876 < 0) goto 0x40013be8;
				r15d = r15d >> r9d;
				r15d = r15d >> 3;
				goto 0x40013c67;
				_t880 =  &(_t1206[1]);
				if (_t695 - _t880 >= 0) goto 0x40013c4f;
				if (_t917 == 0) goto 0x400144ee;
				_t696 = _t695 + 8;
				_t918 = _t917 - 1;
				r15d = r15d + (( *_t1241 & 0x000000ff) << _t695);
				if (_t696 - _t880 < 0) goto 0x40013c30;
				r15d = r15d >> r9d;
				r15d = r15d >> 7;
				r8d = r12d;
				if (_t1215 + _t1173 -  *(__r13 + 0x80) +  *(__r13 + 0x7c) > 0) goto 0x40013cfb;
				_t1045 = (r15d & 0x0000007f) + 0xb;
				if (_t1045 == 0) goto 0x40013cab;
				asm("o16 nop [eax+eax]");
				 *(__r13 + 0x90 + _t1129 * 2) = r8w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if (_t1045 != 0) goto 0x40013c90;
				_t1198 = __r13 + 0x70;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) < 0) goto 0x40013ad0;
				if ( *((intOrPtr*)(__r13 + 8)) == 0x3f51) goto 0x4001364c;
				if ( *((short*)(__r13 + 0x290)) != 0) goto 0x40013d13;
				 *(_t1186 + 0x20) = "invalid code -- missing end-of-block";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				 *(_t1186 + 0x20) = "invalid bit length repeat";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t1132 = __r13 + 0x550;
				 *_t1198 = 9;
				_t1220 = __r13 + 0x310;
				 *((long long*)(_t1193 + 0x28)) = _t1220;
				 *((long long*)(_t1193 + 0x20)) = _t1198;
				r8d =  *(__r13 + 0x7c);
				 *(__r13 + 0x88) = _t1132;
				 *(__r13 + 0x60) = _t1132;
				_t590 = E00000001140015DD0(1, _t899, _t928, _t1132, __r13 + 0x90, _t1198, __r13 + 0x88, _t1215, _t1220);
				 *(_t1191 + 0x30) = _t590;
				if (_t590 == 0) goto 0x40013d7c;
				 *((long long*)( *((intOrPtr*)(_t1191 + 0x20)) + 0x20)) = "invalid literal/lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				r8d =  *(__r13 + 0x80);
				_t1154 = __r13 + 0x74;
				 *((long long*)(__r13 + 0x68)) =  *(__r13 + 0x88);
				 *_t1154 = 6;
				 *((long long*)(_t1193 + 0x28)) = _t1220;
				 *((long long*)(_t1193 + 0x20)) = _t1154;
				_t592 = E00000001140015DD0(2, _t899, _t928,  *(__r13 + 0x88), 0x90 +  *(__r13 + 0x88) * 2 + __r13, _t1198, __r13 + 0x88, _t1215, _t1220);
				r12d = _t592;
				 *(_t1191 + 0x30) = _t592;
				if (_t592 == 0) goto 0x40013dd5;
				_t1135 = "invalid distances set";
				goto 0x40013d67;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				if ( *((intOrPtr*)(_t1191 + 0x28)) == 6) goto 0x400144f5;
				_t1188 =  *((intOrPtr*)(_t1191 + 0x20));
				r10d =  *(_t1191 - 0x4c);
				r11d =  *(_t1191 + 0x38);
				r12d = 0;
				_t1199 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (_t918 - 6 < 0) goto 0x40013e73;
				if (r11d - 0x102 < 0) goto 0x40013e73;
				 *((long long*)(_t1188 + 0x10)) =  *(_t1191 - 0x40);
				 *(_t1188 + 0x18) = r11d;
				 *_t1188 =  &(_t1241[1]);
				 *((intOrPtr*)(_t1188 + 8)) = _t918;
				_t1155 = _t1188;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t696 + 0xfffffff9 - r9d;
				E00000001140016210(r10d, _t1135, _t1155, 0x90 +  *(__r13 + 0x88) * 2 + __r13,  *(_t1191 - 0x40), _t1215, _t1216);
				_t1210 =  *((intOrPtr*)(_t1188 + 0x10));
				r11d =  *(_t1188 + 0x18);
				_t1243 =  *_t1188;
				_t919 =  *((intOrPtr*)(_t1188 + 8));
				r15d =  *(__r13 + 0x48);
				_t698 =  *(__r13 + 0x4c);
				 *(_t1191 - 0x40) = _t1210;
				 *(_t1191 + 0x38) = r11d;
				if ( *((intOrPtr*)(__r13 + 8)) != 0x3f3f) goto 0x40013650;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013650;
				_t1217 =  *(__r13 + 0x60);
				 *(__r13 + 0x1be4) = r12d;
				_t1156 = _t1155 & _t1135;
				if (( *(_t1217 + _t1156 * 4) >> 0x00000008 & 0x000000ff) - _t698 <= 0) goto 0x40013ee2;
				if (_t919 == 0) goto 0x400144ee;
				_t699 = _t698 + 8;
				_t920 = _t919 - 1;
				r15d = r15d + (( *_t1243 & 0x000000ff) << _t698);
				_t1244 =  &(_t1243[1]);
				_t1157 = _t1156 & _t1135;
				_t603 =  *( *(__r13 + 0x60) + _t1157 * 4);
				if ((_t603 >> 0x00000008 & 0x000000ff) - _t699 > 0) goto 0x40013ea1;
				if (_t603 == 0) goto 0x40013fb0;
				if ((_t603 & 0x000000f0) != 0) goto 0x40013fb0;
				r10d = _t603;
				 *(_t1191 - 0x48) = _t603;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t603 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t603 >> 0x10);
				r11d =  *(_t1191 - 0x47) & 0x000000ff;
				r8d =  *(_t1217 + _t1210 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t699 <= 0) goto 0x40013fa0;
				r10d =  *(_t1191 - 0x46) & 0x0000ffff;
				if (_t920 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t1244 & 0x000000ff) << _t699);
				r8d = r8d << (_t603 & 0x000000ff) + r9d;
				_t700 = _t699 + 8;
				r8d = r8d - 1;
				_t921 = _t920 - 1;
				_t1245 =  &(_t1244[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t609 =  *( *(__r13 + 0x60) + _t1199 * 4);
				r8d = _t609 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t700 > 0) goto 0x40013f46;
				_t804 = r11b & 0xffffffff;
				r15d = r15d >> _t804;
				 *(__r13 + 0x1be4) = _t804;
				_t807 = _t609 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t807;
				r15d = r15d >> _t807;
				_t702 = _t700 - _t804 - _t807;
				 *(__r13 + 0x50) = _t609 >> 0x10;
				if (_t609 != 0) goto 0x40013fde;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4d;
				goto 0x40013648;
				if ((_t609 & 0x00000020) == 0) goto 0x40013ff2;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013640;
				if ((_t609 & 0x00000040) == 0) goto 0x4001400e;
				_t1138 = "invalid literal/length code";
				 *(_t1188 + 0x20) = _t1138;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f49;
				 *(__r13 + 0x58) = _t609 & 0xf;
				_t887 =  *(__r13 + 0x58);
				if (_t887 == 0) goto 0x4001406d;
				if (_t702 - _t887 >= 0) goto 0x4001404f;
				if (_t921 == 0) goto 0x400144ee;
				_t703 = _t702 + 8;
				_t922 = _t921 - 1;
				_t1246 =  &(_t1245[1]);
				r15d = r15d + (( *_t1245 & 0x000000ff) << _t702);
				if (_t703 - _t887 < 0) goto 0x40014030;
				_t813 = _t887;
				_t704 = _t703 - _t887;
				r15d = r15d >> _t813;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + ((0x00000001 << _t813) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t887;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4a;
				 *(__r13 + 0x1be8) =  *(__r13 + 0x50);
				_t1218 =  *((intOrPtr*)(__r13 + 0x68));
				_t1158 = _t1157 & _t1138;
				if (( *(_t1218 + _t1158 * 4) >> 0x00000008 & 0x000000ff) - _t704 <= 0) goto 0x400140f0;
				asm("o16 nop [eax+eax]");
				if (_t922 == 0) goto 0x400144ee;
				_t705 = _t704 + 8;
				_t923 = _t922 - 1;
				r15d = r15d + (( *_t1246 & 0x000000ff) << _t704);
				_t1247 =  &(_t1246[1]);
				_t1159 = _t1158 & _t1138;
				_t626 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t1159 * 4);
				if ((_t626 >> 0x00000008 & 0x000000ff) - _t705 > 0) goto 0x400140b0;
				if ((_t626 & 0x000000f0) != 0) goto 0x400141ba;
				r10d = _t626;
				 *(_t1191 - 0x48) = _t626;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t626 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t626 >> 0x10);
				r11d =  *(_t1191 - 0x47) & 0x000000ff;
				r8d =  *(_t1218 + _t1210 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t705 <= 0) goto 0x400141aa;
				r10d =  *(_t1191 - 0x46) & 0x0000ffff;
				if (_t923 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t1247 & 0x000000ff) << _t705);
				r8d = r8d << (_t626 & 0x000000ff) + r9d;
				_t706 = _t705 + 8;
				r8d = r8d - 1;
				_t924 = _t923 - 1;
				_t1248 =  &(_t1247[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t632 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t1199 * 4);
				r8d = _t632 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t706 > 0) goto 0x40014150;
				_t837 = r11b & 0xffffffff;
				r15d = r15d >> _t837;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t837;
				_t1211 =  *(_t1191 - 0x40);
				r11d =  *(_t1191 + 0x38);
				_t840 = _t632 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t840;
				r15d = r15d >> _t840;
				_t708 = _t706 - _t837 - _t840;
				if ((_t632 & 0x00000040) == 0) goto 0x400141f2;
				 *(_t1188 + 0x20) = "invalid distance code";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r10d =  *(_t1191 - 0x4c);
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4b;
				 *(__r13 + 0x54) = _t632 >> 0x10;
				 *(__r13 + 0x58) = _t632 & 0xf;
				_t889 =  *(__r13 + 0x58);
				if (_t889 == 0) goto 0x4001425d;
				if (_t708 - _t889 >= 0) goto 0x4001423f;
				if (_t924 == 0) goto 0x400144ee;
				_t709 = _t708 + 8;
				_t925 = _t924 - 1;
				_t1249 =  &(_t1248[1]);
				r15d = r15d + (( *_t1248 & 0x000000ff) << _t708);
				if (_t709 - _t889 < 0) goto 0x40014220;
				_t846 = _t889;
				_t710 = _t709 - _t889;
				r15d = r15d >> _t846;
				 *(__r13 + 0x54) =  *(__r13 + 0x54) + ((0x00000001 << _t846) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t889;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4c;
				if (r11d == 0) goto 0x400144ee;
				_t847 =  *(__r13 + 0x54);
				_t640 = r10d - r11d;
				if (_t847 - _t640 <= 0) goto 0x400142ca;
				_t848 = _t847 - _t640;
				if (_t848 -  *((intOrPtr*)(__r13 + 0x38)) <= 0) goto 0x400142a6;
				if ( *((intOrPtr*)(__r13 + 0x1be0)) == 0) goto 0x400142a6;
				 *(_t1188 + 0x20) = "invalid distance too far back";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				_t641 =  *((intOrPtr*)(__r13 + 0x3c));
				if (_t848 - _t641 <= 0) goto 0x400142b8;
				_t849 = _t848 - _t641;
				goto 0x400142bc;
				_t892 = _t641 - _t849;
				if (_t849 -  *(__r13 + 0x50) <= 0) goto 0x400142d6;
				goto 0x400142d4;
				_t644 =  *(__r13 + 0x50);
				_t850 = _t644;
				_t851 =  >  ? r11d : _t850;
				r11d = r11d - _t851;
				 *(_t1191 + 0x38) = r11d;
				 *(__r13 + 0x50) = _t644 - _t851;
				_t1212 = _t1211 + 1;
				 *((char*)(_t1212 - 1)) =  *(_t1211 - _t1159 - _t1211 + _t1211) & 0x000000ff;
				if (_t850 != r11d) goto 0x400142f0;
				 *(_t1191 - 0x40) = _t1212;
				if ( *(__r13 + 0x50) != _t851 - 1) goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (r11d == 0) goto 0x400144ee;
				_t1213 = _t1212 + 1;
				r11d = r11d - 1;
				 *((char*)(_t1213 - 1)) =  *(__r13 + 0x50) & 0x000000ff;
				 *(_t1191 + 0x38) = r11d;
				 *(_t1191 - 0x40) = _t1213;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				goto 0x40013650;
				if ( *((intOrPtr*)(_t1191 + 0x10)) == 0) goto 0x40014420;
				if (_t710 - 0x20 >= 0) goto 0x40014378;
				if (_t925 == 0) goto 0x400144ee;
				_t926 = _t925 - 1;
				_t1250 =  &(_t1249[1]);
				r15d = r15d + (( *_t1249 & 0x000000ff) << _t710);
				if (_t710 + 8 - 0x20 < 0) goto 0x40014358;
				r10d = r10d - r11d;
				 *((intOrPtr*)(_t1188 + 0x1c)) =  *((intOrPtr*)(_t1188 + 0x1c)) + r10d;
				 *((intOrPtr*)(__r13 + 0x24)) =  *((intOrPtr*)(__r13 + 0x24)) + r10d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400143c1;
				if (r10d == 0) goto 0x400143c1;
				r8d = r10d;
				if ( *(__r13 + 0x18) == 0) goto 0x400143ad;
				_t651 = E00000001140015160(_t1213 - "invalid distance too far back");
				goto 0x400143b2;
				_t652 = E00000001140015A00(_t651,  *(__r13 + 0x20), _t892, _t1145, _t1199);
				r11d =  *(_t1191 + 0x38);
				 *(__r13 + 0x20) = _t652;
				 *(_t1188 + 0x4c) = _t652;
				 *(_t1191 - 0x4c) = r11d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x4001441a;
				if ( *(__r13 + 0x18) != 0) goto 0x400143fc;
				if (((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + (r15d >> 0x00000008 & 0x0000ff00) + (r15d >> 0x18) ==  *(__r13 + 0x20)) goto 0x4001441a;
				 *(_t1188 + 0x20) = "incorrect data check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t712 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4f;
				if ( *(__r13 + 0x10) == 0) goto 0x400144c7;
				if ( *(__r13 + 0x18) == 0) goto 0x400144c7;
				if (_t712 - 0x20 >= 0) goto 0x40014463;
				if (_t926 == 0) goto 0x400144ee;
				_t713 = _t712 + 8;
				r15d = r15d + (( *_t1250 & 0x000000ff) << _t712);
				if (_t713 - 0x20 < 0) goto 0x40014443;
				if (r15d ==  *((intOrPtr*)(__r13 + 0x24))) goto 0x400144c1;
				 *(_t1188 + 0x20) = "incorrect length check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *((long long*)(_t1188 + 0x10)) =  *(_t1191 - 0x40);
				 *(_t1188 + 0x18) = r11d;
				 *_t1188 =  &(_t1250[1]);
				 *((intOrPtr*)(_t1188 + 8)) = _t926 - 1;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t713;
				return 2;
			}































































































































































































    0x140013175
    0x140013178
    0x14001317a
    0x140013182
    0x140013193
    0x140013195
    0x140013198
    0x14001319e
    0x1400131a0
    0x1400131a8
    0x1400131b5
    0x1400131be
    0x1400131c2
    0x1400131ca
    0x1400131cf
    0x1400131d6
    0x1400131e1
    0x1400131eb
    0x1400131f2
    0x1400131f4
    0x1400131f8
    0x140013200
    0x140013208
    0x140013213
    0x140013217
    0x14001321a
    0x14001321d
    0x14001322a
    0x140013232
    0x140013243
    0x140013245
    0x140013248
    0x14001324e
    0x140013250
    0x140013257
    0x140013259
    0x140013265
    0x14001326c
    0x140013271
    0x14001327c
    0x140013282
    0x140013288
    0x14001328f
    0x140013293
    0x14001329f
    0x1400132a3
    0x1400132a6
    0x1400132a9
    0x1400132b6
    0x1400132ba
    0x1400132cb
    0x1400132cd
    0x1400132d0
    0x1400132d6
    0x1400132d8
    0x1400132df
    0x1400132e5
    0x1400132f2
    0x1400132fd
    0x140013304
    0x140013306
    0x14001330a
    0x140013312
    0x14001331a
    0x140013325
    0x140013329
    0x14001332c
    0x14001332f
    0x14001333f
    0x140013344
    0x140013348
    0x140013359
    0x14001335b
    0x14001335e
    0x140013364
    0x140013366
    0x14001336a
    0x140013371
    0x140013373
    0x14001337f
    0x140013386
    0x140013388
    0x14001338c
    0x140013390
    0x140013394
    0x14001339c
    0x1400133a7
    0x1400133ab
    0x1400133ae
    0x1400133b1
    0x1400133b3
    0x1400133ba
    0x1400133bc
    0x1400133c0
    0x1400133d0
    0x1400133de
    0x1400133e3
    0x1400133e5
    0x1400133ec
    0x1400133ee
    0x1400133f5
    0x140013404
    0x140013408
    0x14001340c
    0x140013414
    0x140013417
    0x140013424
    0x14001342b
    0x140013431
    0x14001343c
    0x140013442
    0x140013444
    0x140013447
    0x140013450
    0x140013456
    0x14001345a
    0x14001346a
    0x140013472
    0x140013482
    0x140013484
    0x140013489
    0x140013490
    0x140013492
    0x140013499
    0x1400134a2
    0x1400134a4
    0x1400134a8
    0x1400134af
    0x1400134b3
    0x1400134bd
    0x1400134c4
    0x1400134ca
    0x1400134d5
    0x1400134db
    0x1400134dd
    0x1400134e3
    0x1400134e9
    0x1400134ec
    0x1400134ee
    0x1400134f5
    0x1400134f7
    0x1400134fb
    0x1400134ff
    0x14001350f
    0x140013513
    0x140013522
    0x140013524
    0x140013529
    0x140013530
    0x140013532
    0x140013539
    0x140013542
    0x140013544
    0x140013548
    0x14001354f
    0x140013553
    0x14001355d
    0x140013564
    0x14001356a
    0x140013575
    0x14001357b
    0x14001357d
    0x140013583
    0x140013589
    0x14001358c
    0x14001358e
    0x140013595
    0x140013597
    0x14001359b
    0x1400135a3
    0x1400135a7
    0x1400135b7
    0x1400135bc
    0x1400135c2
    0x1400135d3
    0x1400135d5
    0x1400135d8
    0x1400135de
    0x1400135e5
    0x1400135ef
    0x1400135f8
    0x1400135fc
    0x140013604
    0x140013606
    0x140013609
    0x14001360c
    0x140013613
    0x14001361f
    0x140013626
    0x14001362d
    0x140013634
    0x140013639
    0x14001363d
    0x140013640
    0x140013648
    0x14001365c
    0x140013662
    0x140013666
    0x140013671
    0x140013675
    0x140013686
    0x140013688
    0x14001368b
    0x140013691
    0x140013699
    0x1400136aa
    0x1400136bb
    0x1400136be
    0x1400136c1
    0x1400136c5
    0x1400136c8
    0x1400136d5
    0x1400136db
    0x1400136e2
    0x1400136e7
    0x1400136eb
    0x1400136ef
    0x1400136f3
    0x1400136f6
    0x1400136fa
    0x14001370f
    0x14001371a
    0x14001371e
    0x140013726
    0x140013729
    0x14001372c
    0x14001372e
    0x140013736
    0x14001373a
    0x140013746
    0x14001374b
    0x14001374d
    0x140013750
    0x140013753
    0x140013756
    0x14001375b
    0x140013763
    0x14001376d
    0x140013771
    0x140013775
    0x140013779
    0x140013782
    0x140013789
    0x14001378d
    0x140013795
    0x14001379a
    0x14001379e
    0x1400137a9
    0x1400137b8
    0x1400137bf
    0x1400137ca
    0x1400137d0
    0x1400137d8
    0x1400137df
    0x1400137e1
    0x1400137e8
    0x1400137ed
    0x1400137f5
    0x1400137f9
    0x140013803
    0x140013806
    0x140013808
    0x14001380e
    0x140013812
    0x140013823
    0x140013828
    0x14001382e
    0x140013833
    0x14001383e
    0x140013840
    0x140013847
    0x14001384b
    0x140013853
    0x140013858
    0x14001385f
    0x140013862
    0x140013865
    0x140013870
    0x140013876
    0x14001387e
    0x140013885
    0x14001388a
    0x140013891
    0x140013898
    0x14001389e
    0x1400138a4
    0x1400138a7
    0x1400138aa
    0x1400138af
    0x1400138b7
    0x1400138ba
    0x1400138c0
    0x1400138c4
    0x1400138c7
    0x1400138cb
    0x1400138cf
    0x1400138d3
    0x1400138d8
    0x1400138e8
    0x1400138ea
    0x1400138f2
    0x1400138fe
    0x140013903
    0x140013905
    0x140013908
    0x14001390e
    0x140013913
    0x140013917
    0x14001391d
    0x14001392a
    0x140013933
    0x140013935
    0x14001393c
    0x140013940
    0x140013947
    0x140013951
    0x14001395a
    0x140013960
    0x140013967
    0x140013981
    0x140013986
    0x14001398a
    0x140013996
    0x14001399b
    0x14001399d
    0x1400139a0
    0x1400139a6
    0x1400139b3
    0x1400139c2
    0x1400139c6
    0x1400139cf
    0x1400139e1
    0x1400139eb
    0x1400139ff
    0x140013a08
    0x140013a17
    0x140013a19
    0x140013a20
    0x140013a29
    0x140013a2c
    0x140013a37
    0x140013a3c
    0x140013a43
    0x140013a48
    0x140013a48
    0x140013a4c
    0x140013a53
    0x140013a58
    0x140013a5c
    0x140013a61
    0x140013a6a
    0x140013a6e
    0x140013a76
    0x140013a7b
    0x140013a82
    0x140013a86
    0x140013a8e
    0x140013a93
    0x140013a9a
    0x140013aad
    0x140013abb
    0x140013ac5
    0x140013ae0
    0x140013ae3
    0x140013ae7
    0x140013aec
    0x140013af7
    0x140013b02
    0x140013b0e
    0x140013b16
    0x140013b18
    0x140013b20
    0x140013b2e
    0x140013b32
    0x140013b37
    0x140013b42
    0x140013b46
    0x140013b49
    0x140013b4d
    0x140013b52
    0x140013b58
    0x140013b61
    0x140013b64
    0x140013b66
    0x140013b6d
    0x140013b72
    0x140013b7a
    0x140013b7f
    0x140013b83
    0x140013b8f
    0x140013b94
    0x140013b96
    0x140013b99
    0x140013b9e
    0x140013ba0
    0x140013ba4
    0x140013bac
    0x140013bb9
    0x140013bbd
    0x140013bcc
    0x140013bcf
    0x140013bd9
    0x140013bde
    0x140013be0
    0x140013be6
    0x140013bea
    0x140013bf6
    0x140013bfb
    0x140013bfd
    0x140013c00
    0x140013c05
    0x140013c0f
    0x140013c1b
    0x140013c1f
    0x140013c21
    0x140013c27
    0x140013c32
    0x140013c3e
    0x140013c43
    0x140013c48
    0x140013c4d
    0x140013c57
    0x140013c63
    0x140013c6a
    0x140013c80
    0x140013c82
    0x140013c84
    0x140013c86
    0x140013c97
    0x140013ca0
    0x140013ca9
    0x140013cab
    0x140013cb6
    0x140013cc4
    0x140013cd2
    0x140013ce1
    0x140013cea
    0x140013cee
    0x140013cf6
    0x140013d02
    0x140013d06
    0x140013d0e
    0x140013d13
    0x140013d1a
    0x140013d21
    0x140013d28
    0x140013d2d
    0x140013d32
    0x140013d49
    0x140013d50
    0x140013d54
    0x140013d59
    0x140013d5e
    0x140013d6b
    0x140013d6f
    0x140013d77
    0x140013d83
    0x140013d8a
    0x140013d8e
    0x140013d96
    0x140013da4
    0x140013da9
    0x140013dbd
    0x140013dc2
    0x140013dc5
    0x140013dca
    0x140013dcc
    0x140013dd3
    0x140013dd8
    0x140013de3
    0x140013de9
    0x140013df1
    0x140013df5
    0x140013df9
    0x140013dfc
    0x140013e00
    0x140013e0b
    0x140013e14
    0x140013e16
    0x140013e1a
    0x140013e1e
    0x140013e21
    0x140013e27
    0x140013e2a
    0x140013e2e
    0x140013e32
    0x140013e3f
    0x140013e43
    0x140013e47
    0x140013e4a
    0x140013e4d
    0x140013e51
    0x140013e55
    0x140013e59
    0x140013e5d
    0x140013e63
    0x140013e6e
    0x140013e76
    0x140013e81
    0x140013e8e
    0x140013e9f
    0x140013ea3
    0x140013eaf
    0x140013eb7
    0x140013eb9
    0x140013ec1
    0x140013ecc
    0x140013ed3
    0x140013ee0
    0x140013ee4
    0x140013eec
    0x140013ef2
    0x140013ef8
    0x140013efb
    0x140013eff
    0x140013f07
    0x140013f11
    0x140013f17
    0x140013f1a
    0x140013f1d
    0x140013f20
    0x140013f27
    0x140013f31
    0x140013f39
    0x140013f3f
    0x140013f41
    0x140013f48
    0x140013f54
    0x140013f5a
    0x140013f66
    0x140013f6d
    0x140013f73
    0x140013f76
    0x140013f79
    0x140013f7b
    0x140013f7e
    0x140013f81
    0x140013f84
    0x140013f8b
    0x140013f94
    0x140013f98
    0x140013f9e
    0x140013fa0
    0x140013fa4
    0x140013fa9
    0x140013fb5
    0x140013fb8
    0x140013fbf
    0x140013fc2
    0x140013fc9
    0x140013fcf
    0x140013fd1
    0x140013fd9
    0x140013fe0
    0x140013fe2
    0x140013fed
    0x140013ff4
    0x140013ff6
    0x140013ffd
    0x140014001
    0x140014009
    0x140014011
    0x14001401c
    0x140014020
    0x140014026
    0x14001402a
    0x140014032
    0x14001403e
    0x140014043
    0x140014045
    0x140014048
    0x14001404d
    0x14001404f
    0x140014056
    0x14001405f
    0x140014062
    0x140014066
    0x140014071
    0x14001407d
    0x140014086
    0x140014097
    0x1400140a8
    0x1400140aa
    0x1400140b2
    0x1400140be
    0x1400140c5
    0x1400140c7
    0x1400140cf
    0x1400140da
    0x1400140e1
    0x1400140ee
    0x1400140f2
    0x1400140f8
    0x1400140fe
    0x140014101
    0x140014105
    0x14001410d
    0x140014117
    0x14001411d
    0x140014120
    0x140014123
    0x140014126
    0x14001412d
    0x140014137
    0x14001413f
    0x140014145
    0x140014147
    0x140014152
    0x14001415e
    0x140014164
    0x140014170
    0x140014177
    0x14001417d
    0x140014180
    0x140014183
    0x140014185
    0x140014188
    0x14001418b
    0x14001418e
    0x140014195
    0x14001419e
    0x1400141a2
    0x1400141a8
    0x1400141aa
    0x1400141ae
    0x1400141b3
    0x1400141ba
    0x1400141be
    0x1400141c7
    0x1400141ca
    0x1400141d1
    0x1400141d4
    0x1400141d8
    0x1400141e1
    0x1400141e5
    0x1400141ed
    0x1400141f2
    0x1400141f8
    0x140014203
    0x14001420d
    0x140014211
    0x140014217
    0x14001421b
    0x140014222
    0x14001422e
    0x140014233
    0x140014235
    0x140014238
    0x14001423d
    0x14001423f
    0x140014246
    0x14001424f
    0x140014252
    0x140014256
    0x14001425d
    0x140014268
    0x14001426e
    0x140014275
    0x14001427a
    0x14001427c
    0x140014282
    0x14001428c
    0x140014295
    0x140014299
    0x1400142a1
    0x1400142a6
    0x1400142ac
    0x1400142b2
    0x1400142b6
    0x1400142ba
    0x1400142c6
    0x1400142c8
    0x1400142ca
    0x1400142d4
    0x1400142d9
    0x1400142dd
    0x1400142e5
    0x1400142e9
    0x1400142f5
    0x1400142f8
    0x1400142fe
    0x140014300
    0x140014308
    0x14001430e
    0x14001431e
    0x140014329
    0x14001432c
    0x14001432f
    0x140014333
    0x140014337
    0x14001433b
    0x140014343
    0x14001434d
    0x140014356
    0x14001435a
    0x14001436b
    0x14001436d
    0x140014370
    0x140014376
    0x140014378
    0x14001437b
    0x14001437f
    0x140014388
    0x14001438d
    0x1400143a1
    0x1400143a4
    0x1400143a6
    0x1400143ab
    0x1400143ad
    0x1400143b6
    0x1400143ba
    0x1400143be
    0x1400143c6
    0x1400143ca
    0x1400143d4
    0x140014400
    0x140014409
    0x14001440d
    0x140014415
    0x14001441a
    0x14001441d
    0x140014420
    0x14001442d
    0x140014438
    0x140014441
    0x140014445
    0x140014451
    0x14001445b
    0x140014461
    0x140014467
    0x140014470
    0x140014474
    0x14001447c
    0x140014481
    0x140014485
    0x140014489
    0x14001448c
    0x140014494
    0x140014498
    0x1400144c0

    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID: $header crc mismatch$unknown compression method$unknown header flags set
    • API String ID: 0-4074041902
    • Opcode ID: 678d21ef58d4a875124531cd8bb27c6309f94b37c07dc777e5a796b3eb271508
    • Instruction ID: 440100e0ad3e42c115cce95f3fb78f0a990aae4413b5501bd8dd5ba0711be261
    • Opcode Fuzzy Hash: 678d21ef58d4a875124531cd8bb27c6309f94b37c07dc777e5a796b3eb271508
    • Instruction Fuzzy Hash: 7A02B1726007949BEBA78F16C488BAE3BE9FB4CB94F164518EF894B7A0D775C940C740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140016210 Relevance: 4.1, Strings: 3, Instructions: 372COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 97%
    			E00000001140016210(void* __edx, void* __rax, long long __rcx, signed int __rdx, void* __r9, void* __r10, void* __r11, void* _a8, intOrPtr _a16, intOrPtr _a24, intOrPtr _a32) {
				long long _v88;
				signed long long _v96;
				long long _v104;
				signed long long _v112;
				void* _t157;
				signed int _t177;
				unsigned int _t183;
				unsigned int _t190;
				signed char _t197;
				signed char _t199;
				signed char _t201;
				signed char _t205;
				signed char _t207;
				signed char _t210;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t217;
				signed char _t230;
				signed char _t232;
				signed char _t233;
				signed int _t234;
				signed char _t235;
				unsigned int _t240;
				void* _t242;
				signed int _t250;
				void* _t262;
				void* _t264;
				void* _t265;
				void* _t266;
				void* _t267;
				signed long long _t278;
				signed long long _t279;
				signed long long _t287;
				signed char* _t292;
				signed long long _t293;
				signed char* _t295;
				long long* _t299;
				intOrPtr _t300;
				signed char* _t304;
				signed char* _t305;
				signed char* _t306;
				signed char* _t307;
				signed char* _t308;
				signed char* _t309;
				void* _t311;
				intOrPtr* _t312;
				intOrPtr _t314;
				void* _t315;
				void* _t316;
				void* _t317;
				void* _t318;
				void* _t319;
				void* _t320;
				void* _t321;
				void* _t322;
				void* _t323;
				void* _t324;
				long long _t325;
				long long _t327;
				signed char* _t328;
				signed char* _t332;
				signed char* _t337;
				signed char* _t338;
				intOrPtr _t343;
				void* _t344;
				void* _t347;

				_a8 = __rcx;
				_t312 = _t311 - 0x38;
				_t343 =  *((intOrPtr*)(__rcx + 0x28));
				r9d =  *((intOrPtr*)(__rcx + 0x18));
				r13d =  *((intOrPtr*)(__rcx + 8));
				_t314 =  *((intOrPtr*)(__rcx + 0x10));
				_t304 =  *((intOrPtr*)(__rcx));
				_t300 =  *((intOrPtr*)(_t343 + 0x68));
				r14d =  *((intOrPtr*)(_t343 + 0x3c));
				r11d =  *(_t343 + 0x4c);
				r15d = __r9 - 0x101;
				_t327 =  *((intOrPtr*)(_t343 + 0x60));
				_t287 = _t314 - __rax;
				_a16 =  *((intOrPtr*)(_t343 + 0x34));
				_v96 = _t287;
				_a32 =  *((intOrPtr*)(_t343 + 0x38));
				_t278 =  *((intOrPtr*)(_t343 + 0x40));
				_v112 = _t278;
				r13d = r13d - 5;
				_v104 = _t327;
				 *_t312 = _t300;
				_a24 = (1 <<  *(_t343 + 0x74)) - 1;
				_v88 = __rdx;
				if (r11d - 0xf >= 0) goto 0x400162ea;
				_t305 =  &(_t304[2]);
				r11d = r11d + 0x10;
				_t279 = _t278 & __rdx;
				r10d =  *(_t327 + _t279 * 4);
				_t230 = r10b & 0xffffffff;
				_t197 = r10d >> 0x00000008 & 0x000000ff;
				r11d = r11d - _t197;
				if (r10b == 0) goto 0x4001634a;
				asm("o16 nop [eax+eax]");
				if ((_t230 & 0x00000010) != 0) goto 0x4001635a;
				if ((_t230 & 0x00000040) != 0) goto 0x4001664b;
				r10d = r10d >> 0x10;
				r10d =  *(_t327 + _t279 * 4);
				_t199 = r10d >> 0x00000008 & 0x000000ff;
				r11d = r11d - _t199;
				_t250 = r10b;
				if (_t250 != 0) goto 0x40016310;
				r10d = r10d >> 0x10;
				_t315 = _t314 + 1;
				 *(_t315 - 1) = r10b;
				goto 0x40016637;
				r10d = r10d >> 0x10;
				_t232 = r10b & 0xf;
				if (_t250 == 0) goto 0x4001638b;
				if (r11d - _t232 >= 0) goto 0x40016379;
				_t306 =  &(_t305[1]);
				_t183 = ( *(_t343 + 0x48) + (( *_t304 & 0x000000ff) << r11d) + (( *(_t305 - 1) & 0x000000ff) << __r11 + 8) >> _t197 >> _t199) + (( *_t305 & 0x000000ff) << r11d);
				r11d = r11d + 8;
				_t201 = _t232;
				r10d = r10d + ((0x00000001 << _t201) - 0x00000001 & _t183);
				r11d = r11d - _t232;
				if (r11d - 0xf >= 0) goto 0x400163af;
				_t307 =  &(_t306[2]);
				r11d = r11d + 0x10;
				_t233 = dil & 0xffffffff;
				_t205 =  *(_t300 + (_t287 & _t279) * 4) >> 0x00000008 & 0x000000ff;
				r11d = r11d - _t205;
				if ((_t233 & 0x00000010) != 0) goto 0x40016409;
				if ((_t233 & 0x00000040) != 0) goto 0x40016679;
				_t240 =  *( *_t312 + _t279 * 4);
				_t234 = dil & 0xffffffff;
				_t207 = _t240 >> 0x00000008 & 0x000000ff;
				r11d = r11d - _t207;
				if ((_t234 & 0x00000010) == 0) goto 0x400163d4;
				_t235 = _t234 & 0x0000000f;
				if (r11d - _t235 >= 0) goto 0x4001643b;
				r11d = r11d + 8;
				_t308 =  &(_t307[1]);
				if (r11d - _t235 >= 0) goto 0x4001643b;
				_t309 =  &(_t308[1]);
				_t190 = ((_t183 >> _t201) + (( *_t306 & 0x000000ff) << r11d) + (( *(_t307 - 1) & 0x000000ff) << __r11 + 8) >> _t205 >> _t207) + (( *_t307 & 0x000000ff) << r11d) + (( *_t308 & 0x000000ff) << r11d);
				r11d = r11d + 8;
				_t210 = _t235;
				r11d = r11d - _t235;
				_t242 = (_t240 >> 0x10) + ((0x00000001 << _t210) - 0x00000001 & _t190);
				_t157 = r8d - _v96;
				if (_t242 - _t157 <= 0) goto 0x400165d7;
				_t212 = _t242 - _t157;
				if (_t212 - _a32 <= 0) goto 0x40016477;
				if ( *((intOrPtr*)(_t343 + 0x1be0)) != 0) goto 0x40016697;
				if (r14d != 0) goto 0x400164b8;
				r9d = _a16;
				r9d = r9d - _t212;
				_t328 = _t327 + _v112;
				_t262 = _t212 - r10d;
				if (_t262 >= 0) goto 0x4001655b;
				r10d = r10d - _t212;
				_t316 = _t315 + 1;
				 *((char*)(_t316 - 1)) =  *_t328 & 0x000000ff;
				_t213 = _t212 - 1;
				if (_t262 != 0) goto 0x400164a0;
				goto 0x40016553;
				r9d = r14d;
				r9d = r9d - _t213;
				if (r14d - _t213 >= 0) goto 0x40016525;
				r9d = r9d + _a16;
				_t295 = _v112;
				_t214 = _t213 - r14d;
				_t264 = _t214 - r10d;
				if (_t264 >= 0) goto 0x4001655b;
				r10d = r10d - _t214;
				asm("o16 nop [eax+eax]");
				_t317 = _t316 + 1;
				 *((char*)(_t317 - 1)) =  *( &(( &(_t328[1]))[_t295]) - _t316 + _t316) & 0x000000ff;
				if (_t264 != 0) goto 0x400164f0;
				_t332 = _t295;
				_t265 = r14d - r10d;
				if (_t265 >= 0) goto 0x4001655b;
				r10d = r10d - r14d;
				_t318 = _t317 + 1;
				 *((char*)(_t318 - 1)) =  *_t332 & 0x000000ff;
				_t217 = r14d - 1;
				if (_t265 != 0) goto 0x40016510;
				goto 0x40016553;
				_t266 = _t217 - r10d;
				if (_t266 >= 0) goto 0x4001655b;
				r10d = r10d - _t217;
				asm("o16 nop [eax+eax]");
				_t319 = _t318 + 1;
				 *((char*)(_t319 - 1)) = ( &(_t332[1]))[_v112] & 0x000000ff;
				if (_t266 != 0) goto 0x40016540;
				_t337 = _t319 - _t279;
				_t267 = r10d - 2;
				if (_t267 <= 0) goto 0x400165ab;
				asm("o16 nop [eax+eax]");
				_t320 = _t319 + 3;
				_t338 =  &(_t337[3]);
				 *((char*)(_t320 - 3)) =  *_t337 & 0x000000ff;
				r10d = r10d + 0xfffffffd;
				 *((char*)(_t320 - 2)) =  *(_t338 - 2) & 0x000000ff;
				 *((char*)(_t320 - 1)) =  *(_t338 - 1) & 0x000000ff;
				if (_t267 != 0) goto 0x40016580;
				if (r10d == 0) goto 0x4001662e;
				_t321 = _t320 + 1;
				 *((char*)(_t321 - 1)) =  *_t338 & 0x000000ff;
				if (r10d - 1 <= 0) goto 0x400165d0;
				_t322 = _t321 + 1;
				 *((char*)(_t322 - 1)) = _t338[1] & 0x000000ff;
				goto 0x40016637;
				_t292 = _t322 - _t279;
				r10d = r10d + 0xfffffffd;
				_t323 = _t322 + 3;
				 *((char*)(_t323 - 3)) =  *_t292 & 0x000000ff;
				_t293 =  &(_t292[3]);
				 *((char*)(_t323 - 2)) = _t292[1] & 0x000000ff;
				 *((char*)(_t323 - 1)) =  *(_t293 - 1) & 0x000000ff;
				if (r10d - 2 > 0) goto 0x400165e0;
				if (r10d == 0) goto 0x40016633;
				_t324 = _t323 + 1;
				 *((char*)(_t324 - 1)) =  *_t293 & 0x000000ff;
				if (r10d - 1 <= 0) goto 0x40016637;
				_t325 = _t324 + 1;
				 *((char*)(_t325 - 1)) =  *(_t293 + 1) & 0x000000ff;
				goto 0x40016637;
				if (_t309 - _t344 + _t304 >= 0) goto 0x400166a0;
				if (_t325 - _t347 + _t314 >= 0) goto 0x400166a0;
				goto 0x400162c6;
				if ((0xaaaaaaab * (__r10 - 0x00000003) >> 0x00000020 >> 0x00000001 & 0x00000020) == 0) goto 0x40016663;
				 *((intOrPtr*)(_t343 + 8)) = 0x3f3f;
				goto 0x400166a8;
				 *((long long*)(_a8 + 0x20)) = "invalid literal/length code";
				 *((intOrPtr*)(_t343 + 8)) = 0x3f51;
				goto 0x400166a8;
				 *((long long*)(_a8 + 0x20)) = "invalid distance code";
				 *((intOrPtr*)(_t343 + 8)) = 0x3f51;
				goto 0x400166a8;
				goto 0x40016680;
				_t299 = _a8;
				 *((long long*)(_t299 + 0x10)) = _t325;
				_t177 = _t293 * 8;
				r11d = r11d - _t177;
				 *_t299 = _t309 - "invalid distance too far back";
				 *(_t299 + 8) = _t177;
				 *(_t299 + 0x18) = _t177;
				 *(_t343 + 0x48) = _t190 >> _t210 & (0x00000001 << r11d) - 0x00000001;
				 *(_t343 + 0x4c) = r11d;
				return _t177;
			}






































































    0x140016210
    0x140016221
    0x140016225
    0x140016229
    0x14001622d
    0x140016231
    0x140016235
    0x140016238
    0x14001623d
    0x140016247
    0x140016259
    0x140016260
    0x140016265
    0x14001626f
    0x14001627b
    0x140016285
    0x14001628c
    0x140016291
    0x140016296
    0x1400162af
    0x1400162b4
    0x1400162b8
    0x1400162c1
    0x1400162ca
    0x1400162d2
    0x1400162e6
    0x1400162ec
    0x1400162ef
    0x1400162f6
    0x1400162fd
    0x140016302
    0x140016308
    0x14001630a
    0x140016313
    0x140016318
    0x140016320
    0x14001632f
    0x14001633d
    0x140016342
    0x140016345
    0x140016348
    0x14001634a
    0x14001634e
    0x140016351
    0x140016355
    0x14001635a
    0x14001635e
    0x140016361
    0x140016366
    0x14001636e
    0x140016373
    0x140016375
    0x140016379
    0x140016385
    0x140016388
    0x14001638f
    0x140016397
    0x1400163ab
    0x1400163c0
    0x1400163c7
    0x1400163cc
    0x1400163d2
    0x1400163d7
    0x1400163f0
    0x1400163f5
    0x1400163fc
    0x140016401
    0x140016407
    0x140016409
    0x140016412
    0x14001641a
    0x140016420
    0x140016428
    0x140016430
    0x140016435
    0x140016437
    0x14001643b
    0x14001643f
    0x14001644a
    0x14001644f
    0x140016455
    0x14001645d
    0x140016466
    0x140016471
    0x14001647a
    0x14001647c
    0x140016484
    0x140016487
    0x14001648c
    0x14001648f
    0x140016495
    0x1400164a4
    0x1400164ab
    0x1400164af
    0x1400164b1
    0x1400164b3
    0x1400164b8
    0x1400164bb
    0x1400164c1
    0x1400164c3
    0x1400164cb
    0x1400164d0
    0x1400164d6
    0x1400164d9
    0x1400164df
    0x1400164e5
    0x1400164f5
    0x1400164f8
    0x1400164fe
    0x140016500
    0x140016503
    0x140016506
    0x14001650b
    0x140016514
    0x14001651b
    0x14001651f
    0x140016521
    0x140016523
    0x14001652a
    0x14001652d
    0x14001652f
    0x140016536
    0x140016544
    0x14001654b
    0x140016551
    0x140016558
    0x14001655b
    0x14001655f
    0x140016575
    0x140016584
    0x140016588
    0x14001658c
    0x140016595
    0x140016599
    0x1400165a2
    0x1400165a9
    0x1400165ae
    0x1400165b8
    0x1400165bb
    0x1400165c2
    0x1400165c9
    0x1400165cc
    0x1400165d5
    0x1400165dc
    0x1400165e3
    0x1400165e7
    0x1400165eb
    0x1400165f3
    0x1400165f7
    0x1400165ff
    0x140016607
    0x14001660c
    0x140016615
    0x140016618
    0x14001661f
    0x140016625
    0x140016628
    0x14001662c
    0x14001663a
    0x14001663f
    0x140016646
    0x140016656
    0x140016658
    0x140016661
    0x14001666a
    0x14001666e
    0x140016677
    0x140016688
    0x14001668c
    0x140016695
    0x14001669e
    0x1400166a0
    0x1400166ab
    0x1400166b7
    0x1400166be
    0x1400166c4
    0x1400166ce
    0x1400166e1
    0x1400166e4
    0x1400166e9
    0x1400166fe

    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID: invalid distance code$invalid distance too far back$invalid literal/length code
    • API String ID: 0-3255898291
    • Opcode ID: 7d717e1bb7401720cff5681938534b099b93b01708ed7fc065f61c715005915f
    • Instruction ID: 3f1348f65b8f8bda14ba5cdfa7bf6f02fc8c4dbb68883e69d1ec2b1899c7470d
    • Opcode Fuzzy Hash: 7d717e1bb7401720cff5681938534b099b93b01708ed7fc065f61c715005915f
    • Instruction Fuzzy Hash: C5D138326186D08BD71A8F3AD8447BD7FA1F3993C4F54811AEB968B791D63DCA4AC700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140012FDD Relevance: 4.0, Strings: 3, Instructions: 217COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 51%
    			E00000001140012FDD(signed int __ebx, void* __esi, void* __rdi, void* __r10, long long __r12, void* __r13, signed char* __r14) {
				signed short _t517;
				signed short _t518;
				signed short _t533;
				signed short _t570;
				signed short _t581;
				signed short _t582;
				signed int _t613;
				unsigned int _t619;
				unsigned int _t625;
				signed int _t644;
				signed int _t646;
				signed int _t657;
				signed char _t663;
				signed int _t680;
				signed char _t686;
				void* _t694;
				intOrPtr _t695;
				signed char _t698;
				void* _t705;
				signed short _t706;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t729;
				signed int _t731;
				signed int _t733;
				signed int _t734;
				void* _t735;
				signed int _t740;
				signed int _t741;
				signed int _t743;
				void* _t744;
				signed int _t745;
				void* _t746;
				signed int _t747;
				void* _t748;
				signed int _t749;
				void* _t750;
				signed int _t752;
				signed int _t753;
				void* _t754;
				signed int _t756;
				signed int _t757;
				void* _t758;
				signed int _t760;
				void* _t761;
				signed int _t762;
				signed int _t763;
				void* _t764;
				signed int _t766;
				void* _t767;
				signed int _t768;
				signed int _t770;
				signed int _t771;
				signed char _t780;
				signed char _t811;
				signed char _t815;
				signed int _t817;
				signed int _t822;
				signed char _t838;
				signed char _t840;
				signed char _t872;
				signed char _t875;
				signed char _t881;
				signed char _t905;
				signed char _t908;
				signed char _t914;
				unsigned int _t915;
				void* _t916;
				void* _t917;
				signed char _t918;
				void* _t919;
				signed char _t930;
				signed int _t940;
				unsigned int _t942;
				void* _t944;
				signed int* _t948;
				signed int* _t952;
				signed char _t959;
				signed char _t961;
				void* _t964;
				signed int _t966;
				signed int _t968;
				signed int _t970;
				signed int _t971;
				void* _t973;
				void* _t974;
				void* _t975;
				void* _t976;
				void* _t977;
				void* _t978;
				void* _t979;
				void* _t980;
				void* _t981;
				void* _t982;
				void* _t983;
				void* _t984;
				void* _t985;
				void* _t986;
				void* _t987;
				void* _t988;
				void* _t989;
				void* _t990;
				intOrPtr _t991;
				intOrPtr _t992;
				void* _t993;
				void* _t994;
				void* _t995;
				void* _t996;
				void* _t997;
				void* _t998;
				void* _t999;
				void* _t1001;
				void* _t1091;
				void* _t1119;
				void* _t1132;
				intOrPtr _t1195;
				intOrPtr _t1200;
				intOrPtr _t1202;
				intOrPtr _t1203;
				intOrPtr _t1204;
				intOrPtr _t1205;
				intOrPtr _t1206;
				intOrPtr _t1207;
				intOrPtr _t1208;
				signed long long _t1214;
				signed int _t1215;
				signed long long _t1218;
				signed long long _t1219;
				signed long long _t1220;
				signed int _t1223;
				signed long long _t1226;
				signed long long _t1229;
				void* _t1236;
				signed int* _t1238;
				intOrPtr _t1239;
				void* _t1240;
				intOrPtr _t1241;
				signed long long _t1242;
				signed long long _t1243;
				long long _t1245;
				signed long long _t1246;
				signed long long _t1247;
				signed long long _t1248;
				signed long long _t1249;
				signed long long _t1250;
				void* _t1251;
				void* _t1256;
				intOrPtr _t1259;
				intOrPtr _t1261;
				void* _t1266;
				intOrPtr _t1278;
				intOrPtr _t1279;
				signed long long _t1281;
				void* _t1284;
				void* _t1286;
				void* _t1288;
				long long _t1289;
				long long _t1291;
				signed long long _t1292;
				intOrPtr _t1293;
				signed long long _t1296;
				signed int* _t1299;
				signed long long _t1303;
				signed long long _t1304;
				signed long long _t1305;
				signed long long _t1306;
				void* _t1308;
				void* _t1309;
				signed int _t1310;
				intOrPtr _t1311;
				long long _t1313;
				signed char* _t1318;
				signed char* _t1319;
				signed char* _t1320;
				signed char* _t1321;
				signed char* _t1322;
				signed char* _t1323;
				signed char* _t1324;
				signed char* _t1325;
				signed char* _t1326;
				signed char* _t1327;
				signed char* _t1328;
				signed char* _t1330;
				signed char* _t1331;
				signed char* _t1332;
				signed char* _t1333;
				signed char* _t1334;
				signed char* _t1335;
				signed char* _t1337;
				signed char* _t1338;
				signed char* _t1339;
				signed char* _t1340;
				signed char* _t1341;
				signed char* _t1342;
				signed char* _t1343;
				signed char* _t1344;

				_t1308 = __r10;
				_t930 =  *(__r13 + 0x10);
				if (_t930 != 0) goto 0x40012ff2;
				 *(__r13 + 8) = 0x3f40;
				goto 0x40013650;
				if (__ebx - 0x10 >= 0) goto 0x40013017;
				if (__esi == 0) goto 0x400144ee;
				_t973 = __esi - 1;
				_t1318 =  &(__r14[1]);
				r15d = r15d + (( *__r14 & 0x000000ff) << __ebx);
				if (__ebx + 8 - 0x10 < 0) goto 0x40012ff7;
				if ((_t930 & 0x00000002) == 0) goto 0x40013074;
				if (r15d != 0x8b1f) goto 0x40013074;
				if ( *(__r13 + 0x30) != 0) goto 0x40013034;
				 *(__r13 + 0x30) = 0xf;
				r8d = 0;
				_t517 = E00000001140015160(_t1251);
				r8d = 2;
				 *(__r13 + 0x20) = _t517;
				 *(_t1284 - 0x50) = 0x8b1f;
				_t518 = E00000001140015160(_t1284 - 0x50);
				r15d = r12d;
				 *(__r13 + 0x20) = _t518;
				 *(__r13 + 8) = 0x3f35;
				goto 0x40013648;
				_t1195 =  *((intOrPtr*)(__r13 + 0x28));
				 *(__r13 + 0x18) = r12d;
				if (_t1195 == 0) goto 0x40013088;
				 *(_t1195 + 0x40) = 0xffffffff;
				if (( *(__r13 + 0x10) & 0x00000001) == 0) goto 0x4001315d;
				if (((r15b & 0xffffffff) << 8) + (r15d >> 8) != ((((r15b & 0xffffffff) << 8) + (r15d >> 8) - (0x8421085 * (((r15b & 0xffffffff) << 8) + (r15d >> 8)) >> 0x20) >> 1) + (0x8421085 * (((r15b & 0xffffffff) << 8) + (r15d >> 8)) >> 0x20) >> 4) * 0x1f) goto 0x4001315d;
				if ((r15d & 0x0000000f) == 8) goto 0x400130e0;
				 *((long long*)(__rdi + 0x20)) = "unknown compression method";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				r15d = r15d >> 4;
				_t780 = (r15d & 0x0000000f) + 8;
				if ( *(__r13 + 0x30) != 0) goto 0x400130fb;
				 *(__r13 + 0x30) = _t780;
				if (_t780 - 0xf > 0) goto 0x40013145;
				if (_t780 -  *(__r13 + 0x30) > 0) goto 0x40013145;
				r8d = 0;
				 *(__r13 + 0x1c) = 1;
				_t533 = E00000001140015A00(1 << _t780, 0, 0, _t1236, _t1288);
				r15d = r15d >> 8;
				r15d =  !r15d;
				 *(__r13 + 0x20) = _t533;
				 *(__rdi + 0x4c) = _t533;
				r15d = r15d & 0x00000002;
				_t721 = r12d;
				r15d = r15d | 0x00003f3d;
				 *(__r13 + 8) = r15d;
				r15d = r12d;
				goto 0x40013648;
				 *((long long*)(__rdi + 0x20)) = "invalid window size";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				 *((long long*)(__rdi + 0x20)) = "incorrect header check";
				 *(__r13 + 8) = 0x3f51;
				if (_t721 - 0x10 >= 0) goto 0x400131a0;
				asm("o16 nop [eax+eax]");
				if (_t973 == 0) goto 0x400144e5;
				_t974 = _t973 - 1;
				_t1319 =  &(_t1318[1]);
				r15d = r15d + (( *_t1318 & 0x000000ff) << _t721);
				if (_t721 + 8 - 0x10 < 0) goto 0x40013180;
				 *(__r13 + 0x18) = r15d;
				if (r15b != 8) goto 0x400130c8;
				if ((r15d & 0x0000e000) == 0) goto 0x400131cf;
				 *((long long*)(__rdi + 0x20)) = "unknown header flags set";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				_t1238 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1238 == 0) goto 0x400131e3;
				 *_t1238 = r15d >> 0x00000008 & 0x00000001;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013217;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013217;
				 *(_t1284 - 0x50) = r15b;
				r15d = r15d >> 8;
				 *(_t1284 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1284 - 0x50);
				r15d = r12d;
				_t723 = r12d;
				 *(__r13 + 8) = 0x3f36;
				if (_t723 - 0x20 >= 0) goto 0x40013250;
				if (_t974 == 0) goto 0x400144ee;
				_t975 = _t974 - 1;
				_t1320 =  &(_t1319[1]);
				r15d = r15d + (( *_t1319 & 0x000000ff) << _t723);
				if (_t723 + 8 - 0x20 < 0) goto 0x40013230;
				_t1200 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1200 == 0) goto 0x4001325d;
				 *(_t1200 + 4) = r15d;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400132a3;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400132a3;
				 *(_t1284 - 0x50) = r15b;
				r8d = 4;
				 *(_t1284 - 0x4f) = r15d >> 8;
				r15d = r15d >> 0x18;
				 *(_t1284 - 0x4d) = r15b;
				 *((char*)(_t1284 - 0x4e)) = r15d >> 0x10;
				 *(__r13 + 0x20) = E00000001140015160(_t1284 - 0x50);
				r15d = r12d;
				_t725 = r12d;
				 *(__r13 + 8) = 0x3f37;
				if (_t725 - 0x10 >= 0) goto 0x400132d8;
				if (_t975 == 0) goto 0x400144ee;
				_t976 = _t975 - 1;
				_t1321 =  &(_t1320[1]);
				r15d = r15d + (( *_t1320 & 0x000000ff) << _t725);
				if (_t725 + 8 - 0x10 < 0) goto 0x400132b8;
				_t1239 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1239 == 0) goto 0x400132f5;
				 *(_t1239 + 8) = r15b & 0xffffffff;
				 *( *((intOrPtr*)(__r13 + 0x28)) + 0xc) = r15d >> 8;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013329;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013329;
				 *(_t1284 - 0x50) = r15b;
				r15d = r15d >> 8;
				 *(_t1284 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1284 - 0x50);
				r15d = r12d;
				_t727 = r12d;
				 *(__r13 + 8) = 0x3f38;
				if (( *(__r13 + 0x18) & 0x00000400) == 0) goto 0x400133b3;
				if (_t727 - 0x10 >= 0) goto 0x40013366;
				if (_t976 == 0) goto 0x400144ee;
				_t977 = _t976 - 1;
				_t1322 =  &(_t1321[1]);
				r15d = r15d + (( *_t1321 & 0x000000ff) << _t727);
				if (_t727 + 8 - 0x10 < 0) goto 0x40013346;
				_t1202 =  *((intOrPtr*)(__r13 + 0x28));
				 *(__r13 + 0x50) = r15d;
				if (_t1202 == 0) goto 0x40013377;
				 *(_t1202 + 0x18) = r15d;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400133ab;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400133ab;
				 *(_t1284 - 0x50) = r15b;
				r15d = r15d >> 8;
				_t1256 = _t1284 - 0x50;
				 *(_t1284 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1256);
				r15d = r12d;
				_t729 = r12d;
				goto 0x400133c0;
				_t1203 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1203 == 0) goto 0x400133c0;
				 *((long long*)(_t1203 + 0x10)) = __r12;
				 *(__r13 + 8) = 0x3f39;
				if (( *(__r13 + 0x18) & 0x00000400) == 0) goto 0x40013456;
				_t966 =  >  ? _t977 :  *(__r13 + 0x50);
				if (_t966 == 0) goto 0x4001344b;
				_t1204 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1204 == 0) goto 0x4001341c;
				_t1293 =  *((intOrPtr*)(_t1204 + 0x10));
				if (_t1293 == 0) goto 0x4001341c;
				if (__rdi + _t1256 -  *((intOrPtr*)(_t1204 + 0x1c)) <= 0) goto 0x4001340a;
				goto 0x4001340c;
				r8d = _t966;
				_t1240 = _t1239 + _t1293;
				memcpy(??, ??, ??);
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013440;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013440;
				r8d = _t966;
				 *(__r13 + 0x20) = E00000001140015160(_t1322);
				_t978 = _t977 - _t966;
				_t1323 =  &(_t1322[_t1204]);
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - _t966;
				if ( *(__r13 + 0x50) != 0) goto 0x400144ee;
				 *(__r13 + 0x50) = r12d;
				 *(__r13 + 8) = 0x3f3a;
				if (( *(__r13 + 0x18) & 0x00000800) == 0) goto 0x400134ee;
				if (_t978 == 0) goto 0x400144ee;
				_t968 = r12d + 1;
				r12d =  *(_t1204 + _t1323) & 0x000000ff;
				_t1205 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1205 == 0) goto 0x400134ac;
				_t1259 =  *((intOrPtr*)(_t1205 + 0x20));
				if (_t1259 == 0) goto 0x400134ac;
				if ( *(__r13 + 0x50) -  *((intOrPtr*)(_t1205 + 0x28)) >= 0) goto 0x400134ac;
				 *((intOrPtr*)(_t1240 + _t1259)) = r12b;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + 1;
				if (r12d == 0) goto 0x400134b5;
				if (_t968 - _t978 < 0) goto 0x40013480;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400134d9;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400134d9;
				r8d = _t968;
				 *(__r13 + 0x20) = E00000001140015160(_t1323);
				_t979 = _t978 - _t968;
				_t1324 =  &(_t1323[_t1205]);
				if (r12d != 0) goto 0x400144ee;
				r12d = 0;
				goto 0x400134fb;
				_t1206 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1206 == 0) goto 0x400134fb;
				 *((long long*)(_t1206 + 0x20)) = __r12;
				 *(__r13 + 0x50) = r12d;
				 *(__r13 + 8) = 0x3f3b;
				if (( *(__r13 + 0x18) & 0x00001000) == 0) goto 0x4001358e;
				if (_t979 == 0) goto 0x400144ee;
				_t970 = r12d + 1;
				r12d =  *(_t1206 + _t1324) & 0x000000ff;
				_t1207 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1207 == 0) goto 0x4001354c;
				_t1261 =  *((intOrPtr*)(_t1207 + 0x30));
				if (_t1261 == 0) goto 0x4001354c;
				if ( *(__r13 + 0x50) -  *((intOrPtr*)(_t1207 + 0x38)) >= 0) goto 0x4001354c;
				 *((intOrPtr*)(_t1240 + _t1261)) = r12b;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + 1;
				if (r12d == 0) goto 0x40013555;
				if (_t970 - _t979 < 0) goto 0x40013520;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013579;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013579;
				r8d = _t970;
				 *(__r13 + 0x20) = E00000001140015160(_t1324);
				_t980 = _t979 - _t970;
				_t1325 =  &(_t1324[_t1207]);
				if (r12d != 0) goto 0x400144ee;
				r12d = 0;
				goto 0x4001359b;
				_t1208 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1208 == 0) goto 0x4001359b;
				 *((long long*)(_t1208 + 0x30)) = __r12;
				_t1278 =  *((intOrPtr*)(_t1284 + 0x20));
				r11d =  *(_t1284 + 0x38);
				 *(__r13 + 8) = 0x3f3c;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x4001360c;
				if (_t729 - 0x10 >= 0) goto 0x400135e0;
				if (_t980 == 0) goto 0x400144ee;
				_t981 = _t980 - 1;
				_t1326 =  &(_t1325[1]);
				r15d = r15d + (( *_t1325 & 0x000000ff) << _t729);
				if (_t729 + 8 - 0x10 < 0) goto 0x400135c0;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013606;
				if (r15d == ( *(__r13 + 0x20) & 0x0000ffff)) goto 0x40013606;
				 *(_t1278 + 0x20) = "header crc mismatch";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t731 = r12d;
				_t1241 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1241 == 0) goto 0x4001362d;
				 *(_t1241 + 0x3c) =  *(__r13 + 0x18) >> 0x00000009 & 0x00000001;
				 *( *((intOrPtr*)(__r13 + 0x28)) + 0x40) = 1;
				r8d = 0;
				_t570 = E00000001140015160(_t1324);
				 *(__r13 + 0x20) = _t570;
				 *(_t1278 + 0x4c) = _t570;
				 *(__r13 + 8) = 0x3f3f;
				r11d =  *(_t1284 + 0x38);
				if ( *(__r13 + 8) - 0x3f34 - 0x1e > 0) goto 0x40014626;
				r10d =  *(_t1284 - 0x4c);
				r12d = 0;
				if (_t731 - 0x20 >= 0) goto 0x40013693;
				if (_t981 == 0) goto 0x400144ee;
				_t982 = _t981 - 1;
				_t1327 =  &(_t1326[1]);
				r15d = r15d + (( *_t1326 & 0x000000ff) << _t731);
				if (_t731 + 8 - 0x20 < 0) goto 0x40013673;
				_t733 = r12d;
				r15d = r15d >> 0x18;
				_t581 = (r15d >> 0x00000008 & 0x0000ff00) + ((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + r15d;
				r15d = r12d;
				 *(__r13 + 0x20) = _t581;
				 *(_t1278 + 0x4c) = _t581;
				 *(__r13 + 8) = 0x3f3e;
				if ( *((intOrPtr*)(__r13 + 0x14)) == 0) goto 0x40014481;
				r8d = 0;
				_t582 = E00000001140015A00(_t581, 0, 0, _t1236, _t1288);
				_t1296 =  *(_t1284 - 0x40);
				r11d =  *(_t1284 + 0x38);
				 *(__r13 + 0x20) = _t582;
				 *(_t1278 + 0x4c) = _t582;
				_t1289 = __r13 + 0x70;
				 *(__r13 + 8) = 0x3f3f;
				if ( *((intOrPtr*)(_t1284 + 0x28)) + 0xfffffffb - 1 <= 0) goto 0x400144ee;
				if ( *(__r13 + 0xc) == 0) goto 0x40013733;
				 *(__r13 + 8) = 0x3f4e;
				_t811 = _t733 & 0x00000007;
				r15d = r15d >> _t811;
				_t734 = _t733 - _t811;
				goto 0x40013650;
				if (_t734 - 3 >= 0) goto 0x40013758;
				if (_t982 == 0) goto 0x400144ee;
				_t735 = _t734 + 8;
				_t983 = _t982 - 1;
				_t1328 =  &(_t1327[1]);
				r15d = r15d + (( *_t1327 & 0x000000ff) << _t734);
				_t1091 = _t735 - 3;
				if (_t1091 < 0) goto 0x40013738;
				r15d = r15d >> 1;
				 *(__r13 + 0xc) = r15d & 0x00000001;
				if (_t1091 == 0) goto 0x400137ed;
				if (_t1091 == 0) goto 0x400137ae;
				if (_t1091 == 0) goto 0x4001379a;
				if (_t1091 != 0) goto 0x400137f5;
				r15d = r15d >> 2;
				 *(_t1278 + 0x20) = "invalid block type";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				r15d = r15d >> 2;
				 *(__r13 + 8) = 0x3f44;
				goto 0x40013650;
				 *_t1289 = 9;
				 *(__r13 + 0x60) = 0x40019e70;
				 *((intOrPtr*)(__r13 + 0x74)) = 5;
				 *(__r13 + 8) = 0x3f47;
				 *((long long*)(__r13 + 0x68)) = 0x4001a670;
				if ( *((intOrPtr*)(_t1284 + 0x28)) != 6) goto 0x400137f5;
				r15d = r15d >> 2;
				goto 0x400144f1;
				 *(__r13 + 8) = 0x3f41;
				r15d = r15d >> 2;
				_t740 = _t735 - 1 + 0x3fffffff8;
				_t815 = _t740 & 0x00000007;
				_t741 = _t740 - _t815;
				r15d = r15d >> _t815;
				if (_t741 - 0x20 >= 0) goto 0x40013830;
				if (_t983 == 0) goto 0x400144ee;
				_t984 = _t983 - 1;
				r15d = r15d + (( *_t1328 & 0x000000ff) << _t741);
				if (_t741 + 8 - 0x20 < 0) goto 0x40013810;
				_t817 = r15w & 0xffffffff;
				if (_t817 ==  !r15d >> 0x10) goto 0x40013858;
				_t1214 = "invalid stored block lengths";
				 *(_t1278 + 0x20) = _t1214;
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x50) = _t817;
				r15d = r12d;
				_t743 = r12d;
				 *(__r13 + 8) = 0x3f42;
				if ( *((intOrPtr*)(_t1284 + 0x28)) == 6) goto 0x400144f1;
				 *(__r13 + 8) = 0x3f43;
				r12d =  *(__r13 + 0x50);
				if (r12d == 0) goto 0x400138d8;
				r12d =  >  ? _t984 : r12d;
				r12d =  >  ? r11d : r12d;
				if (r12d == 0) goto 0x400144ee;
				r8d = r12d;
				_t1242 = _t1296;
				_t971 = r12d;
				memcpy(??, ??, ??);
				r11d =  *(_t1284 + 0x38);
				r11d = r11d - r12d;
				_t1330 =  &(( &(_t1328[1]))[_t1278]);
				_t1279 =  *((intOrPtr*)(_t1284 + 0x20));
				_t985 = _t984 - r12d;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - r12d;
				 *(_t1284 + 0x38) = r11d;
				 *(_t1284 - 0x40) =  *(_t1284 - 0x40) + _t1278;
				goto 0x40013650;
				 *(__r13 + 8) = 0x3f3f;
				if (_t743 - 0xe >= 0) goto 0x40013910;
				asm("o16 nop [eax+eax]");
				if (_t985 == 0) goto 0x400144ee;
				_t744 = _t743 + 8;
				_t986 = _t985 - 1;
				_t1331 =  &(_t1330[1]);
				r15d = r15d + (( *_t1330 & 0x000000ff) << _t743);
				if (_t744 - 0xe < 0) goto 0x400138f0;
				r15d = r15d >> 5;
				_t745 = _t744 + 0xfffffff2;
				r15d = r15d >> 5;
				_t822 = (r15d & 0x0000001f) + 0x101;
				_t940 = (r15d & 0x0000001f) + 1;
				r15d = r15d >> 4;
				 *(__r13 + 0x7c) = _t822;
				 *(__r13 + 0x80) = _t940;
				 *((intOrPtr*)(__r13 + 0x78)) = (r15d & 0x0000000f) + 4;
				if (_t822 - 0x11e > 0) goto 0x40013a7b;
				if (_t940 - 0x1e > 0) goto 0x40013a7b;
				 *(__r13 + 0x84) = r12d;
				 *(__r13 + 8) = 0x3f45;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) >= 0) goto 0x400139e3;
				if (_t745 - 3 >= 0) goto 0x400139a8;
				if (_t986 == 0) goto 0x400144ee;
				_t746 = _t745 + 8;
				_t987 = _t986 - 1;
				_t1332 =  &(_t1331[1]);
				r15d = r15d + (( *_t1331 & 0x000000ff) << _t745);
				if (_t746 - 3 < 0) goto 0x40013988;
				_t747 = _t746 + 0xfffffffd;
				r15d = r15d >> 3;
				 *(__r13 + 0x90 + _t1214 * 2) = r15w & 7;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) < 0) goto 0x40013983;
				if ( *(__r13 + 0x84) - 0x13 >= 0) goto 0x40013a19;
				 *(__r13 + 0x90 + _t1214 * 2) = r12w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) - 0x13 < 0) goto 0x400139f0;
				_t1215 = __r13 + 0x550;
				_t1299 = __r13 + 0x88;
				 *_t1299 = _t1215;
				 *(__r13 + 0x60) = _t1215;
				 *((long long*)(_t1286 + 0x28)) = __r13 + 0x310;
				 *_t1289 = 7;
				 *((long long*)(_t1286 + 0x20)) = _t1289;
				_t271 = _t1242 + 0x13; // 0x13
				r8d = _t271;
				_t1266 = __r13 + 0x90;
				_t613 = E00000001140015DD0(0, _t971, _t1001, __r13 + 0x310, _t1266, _t1289, _t1299, _t1308, __r12);
				r11d =  *(_t1284 + 0x38);
				 *(_t1284 + 0x30) = _t613;
				if (_t613 == 0) goto 0x40013a93;
				 *(_t1279 + 0x20) = "invalid code lengths set";
				 *(__r13 + 8) = 0x3f51;
				goto 0x4001364c;
				_t1218 = "too many length or distance symbols";
				 *(_t1279 + 0x20) = _t1218;
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x84) = r12d;
				 *(__r13 + 8) = 0x3f46;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) >= 0) goto 0x40013cca;
				asm("o16 nop [eax+eax]");
				_t1243 = _t1242 & _t1218;
				_t1219 =  *(__r13 + 0x60);
				_t619 =  *(_t1219 + _t1243 * 4);
				 *(_t1284 - 0x48) = _t619;
				if ((_t619 >> 0x00000008 & 0x000000ff) - _t747 <= 0) goto 0x40013b44;
				if (_t987 == 0) goto 0x400144ee;
				_t748 = _t747 + 8;
				_t988 = _t987 - 1;
				r15d = r15d + (( *_t1332 & 0x000000ff) << _t747);
				_t1333 =  &(_t1332[1]);
				_t1220 =  *(__r13 + 0x60);
				_t625 =  *(_t1220 + (_t1243 & _t1219) * 4);
				 *(_t1284 - 0x48) = _t625;
				if ((_t625 >> 0x00000008 & 0x000000ff) - _t748 > 0) goto 0x40013b00;
				_t942 = _t625 >> 0x10;
				_t1119 = _t942 - 0x10;
				if (_t1119 >= 0) goto 0x40013b72;
				_t838 = _t625 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x90 + _t1220 * 2) = _t942;
				r15d = r15d >> _t838;
				_t749 = _t748 - _t838;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				goto 0x40013caf;
				if (_t1119 != 0) goto 0x40013bd4;
				_t944 = (r10d >> 0x00000008 & 0x000000ff) + 2;
				if (_t749 - _t944 >= 0) goto 0x40013ba0;
				if (_t988 == 0) goto 0x400144ee;
				_t750 = _t749 + 8;
				_t989 = _t988 - 1;
				_t1334 =  &(_t1333[1]);
				r15d = r15d + (( *_t1333 & 0x000000ff) << _t749);
				if (_t750 - _t944 < 0) goto 0x40013b81;
				_t840 =  *(_t1284 - 0x47) & 0x000000ff;
				r15d = r15d >> _t840;
				if (r10d == 0) goto 0x40013cfb;
				r15d = r15d >> 2;
				r8d =  *(__r13 + 0x90 + _t1220 * 2) & 0x0000ffff;
				_t752 = _t750 - _t840 + 0xfffffffe;
				goto 0x40013c6f;
				r9d =  *(_t1284 - 0x47) & 0x000000ff;
				if ( *(_t1284 - 0x46) != 0x11) goto 0x40013c21;
				_t948 =  &(_t1299[0]);
				if (_t752 - _t948 >= 0) goto 0x40013c07;
				if (_t989 == 0) goto 0x400144ee;
				_t753 = _t752 + 8;
				_t990 = _t989 - 1;
				_t1335 =  &(_t1334[1]);
				r15d = r15d + (( *_t1334 & 0x000000ff) << _t752);
				if (_t753 - _t948 < 0) goto 0x40013be8;
				r15d = r15d >> r9d;
				r15d = r15d >> 3;
				goto 0x40013c67;
				_t952 =  &(_t1299[1]);
				if (_t753 - _t952 >= 0) goto 0x40013c4f;
				if (_t990 == 0) goto 0x400144ee;
				_t754 = _t753 + 8;
				_t991 = _t990 - 1;
				r15d = r15d + (( *_t1335 & 0x000000ff) << _t753);
				if (_t754 - _t952 < 0) goto 0x40013c30;
				r15d = r15d >> r9d;
				r15d = r15d >> 7;
				r8d = r12d;
				if (_t1308 + _t1266 -  *(__r13 + 0x80) +  *(__r13 + 0x7c) > 0) goto 0x40013cfb;
				_t1132 = (r15d & 0x0000007f) + 0xb;
				if (_t1132 == 0) goto 0x40013cab;
				asm("o16 nop [eax+eax]");
				 *(__r13 + 0x90 + _t1220 * 2) = r8w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if (_t1132 != 0) goto 0x40013c90;
				_t1291 = __r13 + 0x70;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) < 0) goto 0x40013ad0;
				if ( *(__r13 + 8) == 0x3f51) goto 0x4001364c;
				if ( *((short*)(__r13 + 0x290)) != 0) goto 0x40013d13;
				 *(_t1279 + 0x20) = "invalid code -- missing end-of-block";
				 *(__r13 + 8) = 0x3f51;
				goto 0x4001364c;
				 *(_t1279 + 0x20) = "invalid bit length repeat";
				 *(__r13 + 8) = 0x3f51;
				goto 0x4001364c;
				_t1223 = __r13 + 0x550;
				 *_t1291 = 9;
				_t1313 = __r13 + 0x310;
				 *((long long*)(_t1286 + 0x28)) = _t1313;
				 *((long long*)(_t1286 + 0x20)) = _t1291;
				r8d =  *(__r13 + 0x7c);
				 *(__r13 + 0x88) = _t1223;
				 *(__r13 + 0x60) = _t1223;
				_t644 = E00000001140015DD0(1, _t971, _t1001, _t1223, __r13 + 0x90, _t1291, __r13 + 0x88, _t1308, _t1313);
				 *(_t1284 + 0x30) = _t644;
				if (_t644 == 0) goto 0x40013d7c;
				 *((long long*)( *((intOrPtr*)(_t1284 + 0x20)) + 0x20)) = "invalid literal/lengths set";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013648;
				r8d =  *(__r13 + 0x80);
				_t1245 = __r13 + 0x74;
				 *((long long*)(__r13 + 0x68)) =  *(__r13 + 0x88);
				 *_t1245 = 6;
				 *((long long*)(_t1286 + 0x28)) = _t1313;
				 *((long long*)(_t1286 + 0x20)) = _t1245;
				_t646 = E00000001140015DD0(2, _t971, _t1001,  *(__r13 + 0x88), 0x90 +  *(__r13 + 0x88) * 2 + __r13, _t1291, __r13 + 0x88, _t1308, _t1313);
				r12d = _t646;
				 *(_t1284 + 0x30) = _t646;
				if (_t646 == 0) goto 0x40013dd5;
				_t1226 = "invalid distances set";
				goto 0x40013d67;
				 *(__r13 + 8) = 0x3f47;
				if ( *((intOrPtr*)(_t1284 + 0x28)) == 6) goto 0x400144f5;
				_t1281 =  *((intOrPtr*)(_t1284 + 0x20));
				r10d =  *(_t1284 - 0x4c);
				r11d =  *(_t1284 + 0x38);
				r12d = 0;
				_t1292 = __r13 + 0x70;
				 *(__r13 + 8) = 0x3f48;
				if (_t991 - 6 < 0) goto 0x40013e73;
				if (r11d - 0x102 < 0) goto 0x40013e73;
				 *((long long*)(_t1281 + 0x10)) =  *(_t1284 - 0x40);
				 *(_t1281 + 0x18) = r11d;
				 *_t1281 =  &(_t1335[1]);
				 *((intOrPtr*)(_t1281 + 8)) = _t991;
				_t1246 = _t1281;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t754 + 0xfffffff9 - r9d;
				E00000001140016210(r10d, _t1226, _t1246, 0x90 +  *(__r13 + 0x88) * 2 + __r13,  *(_t1284 - 0x40), _t1308, _t1309);
				_t1303 =  *((intOrPtr*)(_t1281 + 0x10));
				r11d =  *(_t1281 + 0x18);
				_t1337 =  *_t1281;
				_t992 =  *((intOrPtr*)(_t1281 + 8));
				r15d =  *(__r13 + 0x48);
				_t756 =  *(__r13 + 0x4c);
				 *(_t1284 - 0x40) = _t1303;
				 *(_t1284 + 0x38) = r11d;
				if ( *(__r13 + 8) != 0x3f3f) goto 0x40013650;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013650;
				_t1310 =  *(__r13 + 0x60);
				 *(__r13 + 0x1be4) = r12d;
				_t1247 = _t1246 & _t1226;
				if (( *(_t1310 + _t1247 * 4) >> 0x00000008 & 0x000000ff) - _t756 <= 0) goto 0x40013ee2;
				if (_t992 == 0) goto 0x400144ee;
				_t757 = _t756 + 8;
				_t993 = _t992 - 1;
				r15d = r15d + (( *_t1337 & 0x000000ff) << _t756);
				_t1338 =  &(_t1337[1]);
				_t1248 = _t1247 & _t1226;
				_t657 =  *( *(__r13 + 0x60) + _t1248 * 4);
				if ((_t657 >> 0x00000008 & 0x000000ff) - _t757 > 0) goto 0x40013ea1;
				if (_t657 == 0) goto 0x40013fb0;
				if ((_t657 & 0x000000f0) != 0) goto 0x40013fb0;
				r10d = _t657;
				 *(_t1284 - 0x48) = _t657;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t657 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t657 >> 0x10);
				r11d =  *(_t1284 - 0x47) & 0x000000ff;
				r8d =  *(_t1310 + _t1303 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t757 <= 0) goto 0x40013fa0;
				r10d =  *(_t1284 - 0x46) & 0x0000ffff;
				if (_t993 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t1338 & 0x000000ff) << _t757);
				r8d = r8d << (_t657 & 0x000000ff) + r9d;
				_t758 = _t757 + 8;
				r8d = r8d - 1;
				_t994 = _t993 - 1;
				_t1339 =  &(_t1338[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t663 =  *( *(__r13 + 0x60) + _t1292 * 4);
				r8d = _t663 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t758 > 0) goto 0x40013f46;
				_t872 = r11b & 0xffffffff;
				r15d = r15d >> _t872;
				 *(__r13 + 0x1be4) = _t872;
				_t875 = _t663 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t875;
				r15d = r15d >> _t875;
				_t760 = _t758 - _t872 - _t875;
				 *(__r13 + 0x50) = _t663 >> 0x10;
				if (_t663 != 0) goto 0x40013fde;
				 *(__r13 + 8) = 0x3f4d;
				goto 0x40013648;
				if ((_t663 & 0x00000020) == 0) goto 0x40013ff2;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013640;
				if ((_t663 & 0x00000040) == 0) goto 0x4001400e;
				_t1229 = "invalid literal/length code";
				 *(_t1281 + 0x20) = _t1229;
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013648;
				 *(__r13 + 8) = 0x3f49;
				 *(__r13 + 0x58) = _t663 & 0xf;
				_t959 =  *(__r13 + 0x58);
				if (_t959 == 0) goto 0x4001406d;
				if (_t760 - _t959 >= 0) goto 0x4001404f;
				if (_t994 == 0) goto 0x400144ee;
				_t761 = _t760 + 8;
				_t995 = _t994 - 1;
				_t1340 =  &(_t1339[1]);
				r15d = r15d + (( *_t1339 & 0x000000ff) << _t760);
				if (_t761 - _t959 < 0) goto 0x40014030;
				_t881 = _t959;
				_t762 = _t761 - _t959;
				r15d = r15d >> _t881;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + ((0x00000001 << _t881) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t959;
				 *(__r13 + 8) = 0x3f4a;
				 *(__r13 + 0x1be8) =  *(__r13 + 0x50);
				_t1311 =  *((intOrPtr*)(__r13 + 0x68));
				_t1249 = _t1248 & _t1229;
				if (( *(_t1311 + _t1249 * 4) >> 0x00000008 & 0x000000ff) - _t762 <= 0) goto 0x400140f0;
				asm("o16 nop [eax+eax]");
				if (_t995 == 0) goto 0x400144ee;
				_t763 = _t762 + 8;
				_t996 = _t995 - 1;
				r15d = r15d + (( *_t1340 & 0x000000ff) << _t762);
				_t1341 =  &(_t1340[1]);
				_t1250 = _t1249 & _t1229;
				_t680 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t1250 * 4);
				if ((_t680 >> 0x00000008 & 0x000000ff) - _t763 > 0) goto 0x400140b0;
				if ((_t680 & 0x000000f0) != 0) goto 0x400141ba;
				r10d = _t680;
				 *(_t1284 - 0x48) = _t680;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t680 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t680 >> 0x10);
				r11d =  *(_t1284 - 0x47) & 0x000000ff;
				r8d =  *(_t1311 + _t1303 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t763 <= 0) goto 0x400141aa;
				r10d =  *(_t1284 - 0x46) & 0x0000ffff;
				if (_t996 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t1341 & 0x000000ff) << _t763);
				r8d = r8d << (_t680 & 0x000000ff) + r9d;
				_t764 = _t763 + 8;
				r8d = r8d - 1;
				_t997 = _t996 - 1;
				_t1342 =  &(_t1341[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t686 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t1292 * 4);
				r8d = _t686 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t764 > 0) goto 0x40014150;
				_t905 = r11b & 0xffffffff;
				r15d = r15d >> _t905;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t905;
				_t1304 =  *(_t1284 - 0x40);
				r11d =  *(_t1284 + 0x38);
				_t908 = _t686 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t908;
				r15d = r15d >> _t908;
				_t766 = _t764 - _t905 - _t908;
				if ((_t686 & 0x00000040) == 0) goto 0x400141f2;
				 *(_t1281 + 0x20) = "invalid distance code";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				r10d =  *(_t1284 - 0x4c);
				 *(__r13 + 8) = 0x3f4b;
				 *(__r13 + 0x54) = _t686 >> 0x10;
				 *(__r13 + 0x58) = _t686 & 0xf;
				_t961 =  *(__r13 + 0x58);
				if (_t961 == 0) goto 0x4001425d;
				if (_t766 - _t961 >= 0) goto 0x4001423f;
				if (_t997 == 0) goto 0x400144ee;
				_t767 = _t766 + 8;
				_t998 = _t997 - 1;
				_t1343 =  &(_t1342[1]);
				r15d = r15d + (( *_t1342 & 0x000000ff) << _t766);
				if (_t767 - _t961 < 0) goto 0x40014220;
				_t914 = _t961;
				_t768 = _t767 - _t961;
				r15d = r15d >> _t914;
				 *(__r13 + 0x54) =  *(__r13 + 0x54) + ((0x00000001 << _t914) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t961;
				 *(__r13 + 8) = 0x3f4c;
				if (r11d == 0) goto 0x400144ee;
				_t915 =  *(__r13 + 0x54);
				_t694 = r10d - r11d;
				if (_t915 - _t694 <= 0) goto 0x400142ca;
				_t916 = _t915 - _t694;
				if (_t916 -  *((intOrPtr*)(__r13 + 0x38)) <= 0) goto 0x400142a6;
				if ( *((intOrPtr*)(__r13 + 0x1be0)) == 0) goto 0x400142a6;
				 *(_t1281 + 0x20) = "invalid distance too far back";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				_t695 =  *((intOrPtr*)(__r13 + 0x3c));
				if (_t916 - _t695 <= 0) goto 0x400142b8;
				_t917 = _t916 - _t695;
				goto 0x400142bc;
				_t964 = _t695 - _t917;
				if (_t917 -  *(__r13 + 0x50) <= 0) goto 0x400142d6;
				goto 0x400142d4;
				_t698 =  *(__r13 + 0x50);
				_t918 = _t698;
				_t919 =  >  ? r11d : _t918;
				r11d = r11d - _t919;
				 *(_t1284 + 0x38) = r11d;
				 *(__r13 + 0x50) = _t698 - _t919;
				_t1305 = _t1304 + 1;
				 *((char*)(_t1305 - 1)) =  *(_t1304 - _t1250 - _t1304 + _t1304) & 0x000000ff;
				if (_t918 != r11d) goto 0x400142f0;
				 *(_t1284 - 0x40) = _t1305;
				if ( *(__r13 + 0x50) != _t919 - 1) goto 0x40013650;
				 *(__r13 + 8) = 0x3f48;
				if (r11d == 0) goto 0x400144ee;
				_t1306 = _t1305 + 1;
				r11d = r11d - 1;
				 *((char*)(_t1306 - 1)) =  *(__r13 + 0x50) & 0x000000ff;
				 *(_t1284 + 0x38) = r11d;
				 *(_t1284 - 0x40) = _t1306;
				 *(__r13 + 8) = 0x3f48;
				goto 0x40013650;
				if ( *((intOrPtr*)(_t1284 + 0x10)) == 0) goto 0x40014420;
				if (_t768 - 0x20 >= 0) goto 0x40014378;
				if (_t998 == 0) goto 0x400144ee;
				_t999 = _t998 - 1;
				_t1344 =  &(_t1343[1]);
				r15d = r15d + (( *_t1343 & 0x000000ff) << _t768);
				if (_t768 + 8 - 0x20 < 0) goto 0x40014358;
				r10d = r10d - r11d;
				 *((intOrPtr*)(_t1281 + 0x1c)) =  *((intOrPtr*)(_t1281 + 0x1c)) + r10d;
				 *((intOrPtr*)(__r13 + 0x24)) =  *((intOrPtr*)(__r13 + 0x24)) + r10d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400143c1;
				if (r10d == 0) goto 0x400143c1;
				r8d = r10d;
				if ( *(__r13 + 0x18) == 0) goto 0x400143ad;
				_t705 = E00000001140015160(_t1306 - "invalid distance too far back");
				goto 0x400143b2;
				_t706 = E00000001140015A00(_t705,  *(__r13 + 0x20), _t964, _t1236, _t1292);
				r11d =  *(_t1284 + 0x38);
				 *(__r13 + 0x20) = _t706;
				 *(_t1281 + 0x4c) = _t706;
				 *(_t1284 - 0x4c) = r11d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x4001441a;
				if ( *(__r13 + 0x18) != 0) goto 0x400143fc;
				if (((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + (r15d >> 0x00000008 & 0x0000ff00) + (r15d >> 0x18) ==  *(__r13 + 0x20)) goto 0x4001441a;
				 *(_t1281 + 0x20) = "incorrect data check";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t770 = r12d;
				 *(__r13 + 8) = 0x3f4f;
				if ( *(__r13 + 0x10) == 0) goto 0x400144c7;
				if ( *(__r13 + 0x18) == 0) goto 0x400144c7;
				if (_t770 - 0x20 >= 0) goto 0x40014463;
				if (_t999 == 0) goto 0x400144ee;
				_t771 = _t770 + 8;
				r15d = r15d + (( *_t1344 & 0x000000ff) << _t770);
				if (_t771 - 0x20 < 0) goto 0x40014443;
				if (r15d ==  *((intOrPtr*)(__r13 + 0x24))) goto 0x400144c1;
				 *(_t1281 + 0x20) = "incorrect length check";
				 *(__r13 + 8) = 0x3f51;
				goto 0x40013650;
				 *((long long*)(_t1281 + 0x10)) =  *(_t1284 - 0x40);
				 *(_t1281 + 0x18) = r11d;
				 *_t1281 =  &(_t1344[1]);
				 *((intOrPtr*)(_t1281 + 8)) = _t999 - 1;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t771;
				return 2;
			}









































































































































































































    0x140012fdd
    0x140012fdd
    0x140012fe3
    0x140012fe5
    0x140012fed
    0x140012ff5
    0x140012ff9
    0x14001300a
    0x14001300c
    0x14001300f
    0x140013015
    0x14001301a
    0x140013023
    0x14001302a
    0x14001302c
    0x140013034
    0x14001303b
    0x140013044
    0x14001304a
    0x14001304e
    0x140013058
    0x14001305d
    0x140013063
    0x140013067
    0x14001306f
    0x140013074
    0x140013078
    0x14001307f
    0x140013081
    0x14001308d
    0x1400130b9
    0x1400130c6
    0x1400130cf
    0x1400130d3
    0x1400130db
    0x1400130e0
    0x1400130ed
    0x1400130f5
    0x1400130f7
    0x1400130fe
    0x140013104
    0x14001310b
    0x140013114
    0x140013118
    0x14001311d
    0x140013121
    0x140013124
    0x140013128
    0x14001312b
    0x14001312f
    0x140013132
    0x140013139
    0x14001313d
    0x140013140
    0x14001314c
    0x140013150
    0x140013158
    0x140013164
    0x140013168
    0x140013178
    0x14001317a
    0x140013182
    0x140013193
    0x140013195
    0x140013198
    0x14001319e
    0x1400131a0
    0x1400131a8
    0x1400131b5
    0x1400131be
    0x1400131c2
    0x1400131ca
    0x1400131cf
    0x1400131d6
    0x1400131e1
    0x1400131eb
    0x1400131f2
    0x1400131f4
    0x1400131f8
    0x140013200
    0x140013208
    0x140013213
    0x140013217
    0x14001321a
    0x14001321d
    0x14001322a
    0x140013232
    0x140013243
    0x140013245
    0x140013248
    0x14001324e
    0x140013250
    0x140013257
    0x140013259
    0x140013265
    0x14001326c
    0x140013271
    0x14001327c
    0x140013282
    0x140013288
    0x14001328f
    0x140013293
    0x14001329f
    0x1400132a3
    0x1400132a6
    0x1400132a9
    0x1400132b6
    0x1400132ba
    0x1400132cb
    0x1400132cd
    0x1400132d0
    0x1400132d6
    0x1400132d8
    0x1400132df
    0x1400132e5
    0x1400132f2
    0x1400132fd
    0x140013304
    0x140013306
    0x14001330a
    0x140013312
    0x14001331a
    0x140013325
    0x140013329
    0x14001332c
    0x14001332f
    0x14001333f
    0x140013344
    0x140013348
    0x140013359
    0x14001335b
    0x14001335e
    0x140013364
    0x140013366
    0x14001336a
    0x140013371
    0x140013373
    0x14001337f
    0x140013386
    0x140013388
    0x14001338c
    0x140013390
    0x140013394
    0x14001339c
    0x1400133a7
    0x1400133ab
    0x1400133ae
    0x1400133b1
    0x1400133b3
    0x1400133ba
    0x1400133bc
    0x1400133c0
    0x1400133d0
    0x1400133de
    0x1400133e3
    0x1400133e5
    0x1400133ec
    0x1400133ee
    0x1400133f5
    0x140013404
    0x140013408
    0x14001340c
    0x140013414
    0x140013417
    0x140013424
    0x14001342b
    0x140013431
    0x14001343c
    0x140013442
    0x140013444
    0x140013447
    0x140013450
    0x140013456
    0x14001345a
    0x14001346a
    0x140013472
    0x140013482
    0x140013484
    0x140013489
    0x140013490
    0x140013492
    0x140013499
    0x1400134a2
    0x1400134a4
    0x1400134a8
    0x1400134af
    0x1400134b3
    0x1400134bd
    0x1400134c4
    0x1400134ca
    0x1400134d5
    0x1400134db
    0x1400134dd
    0x1400134e3
    0x1400134e9
    0x1400134ec
    0x1400134ee
    0x1400134f5
    0x1400134f7
    0x1400134fb
    0x1400134ff
    0x14001350f
    0x140013513
    0x140013522
    0x140013524
    0x140013529
    0x140013530
    0x140013532
    0x140013539
    0x140013542
    0x140013544
    0x140013548
    0x14001354f
    0x140013553
    0x14001355d
    0x140013564
    0x14001356a
    0x140013575
    0x14001357b
    0x14001357d
    0x140013583
    0x140013589
    0x14001358c
    0x14001358e
    0x140013595
    0x140013597
    0x14001359b
    0x1400135a3
    0x1400135a7
    0x1400135b7
    0x1400135bc
    0x1400135c2
    0x1400135d3
    0x1400135d5
    0x1400135d8
    0x1400135de
    0x1400135e5
    0x1400135ef
    0x1400135f8
    0x1400135fc
    0x140013604
    0x140013606
    0x140013609
    0x14001360c
    0x140013613
    0x14001361f
    0x140013626
    0x14001362d
    0x140013634
    0x140013639
    0x14001363d
    0x140013640
    0x140013648
    0x14001365c
    0x140013662
    0x140013666
    0x140013671
    0x140013675
    0x140013686
    0x140013688
    0x14001368b
    0x140013691
    0x140013699
    0x1400136aa
    0x1400136bb
    0x1400136be
    0x1400136c1
    0x1400136c5
    0x1400136c8
    0x1400136d5
    0x1400136db
    0x1400136e2
    0x1400136e7
    0x1400136eb
    0x1400136ef
    0x1400136f3
    0x1400136f6
    0x1400136fa
    0x14001370f
    0x14001371a
    0x14001371e
    0x140013726
    0x140013729
    0x14001372c
    0x14001372e
    0x140013736
    0x14001373a
    0x140013746
    0x14001374b
    0x14001374d
    0x140013750
    0x140013753
    0x140013756
    0x14001375b
    0x140013763
    0x14001376d
    0x140013771
    0x140013775
    0x140013779
    0x140013782
    0x140013789
    0x14001378d
    0x140013795
    0x14001379a
    0x14001379e
    0x1400137a9
    0x1400137b8
    0x1400137bf
    0x1400137ca
    0x1400137d0
    0x1400137d8
    0x1400137df
    0x1400137e1
    0x1400137e8
    0x1400137ed
    0x1400137f5
    0x1400137f9
    0x140013803
    0x140013806
    0x140013808
    0x14001380e
    0x140013812
    0x140013823
    0x140013828
    0x14001382e
    0x140013833
    0x14001383e
    0x140013840
    0x140013847
    0x14001384b
    0x140013853
    0x140013858
    0x14001385f
    0x140013862
    0x140013865
    0x140013870
    0x140013876
    0x14001387e
    0x140013885
    0x14001388a
    0x140013891
    0x140013898
    0x14001389e
    0x1400138a4
    0x1400138a7
    0x1400138aa
    0x1400138af
    0x1400138b7
    0x1400138ba
    0x1400138c0
    0x1400138c4
    0x1400138c7
    0x1400138cb
    0x1400138cf
    0x1400138d3
    0x1400138d8
    0x1400138e8
    0x1400138ea
    0x1400138f2
    0x1400138fe
    0x140013903
    0x140013905
    0x140013908
    0x14001390e
    0x140013913
    0x140013917
    0x14001391d
    0x14001392a
    0x140013933
    0x140013935
    0x14001393c
    0x140013940
    0x140013947
    0x140013951
    0x14001395a
    0x140013960
    0x140013967
    0x140013981
    0x140013986
    0x14001398a
    0x140013996
    0x14001399b
    0x14001399d
    0x1400139a0
    0x1400139a6
    0x1400139b3
    0x1400139c2
    0x1400139c6
    0x1400139cf
    0x1400139e1
    0x1400139eb
    0x1400139ff
    0x140013a08
    0x140013a17
    0x140013a19
    0x140013a20
    0x140013a29
    0x140013a2c
    0x140013a37
    0x140013a3c
    0x140013a43
    0x140013a48
    0x140013a48
    0x140013a4c
    0x140013a53
    0x140013a58
    0x140013a5c
    0x140013a61
    0x140013a6a
    0x140013a6e
    0x140013a76
    0x140013a7b
    0x140013a82
    0x140013a86
    0x140013a8e
    0x140013a93
    0x140013a9a
    0x140013aad
    0x140013abb
    0x140013ac5
    0x140013ae0
    0x140013ae3
    0x140013ae7
    0x140013aec
    0x140013af7
    0x140013b02
    0x140013b0e
    0x140013b16
    0x140013b18
    0x140013b20
    0x140013b2e
    0x140013b32
    0x140013b37
    0x140013b42
    0x140013b46
    0x140013b49
    0x140013b4d
    0x140013b52
    0x140013b58
    0x140013b61
    0x140013b64
    0x140013b66
    0x140013b6d
    0x140013b72
    0x140013b7a
    0x140013b7f
    0x140013b83
    0x140013b8f
    0x140013b94
    0x140013b96
    0x140013b99
    0x140013b9e
    0x140013ba0
    0x140013ba4
    0x140013bac
    0x140013bb9
    0x140013bbd
    0x140013bcc
    0x140013bcf
    0x140013bd9
    0x140013bde
    0x140013be0
    0x140013be6
    0x140013bea
    0x140013bf6
    0x140013bfb
    0x140013bfd
    0x140013c00
    0x140013c05
    0x140013c0f
    0x140013c1b
    0x140013c1f
    0x140013c21
    0x140013c27
    0x140013c32
    0x140013c3e
    0x140013c43
    0x140013c48
    0x140013c4d
    0x140013c57
    0x140013c63
    0x140013c6a
    0x140013c80
    0x140013c82
    0x140013c84
    0x140013c86
    0x140013c97
    0x140013ca0
    0x140013ca9
    0x140013cab
    0x140013cb6
    0x140013cc4
    0x140013cd2
    0x140013ce1
    0x140013cea
    0x140013cee
    0x140013cf6
    0x140013d02
    0x140013d06
    0x140013d0e
    0x140013d13
    0x140013d1a
    0x140013d21
    0x140013d28
    0x140013d2d
    0x140013d32
    0x140013d49
    0x140013d50
    0x140013d54
    0x140013d59
    0x140013d5e
    0x140013d6b
    0x140013d6f
    0x140013d77
    0x140013d83
    0x140013d8a
    0x140013d8e
    0x140013d96
    0x140013da4
    0x140013da9
    0x140013dbd
    0x140013dc2
    0x140013dc5
    0x140013dca
    0x140013dcc
    0x140013dd3
    0x140013dd8
    0x140013de3
    0x140013de9
    0x140013df1
    0x140013df5
    0x140013df9
    0x140013dfc
    0x140013e00
    0x140013e0b
    0x140013e14
    0x140013e16
    0x140013e1a
    0x140013e1e
    0x140013e21
    0x140013e27
    0x140013e2a
    0x140013e2e
    0x140013e32
    0x140013e3f
    0x140013e43
    0x140013e47
    0x140013e4a
    0x140013e4d
    0x140013e51
    0x140013e55
    0x140013e59
    0x140013e5d
    0x140013e63
    0x140013e6e
    0x140013e76
    0x140013e81
    0x140013e8e
    0x140013e9f
    0x140013ea3
    0x140013eaf
    0x140013eb7
    0x140013eb9
    0x140013ec1
    0x140013ecc
    0x140013ed3
    0x140013ee0
    0x140013ee4
    0x140013eec
    0x140013ef2
    0x140013ef8
    0x140013efb
    0x140013eff
    0x140013f07
    0x140013f11
    0x140013f17
    0x140013f1a
    0x140013f1d
    0x140013f20
    0x140013f27
    0x140013f31
    0x140013f39
    0x140013f3f
    0x140013f41
    0x140013f48
    0x140013f54
    0x140013f5a
    0x140013f66
    0x140013f6d
    0x140013f73
    0x140013f76
    0x140013f79
    0x140013f7b
    0x140013f7e
    0x140013f81
    0x140013f84
    0x140013f8b
    0x140013f94
    0x140013f98
    0x140013f9e
    0x140013fa0
    0x140013fa4
    0x140013fa9
    0x140013fb5
    0x140013fb8
    0x140013fbf
    0x140013fc2
    0x140013fc9
    0x140013fcf
    0x140013fd1
    0x140013fd9
    0x140013fe0
    0x140013fe2
    0x140013fed
    0x140013ff4
    0x140013ff6
    0x140013ffd
    0x140014001
    0x140014009
    0x140014011
    0x14001401c
    0x140014020
    0x140014026
    0x14001402a
    0x140014032
    0x14001403e
    0x140014043
    0x140014045
    0x140014048
    0x14001404d
    0x14001404f
    0x140014056
    0x14001405f
    0x140014062
    0x140014066
    0x140014071
    0x14001407d
    0x140014086
    0x140014097
    0x1400140a8
    0x1400140aa
    0x1400140b2
    0x1400140be
    0x1400140c5
    0x1400140c7
    0x1400140cf
    0x1400140da
    0x1400140e1
    0x1400140ee
    0x1400140f2
    0x1400140f8
    0x1400140fe
    0x140014101
    0x140014105
    0x14001410d
    0x140014117
    0x14001411d
    0x140014120
    0x140014123
    0x140014126
    0x14001412d
    0x140014137
    0x14001413f
    0x140014145
    0x140014147
    0x140014152
    0x14001415e
    0x140014164
    0x140014170
    0x140014177
    0x14001417d
    0x140014180
    0x140014183
    0x140014185
    0x140014188
    0x14001418b
    0x14001418e
    0x140014195
    0x14001419e
    0x1400141a2
    0x1400141a8
    0x1400141aa
    0x1400141ae
    0x1400141b3
    0x1400141ba
    0x1400141be
    0x1400141c7
    0x1400141ca
    0x1400141d1
    0x1400141d4
    0x1400141d8
    0x1400141e1
    0x1400141e5
    0x1400141ed
    0x1400141f2
    0x1400141f8
    0x140014203
    0x14001420d
    0x140014211
    0x140014217
    0x14001421b
    0x140014222
    0x14001422e
    0x140014233
    0x140014235
    0x140014238
    0x14001423d
    0x14001423f
    0x140014246
    0x14001424f
    0x140014252
    0x140014256
    0x14001425d
    0x140014268
    0x14001426e
    0x140014275
    0x14001427a
    0x14001427c
    0x140014282
    0x14001428c
    0x140014295
    0x140014299
    0x1400142a1
    0x1400142a6
    0x1400142ac
    0x1400142b2
    0x1400142b6
    0x1400142ba
    0x1400142c6
    0x1400142c8
    0x1400142ca
    0x1400142d4
    0x1400142d9
    0x1400142dd
    0x1400142e5
    0x1400142e9
    0x1400142f5
    0x1400142f8
    0x1400142fe
    0x140014300
    0x140014308
    0x14001430e
    0x14001431e
    0x140014329
    0x14001432c
    0x14001432f
    0x140014333
    0x140014337
    0x14001433b
    0x140014343
    0x14001434d
    0x140014356
    0x14001435a
    0x14001436b
    0x14001436d
    0x140014370
    0x140014376
    0x140014378
    0x14001437b
    0x14001437f
    0x140014388
    0x14001438d
    0x1400143a1
    0x1400143a4
    0x1400143a6
    0x1400143ab
    0x1400143ad
    0x1400143b6
    0x1400143ba
    0x1400143be
    0x1400143c6
    0x1400143ca
    0x1400143d4
    0x140014400
    0x140014409
    0x14001440d
    0x140014415
    0x14001441a
    0x14001441d
    0x140014420
    0x14001442d
    0x140014438
    0x140014441
    0x140014445
    0x140014451
    0x14001445b
    0x140014461
    0x140014467
    0x140014470
    0x140014474
    0x14001447c
    0x140014481
    0x140014485
    0x140014489
    0x14001448c
    0x140014494
    0x140014498
    0x1400144c0

    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID: incorrect header check$invalid window size$unknown compression method
    • API String ID: 0-1186847913
    • Opcode ID: e5d9ef9cb6cfd683bb0b87efb43f2fbb65f2835d92bd1581f31df26c1c39ce5d
    • Instruction ID: c7f0437dc46e56fef3014f932af091831cb3ca76e565b5a088b3fef6b265a946
    • Opcode Fuzzy Hash: e5d9ef9cb6cfd683bb0b87efb43f2fbb65f2835d92bd1581f31df26c1c39ce5d
    • Instruction Fuzzy Hash: 9391A2726106949BFBA6CF26C584B9E3BA9F70C794F114229EB464BBE1C736D950CB00
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014001366E Relevance: 3.9, Strings: 3, Instructions: 166COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 46%
    			E0000000114001366E(signed int __ebx, void* __esi, void* __rdi, void* __r10, void* __r13, signed char* __r14) {
				intOrPtr _t327;
				intOrPtr _t328;
				signed int _t359;
				unsigned int _t365;
				unsigned int _t371;
				signed int _t390;
				signed int _t392;
				signed int _t403;
				signed char _t409;
				signed int _t426;
				signed char _t432;
				void* _t440;
				intOrPtr _t441;
				signed char _t444;
				void* _t451;
				intOrPtr _t452;
				signed int _t465;
				signed int _t466;
				void* _t467;
				signed int _t472;
				signed int _t473;
				signed int _t475;
				void* _t476;
				signed int _t477;
				void* _t478;
				signed int _t479;
				void* _t480;
				signed int _t481;
				void* _t482;
				signed int _t484;
				signed int _t485;
				void* _t486;
				signed int _t488;
				signed int _t489;
				void* _t490;
				signed int _t492;
				void* _t493;
				signed int _t494;
				signed int _t495;
				void* _t496;
				signed int _t498;
				void* _t499;
				signed int _t500;
				signed int _t502;
				signed int _t503;
				signed char _t511;
				signed char _t515;
				signed int _t517;
				signed int _t522;
				signed char _t538;
				signed char _t540;
				signed char _t572;
				signed char _t575;
				signed char _t581;
				signed char _t605;
				signed char _t608;
				signed char _t614;
				unsigned int _t615;
				void* _t616;
				void* _t617;
				signed char _t618;
				void* _t619;
				signed int _t633;
				unsigned int _t635;
				void* _t637;
				signed int* _t641;
				signed int* _t645;
				signed char _t652;
				signed char _t654;
				void* _t657;
				signed int _t658;
				void* _t660;
				void* _t661;
				void* _t662;
				void* _t663;
				void* _t664;
				void* _t665;
				void* _t666;
				void* _t667;
				void* _t668;
				intOrPtr _t669;
				intOrPtr _t670;
				void* _t671;
				void* _t672;
				void* _t673;
				void* _t674;
				void* _t675;
				void* _t676;
				void* _t677;
				void* _t679;
				void* _t688;
				void* _t716;
				void* _t729;
				signed long long _t795;
				signed int _t796;
				signed long long _t799;
				signed long long _t800;
				signed long long _t801;
				signed int _t804;
				signed long long _t807;
				signed long long _t810;
				void* _t817;
				signed long long _t819;
				signed long long _t820;
				long long _t822;
				signed long long _t823;
				signed long long _t824;
				signed long long _t825;
				signed long long _t826;
				signed long long _t827;
				void* _t831;
				intOrPtr _t843;
				signed long long _t845;
				void* _t848;
				void* _t850;
				void* _t852;
				long long _t853;
				long long _t855;
				signed long long _t856;
				signed long long _t857;
				signed int* _t860;
				signed long long _t864;
				signed long long _t865;
				signed long long _t866;
				signed long long _t867;
				void* _t869;
				void* _t870;
				signed int _t871;
				intOrPtr _t872;
				void* _t873;
				long long _t874;
				signed char* _t879;
				signed char* _t880;
				signed char* _t882;
				signed char* _t883;
				signed char* _t884;
				signed char* _t885;
				signed char* _t886;
				signed char* _t887;
				signed char* _t889;
				signed char* _t890;
				signed char* _t891;
				signed char* _t892;
				signed char* _t893;
				signed char* _t894;
				signed char* _t895;
				signed char* _t896;

				_t869 = __r10;
				if (__ebx - 0x20 >= 0) goto 0x40013693;
				if (__esi == 0) goto 0x400144ee;
				_t660 = __esi - 1;
				_t879 =  &(__r14[1]);
				r15d = r15d + (( *__r14 & 0x000000ff) << __ebx);
				if (__ebx + 8 - 0x20 < 0) goto 0x40013673;
				_t465 = r12d;
				r15d = r15d >> 0x18;
				_t327 = (r15d >> 0x00000008 & 0x0000ff00) + ((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + r15d;
				r15d = r12d;
				 *((intOrPtr*)(__r13 + 0x20)) = _t327;
				 *((intOrPtr*)(__rdi + 0x4c)) = _t327;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3e;
				if ( *((intOrPtr*)(__r13 + 0x14)) == 0) goto 0x40014481;
				r8d = 0;
				_t328 = E00000001140015A00(_t327, 0, 0, _t817, _t852);
				_t857 =  *(_t848 - 0x40);
				r11d =  *(_t848 + 0x38);
				 *((intOrPtr*)(__r13 + 0x20)) = _t328;
				 *((intOrPtr*)(__rdi + 0x4c)) = _t328;
				_t853 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				if ( *((intOrPtr*)(_t848 + 0x28)) + 0xfffffffb - 1 <= 0) goto 0x400144ee;
				if ( *(__r13 + 0xc) == 0) goto 0x40013733;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4e;
				_t511 = _t465 & 0x00000007;
				r15d = r15d >> _t511;
				_t466 = _t465 - _t511;
				goto 0x40013650;
				if (_t466 - 3 >= 0) goto 0x40013758;
				if (_t660 == 0) goto 0x400144ee;
				_t467 = _t466 + 8;
				_t661 = _t660 - 1;
				_t880 =  &(_t879[1]);
				r15d = r15d + (( *_t879 & 0x000000ff) << _t466);
				_t688 = _t467 - 3;
				if (_t688 < 0) goto 0x40013738;
				r15d = r15d >> 1;
				 *(__r13 + 0xc) = r15d & 0x00000001;
				if (_t688 == 0) goto 0x400137ed;
				if (_t688 == 0) goto 0x400137ae;
				if (_t688 == 0) goto 0x4001379a;
				if (_t688 != 0) goto 0x400137f5;
				r15d = r15d >> 2;
				 *(__rdi + 0x20) = "invalid block type";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r15d >> 2;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f44;
				goto 0x40013650;
				 *_t853 = 9;
				 *(__r13 + 0x60) = 0x40019e70;
				 *((intOrPtr*)(__r13 + 0x74)) = 5;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				 *((long long*)(__r13 + 0x68)) = 0x4001a670;
				if ( *((intOrPtr*)(_t848 + 0x28)) != 6) goto 0x400137f5;
				r15d = r15d >> 2;
				goto 0x400144f1;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f41;
				r15d = r15d >> 2;
				_t472 = _t467 - 1 + 0x3fffffff8;
				_t515 = _t472 & 0x00000007;
				_t473 = _t472 - _t515;
				r15d = r15d >> _t515;
				if (_t473 - 0x20 >= 0) goto 0x40013830;
				if (_t661 == 0) goto 0x400144ee;
				_t662 = _t661 - 1;
				r15d = r15d + (( *_t880 & 0x000000ff) << _t473);
				if (_t473 + 8 - 0x20 < 0) goto 0x40013810;
				_t517 = r15w & 0xffffffff;
				if (_t517 ==  !r15d >> 0x10) goto 0x40013858;
				_t795 = "invalid stored block lengths";
				 *(__rdi + 0x20) = _t795;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x50) = _t517;
				r15d = r12d;
				_t475 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f42;
				if ( *((intOrPtr*)(_t848 + 0x28)) == 6) goto 0x400144f1;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f43;
				r12d =  *(__r13 + 0x50);
				if (r12d == 0) goto 0x400138d8;
				r12d =  >  ? _t662 : r12d;
				r12d =  >  ? r11d : r12d;
				if (r12d == 0) goto 0x400144ee;
				r8d = r12d;
				_t819 = _t857;
				_t658 = r12d;
				memcpy(??, ??, ??);
				r11d =  *(_t848 + 0x38);
				r11d = r11d - r12d;
				_t882 =  &(( &(_t880[1]))[__rdi]);
				_t843 =  *((intOrPtr*)(_t848 + 0x20));
				_t663 = _t662 - r12d;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - r12d;
				 *(_t848 + 0x38) = r11d;
				 *(_t848 - 0x40) =  *(_t848 - 0x40) + __rdi;
				goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				if (_t475 - 0xe >= 0) goto 0x40013910;
				asm("o16 nop [eax+eax]");
				if (_t663 == 0) goto 0x400144ee;
				_t476 = _t475 + 8;
				_t664 = _t663 - 1;
				_t883 =  &(_t882[1]);
				r15d = r15d + (( *_t882 & 0x000000ff) << _t475);
				if (_t476 - 0xe < 0) goto 0x400138f0;
				r15d = r15d >> 5;
				_t477 = _t476 + 0xfffffff2;
				r15d = r15d >> 5;
				_t522 = (r15d & 0x0000001f) + 0x101;
				_t633 = (r15d & 0x0000001f) + 1;
				r15d = r15d >> 4;
				 *(__r13 + 0x7c) = _t522;
				 *(__r13 + 0x80) = _t633;
				 *((intOrPtr*)(__r13 + 0x78)) = (r15d & 0x0000000f) + 4;
				if (_t522 - 0x11e > 0) goto 0x40013a7b;
				if (_t633 - 0x1e > 0) goto 0x40013a7b;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f45;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) >= 0) goto 0x400139e3;
				if (_t477 - 3 >= 0) goto 0x400139a8;
				if (_t664 == 0) goto 0x400144ee;
				_t478 = _t477 + 8;
				_t665 = _t664 - 1;
				_t884 =  &(_t883[1]);
				r15d = r15d + (( *_t883 & 0x000000ff) << _t477);
				if (_t478 - 3 < 0) goto 0x40013988;
				_t479 = _t478 + 0xfffffffd;
				r15d = r15d >> 3;
				 *(__r13 + 0x90 + _t795 * 2) = r15w & 7;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) < 0) goto 0x40013983;
				if ( *(__r13 + 0x84) - 0x13 >= 0) goto 0x40013a19;
				 *(__r13 + 0x90 + _t795 * 2) = r12w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) - 0x13 < 0) goto 0x400139f0;
				_t796 = __r13 + 0x550;
				_t860 = __r13 + 0x88;
				 *_t860 = _t796;
				 *(__r13 + 0x60) = _t796;
				 *((long long*)(_t850 + 0x28)) = __r13 + 0x310;
				 *_t853 = 7;
				 *((long long*)(_t850 + 0x20)) = _t853;
				_t75 = _t819 + 0x13; // 0x13
				r8d = _t75;
				_t831 = __r13 + 0x90;
				_t359 = E00000001140015DD0(0, _t658, _t679, __r13 + 0x310, _t831, _t853, _t860, _t869, _t873);
				r11d =  *(_t848 + 0x38);
				 *(_t848 + 0x30) = _t359;
				if (_t359 == 0) goto 0x40013a93;
				 *(_t843 + 0x20) = "invalid code lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t799 = "too many length or distance symbols";
				 *(_t843 + 0x20) = _t799;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f46;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) >= 0) goto 0x40013cca;
				asm("o16 nop [eax+eax]");
				_t820 = _t819 & _t799;
				_t800 =  *(__r13 + 0x60);
				_t365 =  *(_t800 + _t820 * 4);
				 *(_t848 - 0x48) = _t365;
				if ((_t365 >> 0x00000008 & 0x000000ff) - _t479 <= 0) goto 0x40013b44;
				if (_t665 == 0) goto 0x400144ee;
				_t480 = _t479 + 8;
				_t666 = _t665 - 1;
				r15d = r15d + (( *_t884 & 0x000000ff) << _t479);
				_t885 =  &(_t884[1]);
				_t801 =  *(__r13 + 0x60);
				_t371 =  *(_t801 + (_t820 & _t800) * 4);
				 *(_t848 - 0x48) = _t371;
				if ((_t371 >> 0x00000008 & 0x000000ff) - _t480 > 0) goto 0x40013b00;
				_t635 = _t371 >> 0x10;
				_t716 = _t635 - 0x10;
				if (_t716 >= 0) goto 0x40013b72;
				_t538 = _t371 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x90 + _t801 * 2) = _t635;
				r15d = r15d >> _t538;
				_t481 = _t480 - _t538;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				goto 0x40013caf;
				if (_t716 != 0) goto 0x40013bd4;
				_t637 = (r10d >> 0x00000008 & 0x000000ff) + 2;
				if (_t481 - _t637 >= 0) goto 0x40013ba0;
				if (_t666 == 0) goto 0x400144ee;
				_t482 = _t481 + 8;
				_t667 = _t666 - 1;
				_t886 =  &(_t885[1]);
				r15d = r15d + (( *_t885 & 0x000000ff) << _t481);
				if (_t482 - _t637 < 0) goto 0x40013b81;
				_t540 =  *(_t848 - 0x47) & 0x000000ff;
				r15d = r15d >> _t540;
				if (r10d == 0) goto 0x40013cfb;
				r15d = r15d >> 2;
				r8d =  *(__r13 + 0x90 + _t801 * 2) & 0x0000ffff;
				_t484 = _t482 - _t540 + 0xfffffffe;
				goto 0x40013c6f;
				r9d =  *(_t848 - 0x47) & 0x000000ff;
				if ( *(_t848 - 0x46) != 0x11) goto 0x40013c21;
				_t641 =  &(_t860[0]);
				if (_t484 - _t641 >= 0) goto 0x40013c07;
				if (_t667 == 0) goto 0x400144ee;
				_t485 = _t484 + 8;
				_t668 = _t667 - 1;
				_t887 =  &(_t886[1]);
				r15d = r15d + (( *_t886 & 0x000000ff) << _t484);
				if (_t485 - _t641 < 0) goto 0x40013be8;
				r15d = r15d >> r9d;
				r15d = r15d >> 3;
				goto 0x40013c67;
				_t645 =  &(_t860[1]);
				if (_t485 - _t645 >= 0) goto 0x40013c4f;
				if (_t668 == 0) goto 0x400144ee;
				_t486 = _t485 + 8;
				_t669 = _t668 - 1;
				r15d = r15d + (( *_t887 & 0x000000ff) << _t485);
				if (_t486 - _t645 < 0) goto 0x40013c30;
				r15d = r15d >> r9d;
				r15d = r15d >> 7;
				r8d = r12d;
				if (_t869 + _t831 -  *(__r13 + 0x80) +  *(__r13 + 0x7c) > 0) goto 0x40013cfb;
				_t729 = (r15d & 0x0000007f) + 0xb;
				if (_t729 == 0) goto 0x40013cab;
				asm("o16 nop [eax+eax]");
				 *(__r13 + 0x90 + _t801 * 2) = r8w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if (_t729 != 0) goto 0x40013c90;
				_t855 = __r13 + 0x70;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) < 0) goto 0x40013ad0;
				if ( *((intOrPtr*)(__r13 + 8)) == 0x3f51) goto 0x4001364c;
				if ( *((short*)(__r13 + 0x290)) != 0) goto 0x40013d13;
				 *(_t843 + 0x20) = "invalid code -- missing end-of-block";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				 *(_t843 + 0x20) = "invalid bit length repeat";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t804 = __r13 + 0x550;
				 *_t855 = 9;
				_t874 = __r13 + 0x310;
				 *((long long*)(_t850 + 0x28)) = _t874;
				 *((long long*)(_t850 + 0x20)) = _t855;
				r8d =  *(__r13 + 0x7c);
				 *(__r13 + 0x88) = _t804;
				 *(__r13 + 0x60) = _t804;
				_t390 = E00000001140015DD0(1, _t658, _t679, _t804, __r13 + 0x90, _t855, __r13 + 0x88, _t869, _t874);
				 *(_t848 + 0x30) = _t390;
				if (_t390 == 0) goto 0x40013d7c;
				 *((long long*)( *((intOrPtr*)(_t848 + 0x20)) + 0x20)) = "invalid literal/lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				r8d =  *(__r13 + 0x80);
				_t822 = __r13 + 0x74;
				 *((long long*)(__r13 + 0x68)) =  *(__r13 + 0x88);
				 *_t822 = 6;
				 *((long long*)(_t850 + 0x28)) = _t874;
				 *((long long*)(_t850 + 0x20)) = _t822;
				_t392 = E00000001140015DD0(2, _t658, _t679,  *(__r13 + 0x88), 0x90 +  *(__r13 + 0x88) * 2 + __r13, _t855, __r13 + 0x88, _t869, _t874);
				r12d = _t392;
				 *(_t848 + 0x30) = _t392;
				if (_t392 == 0) goto 0x40013dd5;
				_t807 = "invalid distances set";
				goto 0x40013d67;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				if ( *((intOrPtr*)(_t848 + 0x28)) == 6) goto 0x400144f5;
				_t845 =  *((intOrPtr*)(_t848 + 0x20));
				r10d =  *(_t848 - 0x4c);
				r11d =  *(_t848 + 0x38);
				r12d = 0;
				_t856 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (_t669 - 6 < 0) goto 0x40013e73;
				if (r11d - 0x102 < 0) goto 0x40013e73;
				 *((long long*)(_t845 + 0x10)) =  *(_t848 - 0x40);
				 *(_t845 + 0x18) = r11d;
				 *_t845 =  &(_t887[1]);
				 *((intOrPtr*)(_t845 + 8)) = _t669;
				_t823 = _t845;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t486 + 0xfffffff9 - r9d;
				E00000001140016210(r10d, _t807, _t823, 0x90 +  *(__r13 + 0x88) * 2 + __r13,  *(_t848 - 0x40), _t869, _t870);
				_t864 =  *((intOrPtr*)(_t845 + 0x10));
				r11d =  *(_t845 + 0x18);
				_t889 =  *_t845;
				_t670 =  *((intOrPtr*)(_t845 + 8));
				r15d =  *(__r13 + 0x48);
				_t488 =  *(__r13 + 0x4c);
				 *(_t848 - 0x40) = _t864;
				 *(_t848 + 0x38) = r11d;
				if ( *((intOrPtr*)(__r13 + 8)) != 0x3f3f) goto 0x40013650;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013650;
				_t871 =  *(__r13 + 0x60);
				 *(__r13 + 0x1be4) = r12d;
				_t824 = _t823 & _t807;
				if (( *(_t871 + _t824 * 4) >> 0x00000008 & 0x000000ff) - _t488 <= 0) goto 0x40013ee2;
				if (_t670 == 0) goto 0x400144ee;
				_t489 = _t488 + 8;
				_t671 = _t670 - 1;
				r15d = r15d + (( *_t889 & 0x000000ff) << _t488);
				_t890 =  &(_t889[1]);
				_t825 = _t824 & _t807;
				_t403 =  *( *(__r13 + 0x60) + _t825 * 4);
				if ((_t403 >> 0x00000008 & 0x000000ff) - _t489 > 0) goto 0x40013ea1;
				if (_t403 == 0) goto 0x40013fb0;
				if ((_t403 & 0x000000f0) != 0) goto 0x40013fb0;
				r10d = _t403;
				 *(_t848 - 0x48) = _t403;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t403 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t403 >> 0x10);
				r11d =  *(_t848 - 0x47) & 0x000000ff;
				r8d =  *(_t871 + _t864 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t489 <= 0) goto 0x40013fa0;
				r10d =  *(_t848 - 0x46) & 0x0000ffff;
				if (_t671 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t890 & 0x000000ff) << _t489);
				r8d = r8d << (_t403 & 0x000000ff) + r9d;
				_t490 = _t489 + 8;
				r8d = r8d - 1;
				_t672 = _t671 - 1;
				_t891 =  &(_t890[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t409 =  *( *(__r13 + 0x60) + _t856 * 4);
				r8d = _t409 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t490 > 0) goto 0x40013f46;
				_t572 = r11b & 0xffffffff;
				r15d = r15d >> _t572;
				 *(__r13 + 0x1be4) = _t572;
				_t575 = _t409 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t575;
				r15d = r15d >> _t575;
				_t492 = _t490 - _t572 - _t575;
				 *(__r13 + 0x50) = _t409 >> 0x10;
				if (_t409 != 0) goto 0x40013fde;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4d;
				goto 0x40013648;
				if ((_t409 & 0x00000020) == 0) goto 0x40013ff2;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013640;
				if ((_t409 & 0x00000040) == 0) goto 0x4001400e;
				_t810 = "invalid literal/length code";
				 *(_t845 + 0x20) = _t810;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f49;
				 *(__r13 + 0x58) = _t409 & 0xf;
				_t652 =  *(__r13 + 0x58);
				if (_t652 == 0) goto 0x4001406d;
				if (_t492 - _t652 >= 0) goto 0x4001404f;
				if (_t672 == 0) goto 0x400144ee;
				_t493 = _t492 + 8;
				_t673 = _t672 - 1;
				_t892 =  &(_t891[1]);
				r15d = r15d + (( *_t891 & 0x000000ff) << _t492);
				if (_t493 - _t652 < 0) goto 0x40014030;
				_t581 = _t652;
				_t494 = _t493 - _t652;
				r15d = r15d >> _t581;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + ((0x00000001 << _t581) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t652;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4a;
				 *(__r13 + 0x1be8) =  *(__r13 + 0x50);
				_t872 =  *((intOrPtr*)(__r13 + 0x68));
				_t826 = _t825 & _t810;
				if (( *(_t872 + _t826 * 4) >> 0x00000008 & 0x000000ff) - _t494 <= 0) goto 0x400140f0;
				asm("o16 nop [eax+eax]");
				if (_t673 == 0) goto 0x400144ee;
				_t495 = _t494 + 8;
				_t674 = _t673 - 1;
				r15d = r15d + (( *_t892 & 0x000000ff) << _t494);
				_t893 =  &(_t892[1]);
				_t827 = _t826 & _t810;
				_t426 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t827 * 4);
				if ((_t426 >> 0x00000008 & 0x000000ff) - _t495 > 0) goto 0x400140b0;
				if ((_t426 & 0x000000f0) != 0) goto 0x400141ba;
				r10d = _t426;
				 *(_t848 - 0x48) = _t426;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t426 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t426 >> 0x10);
				r11d =  *(_t848 - 0x47) & 0x000000ff;
				r8d =  *(_t872 + _t864 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t495 <= 0) goto 0x400141aa;
				r10d =  *(_t848 - 0x46) & 0x0000ffff;
				if (_t674 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t893 & 0x000000ff) << _t495);
				r8d = r8d << (_t426 & 0x000000ff) + r9d;
				_t496 = _t495 + 8;
				r8d = r8d - 1;
				_t675 = _t674 - 1;
				_t894 =  &(_t893[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t432 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t856 * 4);
				r8d = _t432 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t496 > 0) goto 0x40014150;
				_t605 = r11b & 0xffffffff;
				r15d = r15d >> _t605;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t605;
				_t865 =  *(_t848 - 0x40);
				r11d =  *(_t848 + 0x38);
				_t608 = _t432 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t608;
				r15d = r15d >> _t608;
				_t498 = _t496 - _t605 - _t608;
				if ((_t432 & 0x00000040) == 0) goto 0x400141f2;
				 *(_t845 + 0x20) = "invalid distance code";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r10d =  *(_t848 - 0x4c);
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4b;
				 *(__r13 + 0x54) = _t432 >> 0x10;
				 *(__r13 + 0x58) = _t432 & 0xf;
				_t654 =  *(__r13 + 0x58);
				if (_t654 == 0) goto 0x4001425d;
				if (_t498 - _t654 >= 0) goto 0x4001423f;
				if (_t675 == 0) goto 0x400144ee;
				_t499 = _t498 + 8;
				_t676 = _t675 - 1;
				_t895 =  &(_t894[1]);
				r15d = r15d + (( *_t894 & 0x000000ff) << _t498);
				if (_t499 - _t654 < 0) goto 0x40014220;
				_t614 = _t654;
				_t500 = _t499 - _t654;
				r15d = r15d >> _t614;
				 *(__r13 + 0x54) =  *(__r13 + 0x54) + ((0x00000001 << _t614) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t654;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4c;
				if (r11d == 0) goto 0x400144ee;
				_t615 =  *(__r13 + 0x54);
				_t440 = r10d - r11d;
				if (_t615 - _t440 <= 0) goto 0x400142ca;
				_t616 = _t615 - _t440;
				if (_t616 -  *((intOrPtr*)(__r13 + 0x38)) <= 0) goto 0x400142a6;
				if ( *((intOrPtr*)(__r13 + 0x1be0)) == 0) goto 0x400142a6;
				 *(_t845 + 0x20) = "invalid distance too far back";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				_t441 =  *((intOrPtr*)(__r13 + 0x3c));
				if (_t616 - _t441 <= 0) goto 0x400142b8;
				_t617 = _t616 - _t441;
				goto 0x400142bc;
				_t657 = _t441 - _t617;
				if (_t617 -  *(__r13 + 0x50) <= 0) goto 0x400142d6;
				goto 0x400142d4;
				_t444 =  *(__r13 + 0x50);
				_t618 = _t444;
				_t619 =  >  ? r11d : _t618;
				r11d = r11d - _t619;
				 *(_t848 + 0x38) = r11d;
				 *(__r13 + 0x50) = _t444 - _t619;
				_t866 = _t865 + 1;
				 *((char*)(_t866 - 1)) =  *(_t865 - _t827 - _t865 + _t865) & 0x000000ff;
				if (_t618 != r11d) goto 0x400142f0;
				 *(_t848 - 0x40) = _t866;
				if ( *(__r13 + 0x50) != _t619 - 1) goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (r11d == 0) goto 0x400144ee;
				_t867 = _t866 + 1;
				r11d = r11d - 1;
				 *((char*)(_t867 - 1)) =  *(__r13 + 0x50) & 0x000000ff;
				 *(_t848 + 0x38) = r11d;
				 *(_t848 - 0x40) = _t867;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				goto 0x40013650;
				if ( *((intOrPtr*)(_t848 + 0x10)) == 0) goto 0x40014420;
				if (_t500 - 0x20 >= 0) goto 0x40014378;
				if (_t676 == 0) goto 0x400144ee;
				_t677 = _t676 - 1;
				_t896 =  &(_t895[1]);
				r15d = r15d + (( *_t895 & 0x000000ff) << _t500);
				if (_t500 + 8 - 0x20 < 0) goto 0x40014358;
				r10d = r10d - r11d;
				 *((intOrPtr*)(_t845 + 0x1c)) =  *((intOrPtr*)(_t845 + 0x1c)) + r10d;
				 *((intOrPtr*)(__r13 + 0x24)) =  *((intOrPtr*)(__r13 + 0x24)) + r10d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400143c1;
				if (r10d == 0) goto 0x400143c1;
				r8d = r10d;
				if ( *((intOrPtr*)(__r13 + 0x18)) == 0) goto 0x400143ad;
				_t451 = E00000001140015160(_t867 - "invalid distance too far back");
				goto 0x400143b2;
				_t452 = E00000001140015A00(_t451,  *((intOrPtr*)(__r13 + 0x20)), _t657, _t817, _t856);
				r11d =  *(_t848 + 0x38);
				 *((intOrPtr*)(__r13 + 0x20)) = _t452;
				 *((intOrPtr*)(_t845 + 0x4c)) = _t452;
				 *(_t848 - 0x4c) = r11d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x4001441a;
				if ( *((intOrPtr*)(__r13 + 0x18)) != 0) goto 0x400143fc;
				if (((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + (r15d >> 0x00000008 & 0x0000ff00) + (r15d >> 0x18) ==  *((intOrPtr*)(__r13 + 0x20))) goto 0x4001441a;
				 *(_t845 + 0x20) = "incorrect data check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t502 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4f;
				if ( *(__r13 + 0x10) == 0) goto 0x400144c7;
				if ( *((intOrPtr*)(__r13 + 0x18)) == 0) goto 0x400144c7;
				if (_t502 - 0x20 >= 0) goto 0x40014463;
				if (_t677 == 0) goto 0x400144ee;
				_t503 = _t502 + 8;
				r15d = r15d + (( *_t896 & 0x000000ff) << _t502);
				if (_t503 - 0x20 < 0) goto 0x40014443;
				if (r15d ==  *((intOrPtr*)(__r13 + 0x24))) goto 0x400144c1;
				 *(_t845 + 0x20) = "incorrect length check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *((long long*)(_t845 + 0x10)) =  *(_t848 - 0x40);
				 *(_t845 + 0x18) = r11d;
				 *_t845 =  &(_t896[1]);
				 *((intOrPtr*)(_t845 + 8)) = _t677 - 1;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t503;
				return 2;
			}






















































































































































    0x14001366e
    0x140013671
    0x140013675
    0x140013686
    0x140013688
    0x14001368b
    0x140013691
    0x140013699
    0x1400136aa
    0x1400136bb
    0x1400136be
    0x1400136c1
    0x1400136c5
    0x1400136c8
    0x1400136d5
    0x1400136db
    0x1400136e2
    0x1400136e7
    0x1400136eb
    0x1400136ef
    0x1400136f3
    0x1400136f6
    0x1400136fa
    0x14001370f
    0x14001371a
    0x14001371e
    0x140013726
    0x140013729
    0x14001372c
    0x14001372e
    0x140013736
    0x14001373a
    0x140013746
    0x14001374b
    0x14001374d
    0x140013750
    0x140013753
    0x140013756
    0x14001375b
    0x140013763
    0x14001376d
    0x140013771
    0x140013775
    0x140013779
    0x140013782
    0x140013789
    0x14001378d
    0x140013795
    0x14001379a
    0x14001379e
    0x1400137a9
    0x1400137b8
    0x1400137bf
    0x1400137ca
    0x1400137d0
    0x1400137d8
    0x1400137df
    0x1400137e1
    0x1400137e8
    0x1400137ed
    0x1400137f5
    0x1400137f9
    0x140013803
    0x140013806
    0x140013808
    0x14001380e
    0x140013812
    0x140013823
    0x140013828
    0x14001382e
    0x140013833
    0x14001383e
    0x140013840
    0x140013847
    0x14001384b
    0x140013853
    0x140013858
    0x14001385f
    0x140013862
    0x140013865
    0x140013870
    0x140013876
    0x14001387e
    0x140013885
    0x14001388a
    0x140013891
    0x140013898
    0x14001389e
    0x1400138a4
    0x1400138a7
    0x1400138aa
    0x1400138af
    0x1400138b7
    0x1400138ba
    0x1400138c0
    0x1400138c4
    0x1400138c7
    0x1400138cb
    0x1400138cf
    0x1400138d3
    0x1400138d8
    0x1400138e8
    0x1400138ea
    0x1400138f2
    0x1400138fe
    0x140013903
    0x140013905
    0x140013908
    0x14001390e
    0x140013913
    0x140013917
    0x14001391d
    0x14001392a
    0x140013933
    0x140013935
    0x14001393c
    0x140013940
    0x140013947
    0x140013951
    0x14001395a
    0x140013960
    0x140013967
    0x140013981
    0x140013986
    0x14001398a
    0x140013996
    0x14001399b
    0x14001399d
    0x1400139a0
    0x1400139a6
    0x1400139b3
    0x1400139c2
    0x1400139c6
    0x1400139cf
    0x1400139e1
    0x1400139eb
    0x1400139ff
    0x140013a08
    0x140013a17
    0x140013a19
    0x140013a20
    0x140013a29
    0x140013a2c
    0x140013a37
    0x140013a3c
    0x140013a43
    0x140013a48
    0x140013a48
    0x140013a4c
    0x140013a53
    0x140013a58
    0x140013a5c
    0x140013a61
    0x140013a6a
    0x140013a6e
    0x140013a76
    0x140013a7b
    0x140013a82
    0x140013a86
    0x140013a8e
    0x140013a93
    0x140013a9a
    0x140013aad
    0x140013abb
    0x140013ac5
    0x140013ae0
    0x140013ae3
    0x140013ae7
    0x140013aec
    0x140013af7
    0x140013b02
    0x140013b0e
    0x140013b16
    0x140013b18
    0x140013b20
    0x140013b2e
    0x140013b32
    0x140013b37
    0x140013b42
    0x140013b46
    0x140013b49
    0x140013b4d
    0x140013b52
    0x140013b58
    0x140013b61
    0x140013b64
    0x140013b66
    0x140013b6d
    0x140013b72
    0x140013b7a
    0x140013b7f
    0x140013b83
    0x140013b8f
    0x140013b94
    0x140013b96
    0x140013b99
    0x140013b9e
    0x140013ba0
    0x140013ba4
    0x140013bac
    0x140013bb9
    0x140013bbd
    0x140013bcc
    0x140013bcf
    0x140013bd9
    0x140013bde
    0x140013be0
    0x140013be6
    0x140013bea
    0x140013bf6
    0x140013bfb
    0x140013bfd
    0x140013c00
    0x140013c05
    0x140013c0f
    0x140013c1b
    0x140013c1f
    0x140013c21
    0x140013c27
    0x140013c32
    0x140013c3e
    0x140013c43
    0x140013c48
    0x140013c4d
    0x140013c57
    0x140013c63
    0x140013c6a
    0x140013c80
    0x140013c82
    0x140013c84
    0x140013c86
    0x140013c97
    0x140013ca0
    0x140013ca9
    0x140013cab
    0x140013cb6
    0x140013cc4
    0x140013cd2
    0x140013ce1
    0x140013cea
    0x140013cee
    0x140013cf6
    0x140013d02
    0x140013d06
    0x140013d0e
    0x140013d13
    0x140013d1a
    0x140013d21
    0x140013d28
    0x140013d2d
    0x140013d32
    0x140013d49
    0x140013d50
    0x140013d54
    0x140013d59
    0x140013d5e
    0x140013d6b
    0x140013d6f
    0x140013d77
    0x140013d83
    0x140013d8a
    0x140013d8e
    0x140013d96
    0x140013da4
    0x140013da9
    0x140013dbd
    0x140013dc2
    0x140013dc5
    0x140013dca
    0x140013dcc
    0x140013dd3
    0x140013dd8
    0x140013de3
    0x140013de9
    0x140013df1
    0x140013df5
    0x140013df9
    0x140013dfc
    0x140013e00
    0x140013e0b
    0x140013e14
    0x140013e16
    0x140013e1a
    0x140013e1e
    0x140013e21
    0x140013e27
    0x140013e2a
    0x140013e2e
    0x140013e32
    0x140013e3f
    0x140013e43
    0x140013e47
    0x140013e4a
    0x140013e4d
    0x140013e51
    0x140013e55
    0x140013e59
    0x140013e5d
    0x140013e63
    0x140013e6e
    0x140013e76
    0x140013e81
    0x140013e8e
    0x140013e9f
    0x140013ea3
    0x140013eaf
    0x140013eb7
    0x140013eb9
    0x140013ec1
    0x140013ecc
    0x140013ed3
    0x140013ee0
    0x140013ee4
    0x140013eec
    0x140013ef2
    0x140013ef8
    0x140013efb
    0x140013eff
    0x140013f07
    0x140013f11
    0x140013f17
    0x140013f1a
    0x140013f1d
    0x140013f20
    0x140013f27
    0x140013f31
    0x140013f39
    0x140013f3f
    0x140013f41
    0x140013f48
    0x140013f54
    0x140013f5a
    0x140013f66
    0x140013f6d
    0x140013f73
    0x140013f76
    0x140013f79
    0x140013f7b
    0x140013f7e
    0x140013f81
    0x140013f84
    0x140013f8b
    0x140013f94
    0x140013f98
    0x140013f9e
    0x140013fa0
    0x140013fa4
    0x140013fa9
    0x140013fb5
    0x140013fb8
    0x140013fbf
    0x140013fc2
    0x140013fc9
    0x140013fcf
    0x140013fd1
    0x140013fd9
    0x140013fe0
    0x140013fe2
    0x140013fed
    0x140013ff4
    0x140013ff6
    0x140013ffd
    0x140014001
    0x140014009
    0x140014011
    0x14001401c
    0x140014020
    0x140014026
    0x14001402a
    0x140014032
    0x14001403e
    0x140014043
    0x140014045
    0x140014048
    0x14001404d
    0x14001404f
    0x140014056
    0x14001405f
    0x140014062
    0x140014066
    0x140014071
    0x14001407d
    0x140014086
    0x140014097
    0x1400140a8
    0x1400140aa
    0x1400140b2
    0x1400140be
    0x1400140c5
    0x1400140c7
    0x1400140cf
    0x1400140da
    0x1400140e1
    0x1400140ee
    0x1400140f2
    0x1400140f8
    0x1400140fe
    0x140014101
    0x140014105
    0x14001410d
    0x140014117
    0x14001411d
    0x140014120
    0x140014123
    0x140014126
    0x14001412d
    0x140014137
    0x14001413f
    0x140014145
    0x140014147
    0x140014152
    0x14001415e
    0x140014164
    0x140014170
    0x140014177
    0x14001417d
    0x140014180
    0x140014183
    0x140014185
    0x140014188
    0x14001418b
    0x14001418e
    0x140014195
    0x14001419e
    0x1400141a2
    0x1400141a8
    0x1400141aa
    0x1400141ae
    0x1400141b3
    0x1400141ba
    0x1400141be
    0x1400141c7
    0x1400141ca
    0x1400141d1
    0x1400141d4
    0x1400141d8
    0x1400141e1
    0x1400141e5
    0x1400141ed
    0x1400141f2
    0x1400141f8
    0x140014203
    0x14001420d
    0x140014211
    0x140014217
    0x14001421b
    0x140014222
    0x14001422e
    0x140014233
    0x140014235
    0x140014238
    0x14001423d
    0x14001423f
    0x140014246
    0x14001424f
    0x140014252
    0x140014256
    0x14001425d
    0x140014268
    0x14001426e
    0x140014275
    0x14001427a
    0x14001427c
    0x140014282
    0x14001428c
    0x140014295
    0x140014299
    0x1400142a1
    0x1400142a6
    0x1400142ac
    0x1400142b2
    0x1400142b6
    0x1400142ba
    0x1400142c6
    0x1400142c8
    0x1400142ca
    0x1400142d4
    0x1400142d9
    0x1400142dd
    0x1400142e5
    0x1400142e9
    0x1400142f5
    0x1400142f8
    0x1400142fe
    0x140014300
    0x140014308
    0x14001430e
    0x14001431e
    0x140014329
    0x14001432c
    0x14001432f
    0x140014333
    0x140014337
    0x14001433b
    0x140014343
    0x14001434d
    0x140014356
    0x14001435a
    0x14001436b
    0x14001436d
    0x140014370
    0x140014376
    0x140014378
    0x14001437b
    0x14001437f
    0x140014388
    0x14001438d
    0x1400143a1
    0x1400143a4
    0x1400143a6
    0x1400143ab
    0x1400143ad
    0x1400143b6
    0x1400143ba
    0x1400143be
    0x1400143c6
    0x1400143ca
    0x1400143d4
    0x140014400
    0x140014409
    0x14001440d
    0x140014415
    0x14001441a
    0x14001441d
    0x140014420
    0x14001442d
    0x140014438
    0x140014441
    0x140014445
    0x140014451
    0x14001445b
    0x140014461
    0x140014467
    0x140014470
    0x140014474
    0x14001447c
    0x140014481
    0x140014485
    0x140014489
    0x14001448c
    0x140014494
    0x140014498
    0x1400144c0

    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID: $ $invalid block type
    • API String ID: 0-2056396358
    • Opcode ID: 44e2e5f460598a6c66844f3403f38ee68ad68f3f2a55e5b147868c764788a378
    • Instruction ID: 6826abb0ae9e935998ffe99ae2e08a78a36fe9b187ecd4f73c4f7ab9da41e151
    • Opcode Fuzzy Hash: 44e2e5f460598a6c66844f3403f38ee68ad68f3f2a55e5b147868c764788a378
    • Instruction Fuzzy Hash: 7161E3B3510B949BE766CF26C8887AD3BE8F708394F554229EB558B7E0D73AC490CB40
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000EA48 Relevance: 2.8, APIs: 1, Instructions: 1540COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 58%
    			E0000000114000EA48(long long __rbx, signed int* __rcx, signed int* __rdx, signed int* __r8) {
				signed int _t393;
				signed int _t403;
				signed int _t406;
				signed int _t423;
				signed int _t427;
				signed int _t432;
				signed int _t437;
				signed int _t440;
				signed int _t444;
				signed int _t448;
				signed int _t487;
				signed int _t493;
				signed int _t501;
				signed int _t507;
				signed int _t516;
				signed int _t523;
				signed int _t529;
				signed int _t546;
				void* _t687;
				signed int _t688;
				signed int _t692;
				signed int _t695;
				signed int _t698;
				signed int _t704;
				signed int _t709;
				signed int _t714;
				signed int _t716;
				signed int _t718;
				signed int _t721;
				signed int _t726;
				signed int _t730;
				signed int _t732;
				signed int _t735;
				signed int _t1008;
				signed int _t1011;
				signed int _t1012;
				signed int _t1020;
				signed int _t1021;
				signed int _t1022;
				signed int _t1023;
				signed int _t1024;
				signed int _t1044;
				signed int _t1046;
				signed int _t1051;
				signed int _t1055;
				void* _t1057;
				signed int _t1063;
				signed int _t1067;
				signed int _t1071;
				signed int _t1075;
				signed int _t1076;
				signed int _t1080;
				signed int _t1082;
				signed int _t1086;
				signed int _t1088;
				signed int _t1094;
				signed int _t1096;
				signed int _t1099;
				signed int _t1104;
				signed int _t1109;
				signed int _t1113;
				signed int _t1117;
				signed int _t1121;
				signed int _t1122;
				signed int _t1126;
				signed int _t1130;
				signed int _t1132;
				signed int _t1137;
				signed int _t1140;
				signed int _t1143;
				signed int _t1151;
				signed int _t1160;
				signed int _t1161;
				signed int _t1165;
				signed int _t1169;
				signed int _t1173;
				signed int _t1176;
				signed int _t1180;
				signed int _t1184;
				signed int _t1188;
				signed int* _t1219;
				signed int* _t1220;
				signed int* _t1231;
				intOrPtr* _t1232;
				signed int* _t1234;
				signed int* _t1237;
				signed int* _t1240;
				signed int* _t1243;
				void* _t1245;
				void* _t1246;
				signed int* _t1250;
				signed int* _t1251;
				int _t1253;
				signed int* _t1254;
				signed int* _t1255;
				void* _t1257;
				signed int* _t1258;
				void* _t1260;
				signed int* _t1263;
				signed int* _t1264;

				 *((long long*)(_t1245 + 0x10)) = __rbx;
				 *((long long*)(_t1245 + 8)) = __rcx;
				_t1246 = _t1245 - 0x70;
				 *(_t1246 + 0x20) = __r8;
				if (__r8 == 0) goto 0x4000ea81;
				r8d = 0x40;
				memcpy(_t1260, _t1257, _t1253);
				goto 0x4000ea89;
				 *(_t1246 + 0x20) = __rdx;
				r9d = __rcx[2];
				r8d = __rcx[3];
				_t688 =  *__rcx;
				_t393 =  *__rdx;
				r10d = __rcx[1];
				r11d = _t393;
				asm("rol eax, 0x8");
				asm("inc ecx");
				r13d = 0xff00ff00;
				r11d = r11d & r13d;
				r14d = 0xff00ff;
				asm("inc ecx");
				r11d = r11d | _t393 & r14d;
				r8d = r8d + 0x5a827999;
				 *(_t1246 + 0x5c) = r11d;
				asm("rol eax, 0x5");
				r11d = r11d + _t688;
				r11d = r11d + ((r8d ^ r9d) & r10d ^ r8d);
				r11d = r11d + __rcx[4] + 0x5a827999;
				asm("rol eax, 0x8");
				asm("ror edx, 0x8");
				asm("ror ebx, 0x2");
				_t1008 = __rdx[1] & r13d | __rdx[1] & r14d;
				r9d = r9d + 0x5a827999;
				 *(_t1246 + 0x3c) = _t1008;
				asm("rol eax, 0x5");
				_t1011 = _t1008 + r11d + ((r9d ^ r10d) & _t688 ^ r9d) + r8d;
				r8d = r10d;
				asm("rol eax, 0x8");
				r8d = r8d ^ _t688;
				asm("ror ebp, 0x8");
				r8d = r8d & r11d;
				asm("inc ecx");
				_t1140 = __rdx[2] & r13d | __rdx[2] & r14d;
				r8d = r8d ^ r10d;
				 *(_t1246 + 0x30) = _t1140;
				asm("rol eax, 0x5");
				r8d = r8d + _t1011 + _t1140;
				_t403 = __rdx[3];
				r8d = r8d + r9d;
				r9d = _t403;
				asm("inc ecx");
				r9d = r9d & r13d;
				asm("rol eax, 0x8");
				r9d = r9d | _t403 & r14d;
				 *(_t1246 + 0xc8) = r9d;
				asm("rol eax, 0x5");
				r9d = r9d + r8d;
				r9d = r9d + ((r11d ^ _t688) & _t1011 ^ _t688);
				r10d = r10d + 0x5a827999;
				asm("ror edx, 0x2");
				_t406 = __rdx[4];
				r9d = r9d + r10d;
				r10d = _t406;
				asm("rol eax, 0x8");
				asm("inc ecx");
				r10d = r10d & r13d;
				asm("inc ecx");
				r10d = r10d | _t406 & r14d;
				asm("rol eax, 0x5");
				 *(_t1246 + 0xc0) = r10d;
				r10d = r10d + r9d;
				r10d = r10d + ((r11d ^ _t1011) & r8d ^ r11d);
				r10d = r10d + _t688 + 0x5a827999;
				asm("rol eax, 0x8");
				asm("ror ebx, 0x8");
				_t692 = __rdx[5] & r13d | __rdx[5] & r14d;
				asm("inc ecx");
				 *(_t1246 + 0x50) = _t692;
				asm("rol eax, 0x5");
				r11d = r11d + ((_t1011 ^ r8d) & r9d ^ _t1011) + r10d + 0x5a827999 + _t692;
				asm("rol eax, 0x8");
				asm("ror ebx, 0x8");
				_t695 = __rdx[6] & r13d | __rdx[6] & r14d;
				asm("rol eax, 0x5");
				 *(_t1246 + 0x4c) = _t695;
				asm("inc ecx");
				r8d = r8d + 0x5a827999;
				_t1012 = _t1011 + ((r8d ^ r9d) & r10d ^ r8d) + r11d + 0x5a827999 + _t695;
				asm("rol eax, 0x8");
				asm("ror ebx, 0x8");
				_t698 = __rdx[7] & r13d | __rdx[7] & r14d;
				asm("rol eax, 0x5");
				 *(_t1246 + 0x48) = _t698;
				asm("inc ecx");
				_t423 = __rdx[8];
				r12d = _t423;
				r8d = r8d + ((r9d ^ r10d) & r11d ^ r9d) + _t1012 + _t698;
				asm("inc ecx");
				asm("rol eax, 0x8");
				r9d = r9d + 0x5a827999;
				r12d = r12d & r13d;
				r12d = r12d | _t423 & r14d;
				 *(_t1246 + 0x60) = r12d;
				asm("rol eax, 0x5");
				asm("ror edx, 0x2");
				_t427 = __rdx[9];
				_t704 = ((r11d ^ r10d) & _t1012 ^ r10d) + r8d + r12d + r9d;
				r9d = _t427;
				asm("rol eax, 0x8");
				asm("inc ecx");
				r9d = r9d & r13d;
				asm("inc ecx");
				r9d = r9d | _t427 & r14d;
				 *(_t1246 + 0x28) = r9d;
				asm("rol eax, 0x5");
				asm("ror ebx, 0x2");
				_t432 = __rdx[0xa];
				r9d = _t432;
				asm("rol eax, 0x8");
				_t1063 = ((r11d ^ _t1012) & r8d ^ r11d) + _t704 + 0x5a827999 + r9d + r10d;
				asm("inc ecx");
				r9d = r9d & r13d;
				r9d = r9d | _t432 & r14d;
				 *(_t1246 + 0x34) = r9d;
				asm("rol eax, 0x5");
				asm("ror edi, 0x2");
				_t437 = __rdx[0xb];
				r9d = _t437;
				_t1094 = ((_t1012 ^ r8d) & _t704 ^ _t1012) + _t1063 + 0x5a827999 + r9d + r11d;
				asm("rol eax, 0x8");
				asm("inc ecx");
				r9d = r9d & r13d;
				r9d = r9d | _t437 & r14d;
				 *(_t1246 + 0x40) = r9d;
				asm("rol eax, 0x5");
				r9d = r9d + _t1094;
				_t440 = __rdx[0xc];
				r13d = _t440;
				r9d = r9d + ((r8d ^ _t704) & _t1063 ^ r8d);
				r9d = r9d + _t1012 + 0x5a827999;
				asm("inc ecx");
				r13d = r13d & 0xff00ff00;
				asm("rol eax, 0x8");
				r13d = r13d | _t440 & r14d;
				r8d = r8d + 0x5a827999;
				r10d = _t704;
				r10d = r10d ^ _t1063;
				 *(_t1246 + 0x38) = r13d;
				asm("rol eax, 0x5");
				r10d = r10d & _t1094;
				r10d = r10d ^ _t704;
				r10d = r10d + r9d + r13d;
				_t444 = __rdx[0xd];
				asm("ror esi, 0x2");
				r14d = _t444;
				r10d = r10d + r8d;
				asm("rol eax, 0x8");
				r8d = 0xff00ff;
				r11d = _t1094;
				asm("inc ecx");
				r11d = r11d ^ _t1063;
				r14d = r14d & 0xff00ff00;
				r14d = r14d | _t444 & r8d;
				r11d = r11d & r9d;
				asm("rol eax, 0x5");
				r11d = r11d ^ _t1063;
				 *(_t1246 + 0x2c) = r14d;
				r11d = r11d + r10d + r14d;
				asm("inc ecx");
				_t448 = __rdx[0xe];
				r15d = _t448;
				asm("rol eax, 0x8");
				r11d = r11d + _t704 + 0x5a827999;
				_t1219 =  *(_t1246 + 0x20);
				_t1143 = _t1140 ^  *(_t1246 + 0x5c) ^ r14d ^ r12d;
				asm("inc ecx");
				r15d = r15d & 0xff00ff00;
				asm("rol ebp, 1");
				r15d = r15d | _t448 & r8d;
				 *(_t1246 + 0x44) = _t1143;
				 *_t1219 = _t1143;
				asm("rol eax, 0x5");
				 *(_t1246 + 0x54) = r15d;
				asm("inc ecx");
				_t1020 = ((_t1094 ^ r9d) & r10d ^ _t1094) + r11d + r15d + _t1063 + 0x5a827999;
				asm("rol eax, 0x8");
				r8d = r9d;
				asm("ror edi, 0x8");
				r8d = r8d ^ r10d;
				_t1067 = _t1219[0xf] & 0xff00ff00 | _t1219[0xf] & r8d;
				r8d = r8d & r11d;
				asm("rol eax, 0x5");
				r8d = r8d ^ r9d;
				 *(_t1246 + 0x58) = _t1067;
				asm("inc ecx");
				r8d = r8d + _t1020 + _t1067;
				r8d = r8d + _t1094 + 0x5a827999;
				asm("rol eax, 0x5");
				_t1096 =  *(_t1246 + 0xc8);
				asm("ror edx, 0x2");
				r12d = _t1096;
				r12d = r12d ^  *(_t1246 + 0x3c);
				r9d = r9d + ((r10d ^ r11d) & _t1020 ^ r10d) + r8d + 0x5a827999 + _t1143;
				_t1099 = _t1096 ^ _t1143 ^  *(_t1246 + 0x40) ^  *(_t1246 + 0x50);
				r12d = r12d ^ r15d;
				r12d = r12d ^  *(_t1246 + 0x28);
				asm("rol eax, 0x5");
				asm("rol esi, 1");
				 *(_t1246 + 0xc8) = _t1099;
				asm("inc ecx");
				_t1219[1] = r12d;
				asm("inc ecx");
				r10d = r10d + ((r11d ^ _t1020) & r8d ^ r11d) + r9d + 0x5a827999 + r12d;
				_t709 =  *(_t1246 + 0xc0) ^  *(_t1246 + 0x30) ^ _t1067 ^  *(_t1246 + 0x34);
				asm("inc ecx");
				asm("rol ebx, 1");
				( *(_t1246 + 0x20))[2] = _t709;
				asm("rol eax, 0x5");
				( *(_t1246 + 0x20))[3] = _t1099;
				r11d = r11d + ((r8d ^ _t1020) & r9d ^ _t1020) + r10d + 0x5a827999 + _t709;
				asm("rol eax, 0x5");
				asm("inc ecx");
				_t1104 =  *(_t1246 + 0xc0) ^ r12d ^ r13d ^  *(_t1246 + 0x4c);
				_t1254 =  *(_t1246 + 0x20);
				_t1021 = _t1020 + ((r8d ^ r9d) & r10d ^ r8d) + r11d + _t1099 + 0x5a827999;
				asm("rol esi, 1");
				 *(_t1246 + 0xc0) = _t1104;
				 *(_t1254 + 0x10) = _t1104;
				asm("rol eax, 0x5");
				asm("inc ecx");
				r8d = r8d + (r9d ^ r10d ^ r11d) + _t1021 + _t1104 + 0x6ed9eba1;
				r14d =  *(_t1246 + 0xc8);
				_t1109 = _t709 ^ r14d ^  *(_t1246 + 0x48) ^  *(_t1246 + 0x50);
				asm("rol eax, 0x5");
				r14d = r14d ^ r15d;
				r14d = r14d ^  *(_t1246 + 0x60);
				r15d =  *(_t1246 + 0xc0);
				r14d = r14d ^  *(_t1246 + 0x4c);
				r15d = r15d ^ _t1067;
				asm("rol esi, 1");
				r15d = r15d ^  *(_t1246 + 0x28);
				asm("inc ecx");
				r15d = r15d ^  *(_t1246 + 0x48);
				 *(_t1254 + 0x14) = _t1109;
				asm("inc ecx");
				asm("ror edx, 0x2");
				r9d = r9d + (r10d ^ r11d ^ _t1021) + r8d + 0x6ed9eba1 + _t1109;
				 *(_t1254 + 0x18) = r14d;
				_t1071 = _t1143 ^  *(_t1246 + 0x34) ^  *(_t1246 + 0x60) ^ _t1109;
				asm("rol eax, 0x5");
				asm("inc ecx");
				asm("rol edi, 1");
				r10d = r10d + (r8d ^ r11d ^ _t1021) + r9d + 0x6ed9eba1 + r14d;
				 *(_t1254 + 0x1c) = r15d;
				asm("rol eax, 0x5");
				asm("inc ecx");
				r13d = r12d;
				r13d = r13d ^  *(_t1246 + 0x40);
				r11d = r11d + (r8d ^ r9d ^ _t1021) + r10d + 0x6ed9eba1 + r15d;
				 *(_t1254 + 0x20) = _t1071;
				r13d = r13d ^  *(_t1246 + 0x28);
				asm("rol eax, 0x5");
				r13d = r13d ^ r14d;
				asm("inc ecx");
				_t1022 = _t1021 + (r8d ^ r9d ^ r10d) + r11d + 0x6ed9eba1 + _t1071;
				( *(_t1246 + 0x20))[9] = r13d;
				asm("inc ecx");
				asm("rol eax, 0x5");
				r8d = r8d + (r9d ^ r10d ^ r11d) + _t1022 + 0x6ed9eba1 + r13d;
				asm("inc ecx");
				_t487 = _t709 ^  *(_t1246 + 0x38) ^  *(_t1246 + 0x34) ^ r15d;
				asm("rol eax, 1");
				( *(_t1246 + 0x20))[0xa] = _t487;
				 *(_t1246 + 0x30) = _t487;
				asm("rol eax, 0x5");
				asm("ror edx, 0x2");
				r9d = r9d + (r10d ^ r11d ^ _t1022) + r8d +  *(_t1246 + 0x30) + 0x6ed9eba1;
				_t493 =  *(_t1246 + 0xc8) ^  *(_t1246 + 0x2c) ^  *(_t1246 + 0x40) ^ _t1071;
				asm("rol eax, 1");
				( *(_t1246 + 0x20))[0xb] = _t493;
				 *(_t1246 + 0x28) = _t493;
				asm("rol eax, 0x5");
				asm("inc ecx");
				r10d = r10d + (r8d ^ r11d ^ _t1022) + r9d +  *(_t1246 + 0x28) + 0x6ed9eba1;
				_t1151 =  *(_t1246 + 0xc0) ^  *(_t1246 + 0x54) ^  *(_t1246 + 0x38) ^ r13d;
				asm("rol ebp, 1");
				( *(_t1246 + 0x20))[0xc] = _t1151;
				 *(_t1246 + 0x34) = _t1151;
				asm("rol eax, 0x5");
				asm("inc ecx");
				r11d = r11d + (r8d ^ r9d ^ _t1022) + r10d + _t1151 + 0x6ed9eba1;
				_t501 =  *(_t1246 + 0x58) ^  *(_t1246 + 0x2c) ^  *(_t1246 + 0x30) ^ _t1109;
				asm("rol eax, 1");
				( *(_t1246 + 0x20))[0xd] = _t501;
				 *(_t1246 + 0x3c) = _t501;
				asm("rol eax, 0x5");
				asm("inc ecx");
				_t1023 = _t1022 + (r8d ^ r9d ^ r10d) + r11d +  *(_t1246 + 0x3c) + 0x6ed9eba1;
				_t507 =  *(_t1246 + 0x44) ^  *(_t1246 + 0x54) ^  *(_t1246 + 0x28) ^ r14d;
				asm("rol eax, 1");
				 *(_t1246 + 0x2c) = _t507;
				( *(_t1246 + 0x20))[0xe] = _t507;
				asm("rol eax, 0x5");
				asm("inc ecx");
				r8d = r8d + (r9d ^ r10d ^ r11d) + _t1023 +  *(_t1246 + 0x2c) + 0x6ed9eba1;
				_t1160 = r12d ^  *(_t1246 + 0x58) ^  *(_t1246 + 0x34) ^ r15d;
				asm("rol ebp, 1");
				( *(_t1246 + 0x20))[0xf] = _t1160;
				asm("ror edx, 0x2");
				 *(_t1246 + 0x58) = _t1160;
				asm("rol eax, 0x5");
				r9d = r9d + (r10d ^ r11d ^ _t1023) + r8d + 0x6ed9eba1 + _t1160;
				_t516 = _t709 ^  *(_t1246 + 0x44) ^  *(_t1246 + 0x3c) ^ _t1071;
				asm("rol eax, 1");
				 *( *(_t1246 + 0x20)) = _t516;
				 *(_t1246 + 0x44) = _t516;
				asm("inc ecx");
				asm("rol eax, 0x5");
				r10d = r10d + (r8d ^ r11d ^ _t1023) + r9d + 0x6ed9eba1 +  *(_t1246 + 0x44);
				_t523 =  *(_t1246 + 0xc8) ^ r12d ^  *(_t1246 + 0x2c) ^ r13d;
				asm("rol eax, 1");
				( *(_t1246 + 0x20))[1] = _t523;
				 *(_t1246 + 0x40) = _t523;
				r12d =  *(_t1246 + 0x40);
				asm("inc ecx");
				r12d = r12d + 0x6ed9eba1;
				asm("rol eax, 0x5");
				r11d = r11d + (r8d ^ r9d ^ _t1023) + r10d + r12d;
				_t529 =  *(_t1246 + 0xc0) ^ _t709 ^ _t1160 ^  *(_t1246 + 0x30);
				asm("rol eax, 1");
				( *(_t1246 + 0x20))[2] = _t529;
				 *(_t1246 + 0x38) = _t529;
				asm("rol eax, 0x5");
				r12d =  *(_t1246 + 0x38);
				_t1161 =  *(_t1246 + 0x28);
				asm("inc ecx");
				r12d = r12d + 0x6ed9eba1;
				r12d =  *(_t1246 + 0xc8);
				r12d = r12d ^  *(_t1246 + 0x44);
				_t1024 = _t1023 + (r8d ^ r9d ^ r10d) + r11d + r12d;
				r12d = r12d ^ _t1161;
				r12d = r12d ^ _t1109;
				asm("inc ecx");
				( *(_t1246 + 0x20))[3] = r12d;
				 *(_t1246 + 0xc8) = r12d;
				asm("inc ecx");
				r12d = r12d + 0x6ed9eba1;
				asm("rol eax, 0x5");
				r12d =  *(_t1246 + 0xc0);
				r12d = r12d ^  *(_t1246 + 0x40);
				r12d = r12d ^  *(_t1246 + 0x34);
				r8d = r8d + (r9d ^ r10d ^ r11d) + _t1024 + r12d;
				r12d = r12d ^ r14d;
				asm("inc ecx");
				( *(_t1246 + 0x20))[4] = r12d;
				 *(_t1246 + 0xc0) = r12d;
				r12d = r12d + 0x6ed9eba1;
				asm("rol eax, 0x5");
				r12d =  *(_t1246 + 0x38);
				asm("ror edx, 0x2");
				r12d = r12d ^  *(_t1246 + 0x3c);
				r9d = r9d + (r10d ^ r11d ^ _t1024) + r8d + r12d;
				r12d = r12d ^ r15d;
				r12d = r12d ^ _t1109;
				asm("inc ecx");
				asm("inc ecx");
				( *(_t1246 + 0x20))[5] = r12d;
				_t1113 =  *(_t1246 + 0xc8) ^  *(_t1246 + 0x2c) ^ _t1071 ^ r14d;
				r14d =  *(_t1246 + 0xc0);
				 *(_t1246 + 0x48) = r12d;
				r12d = r12d + 0x6ed9eba1;
				asm("rol esi, 1");
				 *(_t1246 + 0x50) = _t1113;
				asm("rol eax, 0x5");
				_t1250 =  *(_t1246 + 0x20);
				 *(_t1250 + 0x18) = _t1113;
				r10d = r10d + (r8d ^ r11d ^ _t1024) + r9d + r12d;
				asm("rol eax, 0x5");
				r11d = r11d + (r8d ^ r9d ^ _t1024) + r10d + 0x6ed9eba1 + _t1113;
				asm("inc ecx");
				r14d = r14d ^  *(_t1246 + 0x58);
				_t1231 =  *(_t1246 + 0x20);
				r14d = r14d ^ r13d;
				asm("rol eax, 0x5");
				r14d = r14d ^ r15d;
				r15d =  *(_t1246 + 0x44);
				asm("inc ecx");
				 *(_t1250 + 0x1c) = r14d;
				asm("inc ecx");
				r12d =  *(_t1246 + 0x30);
				_t714 = (r8d ^ r9d ^ r10d) + r11d + r14d + _t1024 + 0x6ed9eba1;
				 *(_t1246 + 0x54) = r14d;
				_t546 = r15d ^ r12d ^ _t1071 ^  *(_t1246 + 0x48);
				asm("rol edx, 0x5");
				r13d =  *(_t1246 + 0x38);
				_t1075 =  *(_t1246 + 0x40) ^ _t1161 ^ r13d ^ _t1113;
				asm("rol eax, 1");
				 *(_t1231 + 0x20) = _t546;
				 *(_t1246 + 0x30) = _t546;
				asm("rol edi, 1");
				 *(_t1246 + 0x28) = _t1075;
				asm("inc ecx");
				( *(_t1246 + 0x20))[9] = _t1075;
				r8d = __rdx - 0x70e44324;
				r8d = r8d + ((r10d | r11d) & r9d | r10d & r11d) +  *(_t1246 + 0x30) + r8d;
				asm("rol edx, 0x5");
				asm("ror ebx, 0x2");
				_t1076 =  *(_t1246 + 0x34);
				r9d = __rdx - 0x70e44324;
				r9d = r9d + ((r11d | _t714) & r10d | r11d & _t714) + _t1075 + r9d;
				_t1251 =  *(_t1246 + 0x20);
				_t1117 = r13d ^ _t1076 ^ r12d ^ r14d;
				asm("rol esi, 1");
				 *(_t1246 + 0x34) = _t1117;
				asm("rol edx, 0x5");
				r10d = __rdx - 0x70e44324;
				 *(_t1251 + 0x28) = _t1117;
				asm("inc ecx");
				r14d =  *(_t1246 + 0xc8);
				r10d = r10d + ((r8d | _t714) & r11d | r8d & _t714) + _t1117 + r10d;
				r14d = r14d ^  *(_t1246 + 0x3c);
				r14d = r14d ^ _t1161;
				r14d = r14d ^  *(_t1246 + 0x30);
				asm("rol edx, 0x5");
				asm("inc ecx");
				 *(_t1251 + 0x2c) = r14d;
				asm("inc ecx");
				r11d = __rdx - 0x70e44324;
				 *(_t1246 + 0x38) = r14d;
				r14d =  *(_t1246 + 0x2c);
				r11d = r11d + ((r8d | r9d) & _t714 | r8d & r9d) + r14d + r11d;
				asm("rol edx, 0x5");
				_t1165 =  *(_t1246 + 0xc0) ^ r14d ^ _t1076 ^  *(_t1246 + 0x28);
				asm("rol ebp, 1");
				 *(_t1251 + 0x30) = _t1165;
				asm("inc ecx");
				r12d =  *(_t1246 + 0x58);
				r12d = r12d ^  *(_t1246 + 0x3c);
				_t716 = __rdx - 0x70e44324 + ((r9d | r10d) & r8d | r9d & r10d) + _t1165 + _t714;
				r12d = r12d ^ _t1117;
				r12d = r12d ^  *(_t1246 + 0x48);
				asm("inc ecx");
				asm("rol edx, 0x5");
				r8d = __rdx - 0x70e44324;
				r8d = r8d + ((r10d | r11d) & r9d | r10d & r11d) + r12d + r8d;
				 *(_t1246 + 0x2c) = _t1165;
				asm("inc ecx");
				_t1121 = r15d ^ r14d ^  *(_t1246 + 0x38) ^  *(_t1246 + 0x50);
				_t1243 =  *(_t1246 + 0x20);
				asm("rol esi, 1");
				asm("rol edx, 0x5");
				 *(_t1246 + 0x3c) = r12d;
				 *(_t1243 + 0x34) = r12d;
				 *(_t1246 + 0x4c) = _t1121;
				 *(_t1243 + 0x38) = _t1121;
				asm("ror ebx, 0x2");
				_t1122 =  *(_t1246 + 0x40);
				r9d = __rdx - 0x70e44324;
				r9d = r9d + ((r11d | _t716) & r10d | r11d & _t716) + _t1121 + r9d;
				_t1263 =  *(_t1246 + 0x20);
				_t1169 = _t1122 ^  *(_t1246 + 0x58) ^  *(_t1246 + 0x2c) ^  *(_t1246 + 0x54);
				_t1080 = r13d ^ r15d ^ r12d ^  *(_t1246 + 0x30);
				r12d =  *(_t1246 + 0xc8);
				asm("rol ebp, 1");
				r12d = r12d ^ _t1122;
				r12d = r12d ^  *(_t1246 + 0x4c);
				( *(_t1246 + 0x20))[0xf] = _t1169;
				r12d = r12d ^  *(_t1246 + 0x28);
				asm("rol edi, 1");
				 *_t1263 = _t1080;
				asm("inc ecx");
				asm("inc ecx");
				_t1263[1] = r12d;
				r15d =  *(_t1246 + 0xc0);
				r15d = r15d ^ r13d;
				_t1255 =  *(_t1246 + 0x20);
				r15d = r15d ^ _t1169;
				r15d = r15d ^  *(_t1246 + 0x34);
				 *(_t1246 + 0x44) = _t1169;
				 *(_t1246 + 0x40) = _t1080;
				asm("rol edx, 0x5");
				 *(_t1246 + 0x58) = r12d;
				r10d = __rdx - 0x70e44324;
				asm("inc ecx");
				r10d = r10d + ((r8d | _t716) & r11d | r8d & _t716) + _t1169 + r10d;
				 *(_t1246 + 0x5c) = r15d;
				 *(_t1255 + 8) = r15d;
				asm("rol edx, 0x5");
				r11d = __rdx - 0x70e44324;
				r11d = r11d + ((r8d | r9d) & _t716 | r8d & r9d) + _t1080 + r11d;
				asm("inc ecx");
				asm("rol edx, 0x5");
				asm("inc ecx");
				_t718 = __rdx - 0x70e44324 + ((r9d | r10d) & r8d | r9d & r10d) + r12d + _t716;
				asm("rol edx, 0x5");
				asm("inc ecx");
				_t1237 =  *(_t1246 + 0x20);
				r8d = __rdx - 0x70e44324;
				_t1173 =  *(_t1246 + 0xc8) ^ _t1080 ^  *(_t1246 + 0x38) ^  *(_t1246 + 0x48);
				r8d = r8d + ((r10d | r11d) & r9d | r10d & r11d) + r15d + r8d;
				r14d = r15d;
				r14d = r14d ^  *(_t1246 + 0x3c);
				asm("rol ebp, 1");
				asm("rol edx, 0x5");
				 *(_t1255 + 0xc) = _t1173;
				asm("ror ebx, 0x2");
				r13d =  *(_t1246 + 0xc0);
				r9d = __rdx - 0x70e44324;
				r9d = r9d + ((r11d | _t718) & r10d | r11d & _t718) + _t1173 + r9d;
				r13d = r13d ^ r12d;
				 *(_t1246 + 0xc8) = _t1173;
				r13d = r13d ^  *(_t1246 + 0x2c);
				r13d = r13d ^  *(_t1246 + 0x50);
				_t1176 = _t1173 ^  *(_t1246 + 0x4c) ^  *(_t1246 + 0x30) ^  *(_t1246 + 0x50);
				asm("inc ecx");
				( *(_t1246 + 0x20))[4] = r13d;
				asm("inc ecx");
				asm("rol ebp, 1");
				 *(_t1237 + 0x18) = _t1176;
				asm("rol edx, 0x5");
				 *(_t1246 + 0xc0) = r13d;
				r13d =  *(_t1246 + 0x54);
				r10d = __rdx - 0x70e44324;
				r14d = r14d ^ r13d;
				r14d = r14d ^  *(_t1246 + 0x48);
				r10d = r10d + ((r8d | _t718) & r11d | r8d & _t718) + r13d + r10d;
				asm("inc ecx");
				 *(_t1237 + 0x14) = r14d;
				asm("inc ecx");
				 *(_t1246 + 0x48) = r14d;
				asm("rol edx, 0x5");
				 *(_t1246 + 0x54) = _t1176;
				r11d = r11d + ((r8d | r9d) & _t718 | r8d & r9d) + 0x8f1bbcdc + r14d;
				r11d = r11d + r10d;
				asm("rol edi, 0x5");
				asm("inc ecx");
				_t1126 =  *(_t1246 + 0xc0) ^  *(_t1246 + 0x44) ^  *(_t1246 + 0x28) ^ r13d;
				r13d =  *(_t1246 + 0x40);
				r13d = r13d ^  *(_t1246 + 0x34);
				_t1082 = r11d + ((r9d | r10d) & r8d | r9d & r10d) + _t1176 + _t718 + 0x8f1bbcdc;
				r13d = r13d ^  *(_t1246 + 0x30);
				asm("rol esi, 1");
				( *(_t1246 + 0x20))[7] = _t1126;
				r13d = r13d ^ r14d;
				r14d =  *(_t1246 + 0x38);
				r12d = r12d ^ r14d;
				r12d = r12d ^  *(_t1246 + 0x28);
				asm("inc ecx");
				r12d = r12d ^ _t1176;
				asm("inc ecx");
				( *(_t1246 + 0x20))[8] = r13d;
				asm("inc ecx");
				asm("rol ebx, 0x5");
				_t721 = _t1082 + ((r10d | r11d) & r9d | r10d & r11d) + 0x8f1bbcdc + _t1126 + r8d;
				_t1180 = r15d ^  *(_t1246 + 0x2c) ^  *(_t1246 + 0x34) ^ _t1126;
				 *(_t1246 + 0x50) = _t1126;
				_t1240 =  *(_t1246 + 0x20);
				 *(_t1246 + 0x30) = r13d;
				asm("ror edi, 0x2");
				 *(_t1246 + 0x38) = r12d;
				asm("rol edx, 0x5");
				asm("rol ebp, 1");
				( *(_t1246 + 0x20))[9] = r12d;
				r9d = __rdx - 0x70e44324;
				r9d = r9d + ((r11d | _t1082) & r10d | r11d & _t1082) + r13d + r9d;
				 *(_t1246 + 0x34) = _t1180;
				 *(_t1240 + 0x28) = _t1180;
				asm("rol edx, 0x5");
				r10d = __rdx - 0x70e44324;
				asm("ror ebx, 0x2");
				r10d = r10d + ((_t721 | _t1082) & r11d | _t721 & _t1082) + r12d + r10d;
				asm("rol edx, 0x5");
				r15d =  *(_t1246 + 0xc8);
				r15d = r15d ^  *(_t1246 + 0x3c);
				asm("inc ecx");
				r15d = r15d ^ r14d;
				r14d =  *(_t1246 + 0xc0);
				r14d = r14d ^  *(_t1246 + 0x4c);
				r14d = r14d ^  *(_t1246 + 0x2c);
				r11d = __rdx - 0x70e44324;
				r15d = r15d ^ r13d;
				r11d = r11d + ((_t721 | r9d) & _t1082 | _t721 & r9d) + _t1180 + r11d;
				r14d = r14d ^ r12d;
				asm("inc ecx");
				r8d = r11d;
				asm("inc ecx");
				 *(_t1240 + 0x2c) = r15d;
				asm("inc ecx");
				 *(_t1240 + 0x30) = r14d;
				_t1130 =  *(_t1246 + 0x44) ^  *(_t1246 + 0x3c) ^ _t1180 ^  *(_t1246 + 0x48);
				asm("inc ecx");
				asm("inc ecx");
				_t1220 =  *(_t1246 + 0x20);
				r8d = r8d + ((r9d | r10d) & _t721 | r9d & r10d) + 0x8f1bbcdc + r15d + _t1082;
				 *(_t1246 + 0x28) = r15d;
				_t1184 =  *(_t1246 + 0x40) ^  *(_t1246 + 0x4c) ^ r15d ^  *(_t1246 + 0x54);
				asm("rol esi, 1");
				 *(_t1246 + 0x2c) = r14d;
				asm("rol ebp, 1");
				 *(_t1246 + 0x3c) = _t1130;
				 *(_t1220 + 0x34) = _t1130;
				asm("rol edx, 0x5");
				 *(_t1246 + 0x4c) = _t1184;
				_t1044 = r8d + (r9d ^ r10d ^ r11d) + r14d + _t721 + 0xca62c1d6;
				 *(_t1220 + 0x38) = _t1184;
				asm("rol ecx, 0x5");
				r9d = _t1231 - 0x359d3e2a;
				r9d = r9d + (r10d ^ r11d ^ r8d) + _t1130 + r9d;
				asm("inc ecx");
				asm("rol ecx, 0x5");
				r10d = _t1231 - 0x359d3e2a;
				r10d = r10d + (_t1044 ^ r11d ^ r8d) + _t1184 + r10d;
				asm("ror edx, 0x2");
				asm("rol ecx, 0x5");
				_t726 =  *(_t1246 + 0x58) ^  *(_t1246 + 0x44) ^ r14d ^  *(_t1246 + 0x50);
				_t1086 =  *(_t1246 + 0x5c) ^  *(_t1246 + 0x40) ^ _t1130 ^ r13d;
				r13d =  *(_t1246 + 0xc8);
				r13d = r13d ^  *(_t1246 + 0x58);
				asm("rol ebx, 1");
				( *(_t1246 + 0x20))[0xf] = _t726;
				asm("rol edi, 1");
				 *(_t1246 + 0x44) = _t726;
				asm("inc ecx");
				r13d = r13d ^ _t1184;
				 *(_t1246 + 0x60) = _t1086;
				r13d = r13d ^ r12d;
				r12d =  *(_t1246 + 0xc0);
				r12d = r12d ^  *(_t1246 + 0x5c);
				r11d = _t1231 - 0x359d3e2a;
				r11d = r11d + (_t1044 ^ r9d ^ r8d) + _t726 + r11d;
				asm("inc ecx");
				 *( *(_t1246 + 0x20)) = _t1086;
				r12d = r12d ^ _t726;
				r12d = r12d ^  *(_t1246 + 0x34);
				asm("inc ecx");
				_t730 =  *(_t1246 + 0xc8) ^ _t1086 ^ r15d ^  *(_t1246 + 0x48);
				asm("rol ecx, 0x5");
				asm("inc ecx");
				r8d = _t1231 - 0x359d3e2a;
				r8d = r8d + (_t1044 ^ r9d ^ r10d) + _t1086 + r8d;
				asm("rol ebx, 1");
				( *(_t1246 + 0x20))[1] = r13d;
				 *(_t1246 + 0xc8) = _t730;
				asm("rol ecx, 0x5");
				asm("inc ecx");
				_t1046 = _t1231 - 0x359d3e2a + (r9d ^ r10d ^ r11d) + r13d + _t1044;
				( *(_t1246 + 0x20))[2] = r12d;
				asm("rol ecx, 0x5");
				r9d = _t1231 - 0x359d3e2a;
				asm("inc ecx");
				r9d = r9d + (r10d ^ r11d ^ r8d) + r12d + r9d;
				( *(_t1246 + 0x20))[3] = _t730;
				asm("rol ecx, 0x5");
				r15d =  *(_t1246 + 0xc0);
				asm("ror edx, 0x2");
				r15d = r15d ^ r13d;
				r15d = r15d ^ r14d;
				_t1258 =  *(_t1246 + 0x20);
				r15d = r15d ^  *(_t1246 + 0x54);
				_t732 = _t1231 - 0x359d3e2a + (_t1046 ^ r11d ^ r8d) + _t730 + r10d;
				asm("inc ecx");
				 *(_t1258 + 0x10) = r15d;
				 *(_t1246 + 0xc0) = r15d;
				r15d = r15d + 0xca62c1d6;
				asm("inc ecx");
				r15d = r12d;
				r11d = r11d + (_t1046 ^ r9d ^ r8d) + r15d;
				r15d = r15d ^ _t1130;
				asm("rol ecx, 0x5");
				r15d = r15d ^  *(_t1246 + 0x50);
				r15d = r15d ^  *(_t1246 + 0x48);
				r11d = r11d + _t732;
				asm("inc ecx");
				 *(_t1258 + 0x14) = r15d;
				r14d =  *(_t1246 + 0xc8);
				r14d = r14d ^ _t1184;
				asm("ror ebx, 0x2");
				r14d = r14d ^  *(_t1246 + 0x30);
				r14d = r14d ^  *(_t1246 + 0x54);
				r8d = _t1086;
				asm("rol esi, 0x5");
				r8d = r8d ^  *(_t1246 + 0x34);
				asm("inc ecx");
				_t1188 =  *(_t1246 + 0xc0) ^  *(_t1246 + 0x44) ^  *(_t1246 + 0x38) ^  *(_t1246 + 0x50);
				r8d = r8d ^  *(_t1246 + 0x30);
				_t1132 = r11d + (_t1046 ^ r9d ^ _t732) + 0xca62c1d6 + r15d + r8d;
				r8d = r8d ^ r15d;
				( *(_t1246 + 0x20))[6] = r14d;
				asm("rol ebp, 1");
				r10d = _t1132;
				_t1234 =  *(_t1246 + 0x20);
				 *(_t1234 + 0x1c) = _t1188;
				asm("inc ecx");
				r10d = r10d + (r9d ^ _t732 ^ r11d) + r14d + _t1046 + 0xca62c1d6;
				asm("inc ecx");
				r9d = r9d + (_t732 ^ r11d ^ _t1132) + 0xca62c1d6 + _t1188;
				asm("rol ecx, 0x5");
				r9d = r9d + r10d;
				asm("ror esi, 0x2");
				asm("inc ecx");
				r12d = r12d ^  *(_t1246 + 0x2c);
				 *(_t1234 + 0x20) = r8d;
				r12d = r12d ^  *(_t1246 + 0x34);
				asm("inc ecx");
				r11d = r11d + 0xca62c1d6;
				r12d = r12d ^ _t1188;
				asm("rol edi, 0x5");
				asm("inc ecx");
				_t1088 = r9d + (r10d ^ r11d ^ _t1132) + r8d + _t732 + 0xca62c1d6;
				_t1051 = r13d ^  *(_t1246 + 0x28) ^  *(_t1246 + 0x38) ^ r14d;
				asm("rol edx, 1");
				( *(_t1246 + 0x20))[9] = _t1051;
				asm("rol ebx, 0x5");
				_t735 = _t1088 + (r10d ^ r9d ^ _t1132) + _t1051 + r11d;
				asm("inc ecx");
				( *(_t1246 + 0x20))[0xa] = r12d;
				r11d = _t735;
				asm("inc ecx");
				r12d = r12d ^  *(_t1246 + 0x44);
				asm("ror edi, 0x2");
				r11d = r11d + (r10d ^ r9d ^ _t1088) + r12d + _t1132 + 0xca62c1d6;
				_t1137 =  *(_t1246 + 0xc8) ^  *(_t1246 + 0x3c) ^  *(_t1246 + 0x28) ^ r8d;
				r8d =  *(_t1246 + 0xc0);
				r8d = r8d ^ _t1051;
				asm("rol ecx, 0x5");
				r8d = r8d ^  *(_t1246 + 0x4c);
				r8d = r8d ^  *(_t1246 + 0x2c);
				asm("rol esi, 1");
				( *(_t1246 + 0x20))[0xb] = _t1137;
				asm("inc ecx");
				 *(_t1246 + 0xc0) = r8d;
				r10d = _t1231 - 0x359d3e2a;
				asm("ror ebx, 0x2");
				r10d = r10d + (r9d ^ _t1088 ^ _t735) + _t1137 + r10d;
				( *(_t1246 + 0x20))[0xc] = r8d;
				asm("rol ecx, 0x5");
				asm("inc ecx");
				r9d = _t1231 - 0x359d3e2a;
				r9d = r9d + (_t1088 ^ _t735 ^ r11d) + r8d + r9d;
				r12d = r12d ^  *(_t1246 + 0x3c);
				r13d = r13d ^  *(_t1246 + 0x44);
				r12d = r12d ^ r15d;
				_t1264 =  *(_t1246 + 0x20);
				asm("inc ecx");
				 *(_t1264 + 0x34) = r12d;
				_t1055 =  *(_t1246 + 0x60) ^ _t1137 ^  *(_t1246 + 0x4c) ^ r14d;
				r13d = r13d ^ _t1188;
				r13d = r13d ^  *(_t1246 + 0xc0);
				r8d = r9d;
				asm("rol edx, 1");
				 *(_t1264 + 0x38) = _t1055;
				asm("inc ecx");
				r8d = r8d + (r10d ^ _t735 ^ r11d) + 0xca62c1d6 + r12d + _t1088;
				asm("inc ecx");
				asm("inc ecx");
				 *(_t1264 + 0x3c) = r13d;
				asm("rol ecx, 0x5");
				asm("inc ecx");
				_t1057 = _t1231 - 0x359d3e2a + (r10d ^ r9d ^ r11d) + _t1055 + _t735;
				asm("rol ecx, 0x5");
				asm("inc ecx");
				_t687 = (r10d ^ r9d ^ r8d) + r13d + _t1057 + 0xca62c1d6 + r11d;
				_t1232 =  *((intOrPtr*)(_t1246 + 0xb0));
				 *_t1232 =  *_t1232 + _t687;
				 *((intOrPtr*)(_t1232 + 4)) =  *((intOrPtr*)(_t1232 + 4)) + _t1057;
				 *((intOrPtr*)(_t1232 + 8)) =  *((intOrPtr*)(_t1232 + 8)) + r8d;
				 *((intOrPtr*)(_t1232 + 0xc)) =  *((intOrPtr*)(_t1232 + 0xc)) + r9d;
				 *((intOrPtr*)(_t1232 + 0x10)) =  *((intOrPtr*)(_t1232 + 0x10)) + r10d;
				return _t687;
			}







































































































    0x14000ea48
    0x14000ea4d
    0x14000ea5d
    0x14000ea64
    0x14000ea6f
    0x14000ea71
    0x14000ea7a
    0x14000ea7f
    0x14000ea84
    0x14000ea89
    0x14000ea8d
    0x14000ea91
    0x14000ea93
    0x14000ea96
    0x14000ea9d
    0x14000eaa0
    0x14000eaac
    0x14000eab0
    0x14000eab9
    0x14000eabc
    0x14000eac8
    0x14000eacc
    0x14000ead2
    0x14000ead9
    0x14000eae0
    0x14000eae3
    0x14000eaea
    0x14000eaf0
    0x14000eaf5
    0x14000eafe
    0x14000eb06
    0x14000eb09
    0x14000eb0e
    0x14000eb15
    0x14000eb1c
    0x14000eb29
    0x14000eb2c
    0x14000eb2f
    0x14000eb35
    0x14000eb38
    0x14000eb3b
    0x14000eb41
    0x14000eb45
    0x14000eb47
    0x14000eb4f
    0x14000eb55
    0x14000eb5c
    0x14000eb5f
    0x14000eb65
    0x14000eb68
    0x14000eb6b
    0x14000eb6f
    0x14000eb72
    0x14000eb78
    0x14000eb7e
    0x14000eb86
    0x14000eb89
    0x14000eb8c
    0x14000eb8f
    0x14000eb96
    0x14000eb99
    0x14000eba3
    0x14000eba6
    0x14000ebae
    0x14000ebb7
    0x14000ebbe
    0x14000ebc1
    0x14000ebc5
    0x14000ebcb
    0x14000ebce
    0x14000ebd6
    0x14000ebdd
    0x14000ebe2
    0x14000ebef
    0x14000ebf5
    0x14000ebfb
    0x14000ebfd
    0x14000ec04
    0x14000ec08
    0x14000ec1a
    0x14000ec1d
    0x14000ec26
    0x14000ec2f
    0x14000ec3a
    0x14000ec3d
    0x14000ec46
    0x14000ec4a
    0x14000ec5b
    0x14000ec5d
    0x14000ec66
    0x14000ec6f
    0x14000ec79
    0x14000ec7c
    0x14000ec82
    0x14000ec88
    0x14000ec8c
    0x14000ec8f
    0x14000ec92
    0x14000ec96
    0x14000ec99
    0x14000eca0
    0x14000ecac
    0x14000ecb7
    0x14000ecbc
    0x14000ecc5
    0x14000ecca
    0x14000ecd0
    0x14000ecd3
    0x14000ecd9
    0x14000ece1
    0x14000ece8
    0x14000eceb
    0x14000ecef
    0x14000ecf7
    0x14000ed01
    0x14000ed0c
    0x14000ed1b
    0x14000ed1f
    0x14000ed22
    0x14000ed25
    0x14000ed2b
    0x14000ed31
    0x14000ed37
    0x14000ed3c
    0x14000ed41
    0x14000ed4c
    0x14000ed51
    0x14000ed55
    0x14000ed58
    0x14000ed5b
    0x14000ed61
    0x14000ed65
    0x14000ed68
    0x14000ed6d
    0x14000ed72
    0x14000ed75
    0x14000ed78
    0x14000ed7c
    0x14000ed7f
    0x14000ed82
    0x14000ed8a
    0x14000ed8e
    0x14000ed91
    0x14000ed97
    0x14000ed9e
    0x14000eda5
    0x14000eda8
    0x14000edae
    0x14000edb3
    0x14000edb6
    0x14000edbc
    0x14000edc5
    0x14000edc8
    0x14000edcc
    0x14000edcf
    0x14000edd2
    0x14000edd5
    0x14000edd8
    0x14000edde
    0x14000ede1
    0x14000ede8
    0x14000edeb
    0x14000edee
    0x14000edf1
    0x14000edf7
    0x14000edfa
    0x14000ee09
    0x14000ee0e
    0x14000ee11
    0x14000ee15
    0x14000ee19
    0x14000ee1c
    0x14000ee1f
    0x14000ee22
    0x14000ee2a
    0x14000ee2d
    0x14000ee31
    0x14000ee36
    0x14000ee38
    0x14000ee44
    0x14000ee48
    0x14000ee4a
    0x14000ee58
    0x14000ee62
    0x14000ee66
    0x14000ee6a
    0x14000ee70
    0x14000ee73
    0x14000ee76
    0x14000ee82
    0x14000ee84
    0x14000ee89
    0x14000ee8c
    0x14000ee8f
    0x14000ee93
    0x14000ee99
    0x14000ee9c
    0x14000eea2
    0x14000eea8
    0x14000eeb6
    0x14000eec0
    0x14000eec9
    0x14000eece
    0x14000eed1
    0x14000eed5
    0x14000eedb
    0x14000eee5
    0x14000eef0
    0x14000eef5
    0x14000eefc
    0x14000ef02
    0x14000ef06
    0x14000ef1c
    0x14000ef26
    0x14000ef2d
    0x14000ef33
    0x14000ef35
    0x14000ef3b
    0x14000ef4c
    0x14000ef4f
    0x14000ef61
    0x14000ef78
    0x14000ef7f
    0x14000ef83
    0x14000ef88
    0x14000ef8f
    0x14000ef91
    0x14000ef98
    0x14000efa8
    0x14000efaf
    0x14000efb5
    0x14000efbf
    0x14000efca
    0x14000efce
    0x14000efd1
    0x14000efd4
    0x14000efd9
    0x14000efe6
    0x14000efeb
    0x14000efee
    0x14000eff0
    0x14000eff7
    0x14000effa
    0x14000efff
    0x14000f00f
    0x14000f016
    0x14000f01d
    0x14000f026
    0x14000f032
    0x14000f034
    0x14000f03f
    0x14000f048
    0x14000f04a
    0x14000f04d
    0x14000f05c
    0x14000f067
    0x14000f070
    0x14000f073
    0x14000f078
    0x14000f07b
    0x14000f07e
    0x14000f08c
    0x14000f08f
    0x14000f0a3
    0x14000f0a6
    0x14000f0a8
    0x14000f0ac
    0x14000f0b5
    0x14000f0c8
    0x14000f0cb
    0x14000f0de
    0x14000f0e1
    0x14000f0e3
    0x14000f0e6
    0x14000f0f7
    0x14000f111
    0x14000f114
    0x14000f120
    0x14000f122
    0x14000f124
    0x14000f127
    0x14000f138
    0x14000f143
    0x14000f15f
    0x14000f162
    0x14000f16b
    0x14000f16d
    0x14000f172
    0x14000f17f
    0x14000f186
    0x14000f192
    0x14000f19e
    0x14000f1a0
    0x14000f1a2
    0x14000f1a5
    0x14000f1b6
    0x14000f1ce
    0x14000f1d2
    0x14000f1d8
    0x14000f1db
    0x14000f1e2
    0x14000f1e6
    0x14000f1fb
    0x14000f203
    0x14000f219
    0x14000f222
    0x14000f227
    0x14000f229
    0x14000f22f
    0x14000f232
    0x14000f236
    0x14000f248
    0x14000f254
    0x14000f256
    0x14000f258
    0x14000f25a
    0x14000f269
    0x14000f26d
    0x14000f285
    0x14000f291
    0x14000f294
    0x14000f296
    0x14000f299
    0x14000f2a0
    0x14000f2ab
    0x14000f2b1
    0x14000f2b8
    0x14000f2c9
    0x14000f2d3
    0x14000f2d7
    0x14000f2d9
    0x14000f2dc
    0x14000f2e6
    0x14000f2ec
    0x14000f2f1
    0x14000f2f8
    0x14000f2fc
    0x14000f306
    0x14000f30e
    0x14000f31a
    0x14000f31c
    0x14000f322
    0x14000f32b
    0x14000f32e
    0x14000f332
    0x14000f33a
    0x14000f33e
    0x14000f347
    0x14000f34d
    0x14000f355
    0x14000f361
    0x14000f366
    0x14000f36f
    0x14000f372
    0x14000f377
    0x14000f37b
    0x14000f383
    0x14000f38d
    0x14000f393
    0x14000f398
    0x14000f39b
    0x14000f3a7
    0x14000f3aa
    0x14000f3b0
    0x14000f3c1
    0x14000f3c9
    0x14000f3cc
    0x14000f3d0
    0x14000f3d3
    0x14000f3de
    0x14000f3e3
    0x14000f3ea
    0x14000f3ec
    0x14000f3f0
    0x14000f3f6
    0x14000f3fd
    0x14000f402
    0x14000f410
    0x14000f41c
    0x14000f41f
    0x14000f423
    0x14000f428
    0x14000f433
    0x14000f43c
    0x14000f442
    0x14000f445
    0x14000f44d
    0x14000f453
    0x14000f458
    0x14000f45c
    0x14000f469
    0x14000f46b
    0x14000f478
    0x14000f47c
    0x14000f484
    0x14000f489
    0x14000f48e
    0x14000f490
    0x14000f493
    0x14000f497
    0x14000f49f
    0x14000f4ac
    0x14000f4bb
    0x14000f4c4
    0x14000f4cd
    0x14000f4dd
    0x14000f4e5
    0x14000f4e8
    0x14000f4f1
    0x14000f4f8
    0x14000f4fe
    0x14000f505
    0x14000f515
    0x14000f519
    0x14000f51d
    0x14000f523
    0x14000f52a
    0x14000f52f
    0x14000f533
    0x14000f53b
    0x14000f53e
    0x14000f54c
    0x14000f556
    0x14000f565
    0x14000f568
    0x14000f56e
    0x14000f573
    0x14000f57a
    0x14000f581
    0x14000f586
    0x14000f58b
    0x14000f59d
    0x14000f5a2
    0x14000f5ae
    0x14000f5b2
    0x14000f5b7
    0x14000f5bb
    0x14000f5c8
    0x14000f5cd
    0x14000f5d5
    0x14000f5db
    0x14000f5ea
    0x14000f5f3
    0x14000f5fc
    0x14000f607
    0x14000f60a
    0x14000f60e
    0x14000f612
    0x14000f616
    0x14000f61b
    0x14000f62d
    0x14000f630
    0x14000f637
    0x14000f63b
    0x14000f641
    0x14000f647
    0x14000f64a
    0x14000f653
    0x14000f663
    0x14000f66d
    0x14000f675
    0x14000f679
    0x14000f67d
    0x14000f685
    0x14000f687
    0x14000f68d
    0x14000f694
    0x14000f697
    0x14000f69c
    0x14000f6a1
    0x14000f6a4
    0x14000f6ac
    0x14000f6b0
    0x14000f6b4
    0x14000f6c3
    0x14000f6c6
    0x14000f6ce
    0x14000f6d4
    0x14000f6dc
    0x14000f6e0
    0x14000f6e4
    0x14000f6e7
    0x14000f6ec
    0x14000f6f3
    0x14000f6f6
    0x14000f6fc
    0x14000f707
    0x14000f714
    0x14000f717
    0x14000f71e
    0x14000f721
    0x14000f737
    0x14000f73f
    0x14000f74e
    0x14000f75b
    0x14000f761
    0x14000f773
    0x14000f77f
    0x14000f786
    0x14000f78a
    0x14000f79a
    0x14000f79d
    0x14000f7a5
    0x14000f7ae
    0x14000f7b3
    0x14000f7b7
    0x14000f7ba
    0x14000f7c5
    0x14000f7cc
    0x14000f7cf
    0x14000f7d2
    0x14000f7d9
    0x14000f7e5
    0x14000f7f0
    0x14000f7f7
    0x14000f7fa
    0x14000f801
    0x14000f80a
    0x14000f80e
    0x14000f811
    0x14000f817
    0x14000f81f
    0x14000f827
    0x14000f82e
    0x14000f831
    0x14000f836
    0x14000f83f
    0x14000f84a
    0x14000f853
    0x14000f85d
    0x14000f862
    0x14000f868
    0x14000f86f
    0x14000f875
    0x14000f87e
    0x14000f88e
    0x14000f8ab
    0x14000f8ae
    0x14000f8b3
    0x14000f8b8
    0x14000f8bd
    0x14000f8c5
    0x14000f8ca
    0x14000f8d3
    0x14000f8d6
    0x14000f8e2
    0x14000f8e5
    0x14000f8ea
    0x14000f8f6
    0x14000f901
    0x14000f908
    0x14000f90c
    0x14000f916
    0x14000f919
    0x14000f91d
    0x14000f924
    0x14000f928
    0x14000f92f
    0x14000f937
    0x14000f93a
    0x14000f941
    0x14000f94c
    0x14000f94e
    0x14000f955
    0x14000f95e
    0x14000f96a
    0x14000f971
    0x14000f979
    0x14000f97f
    0x14000f986
    0x14000f989
    0x14000f991
    0x14000f994
    0x14000f9a1
    0x14000f9ab
    0x14000f9b1
    0x14000f9b4
    0x14000f9c1
    0x14000f9cc
    0x14000f9d1
    0x14000f9d8
    0x14000f9db
    0x14000f9e1
    0x14000f9e4
    0x14000f9ea
    0x14000f9ed
    0x14000f9f2
    0x14000f9f6
    0x14000f9fc
    0x14000fa24
    0x14000fa2b
    0x14000fa37
    0x14000fa3d
    0x14000fa42
    0x14000fa48
    0x14000fa4d
    0x14000fa51
    0x14000fa56
    0x14000fa5b
    0x14000fa5d
    0x14000fa61
    0x14000fa64
    0x14000fa67
    0x14000fa6b
    0x14000fa70
    0x14000fa80
    0x14000fa83
    0x14000fa8a
    0x14000fa8d
    0x14000faa1
    0x14000faa4
    0x14000faab
    0x14000faae
    0x14000fac9
    0x14000facf
    0x14000fad5
    0x14000fad8
    0x14000fae0
    0x14000fae5
    0x14000fae7
    0x14000faec
    0x14000faf1
    0x14000faf5
    0x14000fafc
    0x14000faff
    0x14000fb05
    0x14000fb08
    0x14000fb10
    0x14000fb18
    0x14000fb1f
    0x14000fb22
    0x14000fb2a
    0x14000fb2c
    0x14000fb36
    0x14000fb48
    0x14000fb4b
    0x14000fb52
    0x14000fb5a
    0x14000fb5e
    0x14000fb65
    0x14000fb68
    0x14000fb6f
    0x14000fb7c
    0x14000fb83
    0x14000fb8c
    0x14000fb98
    0x14000fb9f
    0x14000fbb1
    0x14000fbb7
    0x14000fbbe
    0x14000fbc2
    0x14000fbcd
    0x14000fbd0
    0x14000fbd3
    0x14000fbdd
    0x14000fbe3
    0x14000fbe9
    0x14000fbec
    0x14000fbf1
    0x14000fc01
    0x14000fc03
    0x14000fc0b
    0x14000fc0f
    0x14000fc1a
    0x14000fc21
    0x14000fc2a
    0x14000fc2d
    0x14000fc30
    0x14000fc35
    0x14000fc38
    0x14000fc40
    0x14000fc47
    0x14000fc4f
    0x14000fc5b
    0x14000fc5f
    0x14000fc6a
    0x14000fc6d
    0x14000fc70
    0x14000fc83
    0x14000fc88
    0x14000fc8b
    0x14000fc92
    0x14000fc97
    0x14000fc9a
    0x14000fc9e
    0x14000fca3
    0x14000fcaa
    0x14000fcad
    0x14000fcb1
    0x14000fcb8
    0x14000fcc3
    0x14000fcc8
    0x14000fccb
    0x14000fccf
    0x14000fcd4
    0x14000fce7
    0x14000fcea
    0x14000fced
    0x14000fcf0
    0x14000fcf3
    0x14000fcf6
    0x14000fcfb
    0x14000fd05
    0x14000fd0d
    0x14000fd14
    0x14000fd20
    0x14000fd26
    0x14000fd30
    0x14000fd39
    0x14000fd40
    0x14000fd45
    0x14000fd47
    0x14000fd4d
    0x14000fd60
    0x14000fd62
    0x14000fd6b
    0x14000fd72
    0x14000fd7a
    0x14000fd81
    0x14000fd86
    0x14000fd96
    0x14000fda5
    0x14000fda8
    0x14000fdb0
    0x14000fdb3
    0x14000fdb6
    0x14000fdbb
    0x14000fdc0
    0x14000fdc2
    0x14000fdc8
    0x14000fdcd
    0x14000fddc
    0x14000fde3
    0x14000fde6
    0x14000fdee
    0x14000fdf9
    0x14000fe02
    0x14000fe09
    0x14000fe10
    0x14000fe13
    0x14000fe18
    0x14000fe21
    0x14000fe24
    0x14000fe2b
    0x14000fe32
    0x14000fe3b
    0x14000fe3e
    0x14000fe41
    0x14000fe4c
    0x14000fe54
    0x14000fe59
    0x14000fe5d
    0x14000fe63
    0x14000fe66
    0x14000fe70
    0x14000fe76
    0x14000fe7a
    0x14000fe82
    0x14000fe96
    0x14000fea6
    0x14000feb2
    0x14000feb6
    0x14000feb8
    0x14000fec0
    0x14000fec2
    0x14000fec5
    0x14000fec9
    0x14000fecd
    0x14000fee0

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: memcpy
    • String ID:
    • API String ID: 3510742995-0
    • Opcode ID: 1b03f7ef480ea5865ac2d9ef79243ddcad7e3d9da8d43d155ca602e5c9a73022
    • Instruction ID: c8f745e53e58f4d3ff63e30af0f782c513ee99f48fb140b821e661274e727f8d
    • Opcode Fuzzy Hash: 1b03f7ef480ea5865ac2d9ef79243ddcad7e3d9da8d43d155ca602e5c9a73022
    • Instruction Fuzzy Hash: 1DC291B3A282408BD368CF69E85665BB7A1F7D8748F45A029FB87D3B44D63CD9018F44
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140010210 Relevance: .7, Instructions: 676COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 71%
    			E00000001140010210(void* __eflags, long long __rbx, long long __rcx, void* __rdx, signed int __r8, void* __r9, void* __r10, void* __r11, void* _a8, long long _a16, intOrPtr _a24) {
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _t301;
				signed int _t305;
				signed int _t308;
				signed int _t311;
				signed int _t451;
				signed int _t455;
				signed int _t459;
				signed int _t468;
				signed int _t471;
				signed int _t474;
				signed int _t477;
				signed int _t480;
				signed int _t483;
				signed int _t485;
				signed int _t487;
				signed int _t491;
				signed int _t494;
				signed int _t497;
				signed int _t499;
				signed int _t502;
				signed int _t505;
				signed int _t508;
				signed int _t511;
				signed int _t519;
				signed int _t528;
				intOrPtr _t529;
				intOrPtr _t530;
				signed char* _t537;
				signed char* _t538;
				void* _t539;
				void* _t541;
				signed int _t544;
				void* _t546;
				intOrPtr* _t547;
				void* _t548;

				_t548 = __r10;
				_t544 = __r8;
				_a16 = __rbx;
				_a8 = __rcx;
				r10d =  *(__rcx + 4);
				r11d =  *(__rcx + 8);
				r8d = 0;
				_a24 =  *((intOrPtr*)(__rcx));
				_t537 = __rdx + 2;
				_t7 = _t544 + 0x10; // 0x10
				r9d = _t7;
				_t538 =  &(_t537[4]);
				 *(_t541 + __r8 * 4 - 0x40) = (((_t537[1] & 0x000000ff) << 0x00000008 |  *_t537 & 0x000000ff) << 0x00000008 |  *(_t538 - 5) & 0x000000ff) << 0x00000008 |  *(_t538 - 6) & 0x000000ff;
				r8d = r8d + 1;
				_t546 = __r9 - 1;
				if (__eflags != 0) goto 0x40010247;
				r9d = __r11 + 0x242070db;
				r8d = __rbx - 0x173848aa;
				asm("rol edx, 0x7");
				_t480 = _t539 - 0x28955b88 + ( !r10d &  *(__rcx + 0xc) | r11d & r10d) + _v120 + r10d;
				r11d = _t538 - 0xa83f051;
				r8d = r8d + ( !_t480 & r11d | r10d & _t480) + _v116;
				asm("inc ecx");
				r8d = r8d + _t480;
				r10d = r10d + 0xc1bdceee;
				r9d = r9d + ( !r8d & r10d | r8d & _t480) + _v112;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + ( !r9d & _t480 | r8d & r9d) + _v108;
				asm("inc ecx");
				r10d = r10d + r9d;
				r8d = _t546 - 0x57cfb9ed;
				r11d = r11d + ( !r10d & r8d | r9d & r10d) + _v104;
				asm("inc ecx");
				r11d = r11d + r10d;
				asm("rol edx, 0xc");
				_t483 = __r8 + 0x4787c62a + ( !r11d & r9d | r10d & r11d) + _v100 + r11d;
				r8d = r8d + ( !_t483 & r10d | _t483 & r11d) + _v96;
				asm("inc ecx");
				r8d = r8d + _t483;
				r15d = _v92;
				r12d = _v80;
				r14d = _v72;
				r13d = _v68;
				_t32 = _t548 - 0x2b96aff; // 0x7b89d112
				r9d = _t32;
				r9d = r9d + ( !r8d & r11d | _t483 & r8d) + r15d;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r9d;
				r10d =  !r10d;
				r10d = r10d & _t483;
				r10d = r10d | r8d & r9d;
				r10d = r10d + 0x698098d8;
				r10d = r10d + _v88;
				r10d = r10d + r11d;
				asm("inc ecx");
				r10d = r10d + r9d;
				r11d = __r10 + 0x6b901122;
				asm("rol edx, 0xc");
				_t485 = _t483 + ( !r10d & r8d | r9d & r10d) + 0x8b44f7af + _v84 + r10d;
				asm("ror edi, 0xf");
				_t528 = ( !_t485 & r9d | _t485 & r10d) + 0xffff5bb1 + r12d + r8d + _t485;
				r9d = r9d + ( !_t528 & r10d | _t485 & _t528) + 0x895cd7be + _v76;
				asm("inc ecx");
				r9d = r9d + _t528;
				r11d = r11d + ( !r9d & _t485 | _t528 & r9d) + r14d;
				asm("inc ecx");
				r11d = r11d + r9d;
				asm("rol ebx, 0xc");
				_t305 = _t538 - 0x2678e6d + ( !r11d & _t528 | r9d & r11d) + r13d + r11d;
				r8d = _t305;
				r8d =  !r8d;
				_t530 = _v64;
				r10d = _t539 - 0x5986bc72;
				_t529 = _v60;
				r10d = r10d + (r8d & r9d | _t305 & r11d) + _t530;
				asm("inc ecx");
				r10d = r10d + _t305;
				r8d = r8d & r10d;
				_t487 =  !r10d;
				r9d = r9d + (_t487 & r11d | _t305 & r10d) + 0x49b40821 + _t529;
				asm("inc ecx");
				r9d = r9d + r10d;
				r8d = r8d | _t305 & r9d;
				r8d = r8d + 0xf61e2562;
				r8d = r8d + _v116;
				r11d = r11d + r8d;
				r8d = r10d;
				asm("inc ecx");
				r11d = r11d + r9d;
				r8d = r8d & r11d;
				r8d = r8d | _t487 & r9d;
				_t43 = _t546 - 0x16493856; // 0x654098bc
				r10d = _t43;
				r8d = r8d + 0xc040b340;
				r8d = r8d + _v96;
				r8d = r8d + _t305;
				asm("inc ecx");
				r8d = r8d + r11d;
				r9d = __r11 - 0x29d0efa3;
				asm("rol edx, 0xe");
				_t491 = __r10 + 0x265e5a51 + ( !r9d & r11d | r8d & r9d) + _v76 + r8d;
				r11d = __r8 + 0x2441453;
				r10d = r10d + ( !r11d & r8d | _t491 & r11d) + _v120;
				asm("inc ecx");
				r10d = r10d + _t491;
				r9d = r9d + ( !r8d & _t491 | r8d & r10d) + _v100;
				asm("inc ecx");
				r9d = r9d + r10d;
				r11d = r11d + ( !_t491 & r10d | _t491 & r9d) + r12d;
				r8d = _t538 - 0x275e197f;
				asm("inc ecx");
				_t51 = _t548 - 0x182c0438; // 0x4d149484
				r11d = r11d + r9d;
				r10d = _t546 + 0x21e1cde6;
				r8d = r8d + ( !r10d & r9d | r11d & r10d) + _t529;
				asm("inc ecx");
				r8d = r8d + r11d;
				r9d = __r11 - 0x3cc8f82a;
				asm("ror edx, 0xc");
				_t494 = _t51 + ( !r9d & r11d | r8d & r9d) + _v104 + r8d;
				r11d = _t494;
				_t55 =  &(_t538[0x455a14ed]); // 0x926ea971
				r11d =  !r11d;
				r10d = r10d + ( !r11d & r8d | r11d & _t494) + _v84;
				asm("inc ecx");
				r10d = r10d + _t494;
				r11d = r11d & r10d;
				r9d = r9d + ( !r8d & _t494 | r8d & r10d) + _t530;
				asm("inc ecx");
				r9d = r9d + r10d;
				r11d = r11d | r9d & _t494;
				r11d = r11d + 0xf4d50d87;
				r11d = r11d + _v108;
				r11d = r11d + r8d;
				asm("inc ecx");
				r11d = r11d + r9d;
				asm("ror ebx, 0xc");
				_t308 = _t55 + ( !r10d & r9d | r11d & r10d) + _v88 + r11d;
				asm("rol edx, 0x5");
				_t497 = __r10 - 0x561c16fb + ( !r9d & r11d | r9d & _t308) + r13d + _t308;
				r8d = _t546 - 0x3105c08;
				r10d = _t497;
				r10d =  !r10d;
				r9d = __r11 + 0x676f02d9;
				r8d = r8d + ( !r11d & _t308 | r11d & _t497) + _v112;
				asm("inc ecx");
				r8d = r8d + _t497;
				r10d = r10d & r8d;
				r9d = r9d + ( !_t308 & _t497 | r8d & _t308) + r15d;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d | r9d & _t497;
				r10d = r10d + 0x8d2a4c8a;
				r10d = r10d + r14d;
				r10d = r10d + _t308;
				asm("inc ecx");
				r10d = r10d + r9d;
				asm("rol edx, 0x4");
				_t499 = _t497 + (r8d ^ r9d ^ r10d) + 0xfffa3942 + _v100 + r10d;
				r11d = _t538 - 0x5b4115bc;
				r8d = r8d + (r9d ^ r10d ^ _t499) + 0x8771f681 + _v88;
				asm("inc ecx");
				r8d = r8d + _t499;
				r9d = r9d + (r8d ^ r10d ^ _t499) + 0x6d9d6122 + _v76;
				asm("inc ecx");
				r9d = r9d + r8d;
				_t451 = r8d ^ r9d;
				r10d = r10d + (_t451 ^ _t499) + 0xfde5380c + _t530;
				asm("inc ecx");
				r10d = r10d + r9d;
				r11d = r11d + (_t451 ^ r10d) + _v116;
				asm("inc ecx");
				r11d = r11d + r10d;
				asm("rol edx, 0xb");
				_t502 = __r8 + 0x4bdecfa9 + (r9d ^ r10d ^ r11d) + _v104 + r11d;
				r8d = _t546 - 0x944b4a0;
				r9d = __r10 - 0x41404390;
				r10d = __r11 + 0x289b7ec6;
				r8d = r8d + (_t502 ^ r10d ^ r11d) + r15d;
				asm("inc ecx");
				r8d = r8d + _t502;
				_t455 = _t502 ^ r8d;
				r11d = _t538 - 0x155ed806;
				r9d = r9d + (_t455 ^ r11d) + r12d;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + (_t455 ^ r9d) + r13d;
				asm("inc ecx");
				r10d = r10d + r9d;
				r11d = r11d + (r8d ^ r9d ^ r10d) + _v120;
				asm("inc ecx");
				r11d = r11d + r10d;
				r9d = __r10 - 0x262b2fc7;
				r8d = r8d + (r11d ^ r9d ^ r10d) + 0xd4ef3085 + _v108;
				asm("inc ecx");
				r8d = r8d + r11d;
				_t459 = r11d ^ r8d;
				r10d = __r8 + 0x1fa27cf8;
				asm("ror edx, 0x9");
				_t505 = _t546 + 0x4881d05 + (_t459 ^ r10d) + _v96 + r8d;
				r9d = r9d + (_t459 ^ _t505) + _v84;
				r8d = _t538 - 0x3b53a99b;
				asm("inc ecx");
				r9d = r9d + _t505;
				asm("rol ecx, 0xb");
				_t468 = (r8d ^ _t505 ^ r9d) + 0xe6db99e5 + r14d + r11d + r9d;
				r10d = r10d + (_t468 ^ _t505 ^ r9d) + _t529;
				asm("inc ecx");
				r10d = r10d + _t468;
				r8d = r8d + (_t468 ^ r10d ^ r9d) + _v112;
				asm("inc ecx");
				r8d = r8d + r10d;
				r9d = __rcx + 0x432aff97;
				r10d = __r8 - 0x36c5fc7;
				asm("rol edx, 0x6");
				_t508 = _t546 - 0xbd6ddbc + (( !_t468 | r8d) ^ r10d) + _v120 + r8d;
				r9d = r9d + (( !r10d | _t508) ^ r8d) + r15d;
				r8d =  &(_t538[0x655b59c3]);
				asm("inc ecx");
				r9d = r9d + _t508;
				asm("rol ecx, 0xf");
				_t471 = __r10 - 0x546bdc59 + (( !r8d | r9d) ^ _t508) + _t530 + r9d;
				r10d = r10d + (( !_t508 | _t471) ^ r9d) + _v100;
				r9d = __rcx - 0x100b83;
				asm("inc ecx");
				r10d = r10d + _t471;
				r8d = r8d + (( !r9d | r10d) ^ _t471) + r14d;
				asm("inc ecx");
				r8d = r8d + r10d;
				r10d = __r8 + 0x6fa87e4f;
				asm("rol edx, 0xa");
				_t511 = _t546 - 0x70f3336e + (( !_t471 | r8d) ^ r10d) + _v108 + r8d;
				r9d = r9d + (( !r10d | _t511) ^ r8d) + r12d;
				asm("inc ecx");
				r9d = r9d + _t511;
				asm("ror ecx, 0xb");
				_t474 = __r10 - 0x7a7ba22f + (( !r8d | r9d) ^ _t511) + _v116 + r9d;
				r10d = r10d + (( !_t511 | _t474) ^ r9d) + _v88;
				asm("inc ecx");
				r10d = r10d + _t474;
				r11d = _t538 - 0x1d31920;
				r11d = r11d + (( !r9d | r10d) ^ _t474) + _t529;
				asm("inc ecx");
				r11d = r11d + r10d;
				r8d = r11d;
				r8d =  !r8d;
				r9d = r9d + (( !_t474 | r11d) ^ r10d) + 0xa3014314 + _v96;
				asm("inc ecx");
				r9d = r9d + r11d;
				asm("ror ebx, 0xb");
				_t311 = __rcx + 0x4e0811a1 + (( !r10d | r9d) ^ r11d) + r13d + r9d;
				r8d = r8d | _t311;
				r8d = r8d ^ r9d;
				_t547 = _a8;
				r8d = r8d + 0xf7537e82;
				r8d = r8d + _v104;
				r8d = r8d + r10d;
				asm("inc ecx");
				r8d = r8d + _t311;
				asm("rol edx, 0xa");
				_t519 = (( !r9d | r8d) ^ _t311) + 0xbd3af235 + _v76 + r11d + r8d;
				r8d =  !r8d;
				 *_t547 = _a24 + r8d;
				asm("rol ecx, 0xf");
				_t477 = _t546 + 0x2ad7d2bb + (( !_t311 | _t519) ^ r8d) + _v112 + _t519;
				 *((intOrPtr*)(_t547 + 8)) =  *((intOrPtr*)(_t547 + 8)) + _t477;
				r8d = r8d | _t477;
				r8d = r8d ^ _t519;
				r8d = r8d + _v84;
				asm("ror eax, 0xb");
				_t301 = __rbx - 0x14792c6f + r8d +  *((intOrPtr*)(_t547 + 4)) + _t477;
				 *((intOrPtr*)(_t547 + 0xc)) =  *((intOrPtr*)(_t547 + 0xc)) + _t519;
				 *((intOrPtr*)(_t547 + 4)) = _t301;
				return _t301;
			}






















































    0x140010210
    0x140010210
    0x140010210
    0x140010215
    0x14001022e
    0x140010232
    0x140010239
    0x14001023c
    0x14001023f
    0x140010243
    0x140010243
    0x14001024e
    0x140010269
    0x14001026e
    0x140010271
    0x140010274
    0x14001027c
    0x140010290
    0x1400102a1
    0x1400102a4
    0x1400102b0
    0x1400102bc
    0x1400102bf
    0x1400102c3
    0x1400102d3
    0x1400102e2
    0x1400102e5
    0x1400102e9
    0x140010305
    0x140010308
    0x14001030c
    0x14001031a
    0x140010329
    0x14001032c
    0x140010330
    0x140010345
    0x140010348
    0x14001035e
    0x140010361
    0x140010365
    0x140010370
    0x140010374
    0x140010378
    0x14001037c
    0x140010383
    0x140010383
    0x140010392
    0x140010395
    0x140010399
    0x14001039f
    0x1400103a2
    0x1400103a5
    0x1400103a8
    0x1400103ae
    0x1400103b5
    0x1400103b9
    0x1400103bc
    0x1400103c0
    0x1400103cb
    0x1400103e2
    0x1400103e5
    0x14001040a
    0x14001040d
    0x140010425
    0x140010428
    0x14001042c
    0x140010441
    0x140010444
    0x140010448
    0x14001045c
    0x14001045f
    0x140010462
    0x140010465
    0x14001046e
    0x140010471
    0x140010478
    0x140010486
    0x140010489
    0x14001048d
    0x140010493
    0x140010499
    0x1400104ac
    0x1400104af
    0x1400104b3
    0x1400104bf
    0x1400104c4
    0x1400104cb
    0x1400104cf
    0x1400104d2
    0x1400104d5
    0x1400104d9
    0x1400104df
    0x1400104e2
    0x1400104ec
    0x1400104ec
    0x1400104f3
    0x1400104fa
    0x1400104fe
    0x140010501
    0x140010505
    0x14001050e
    0x140010524
    0x140010527
    0x14001052f
    0x14001053e
    0x140010546
    0x14001054c
    0x140010559
    0x140010563
    0x140010567
    0x140010572
    0x140010575
    0x140010581
    0x140010585
    0x14001058f
    0x140010598
    0x1400105a3
    0x1400105ae
    0x1400105b2
    0x1400105bb
    0x1400105d1
    0x1400105d7
    0x1400105dc
    0x1400105df
    0x1400105e7
    0x1400105f0
    0x1400105fa
    0x1400105fe
    0x140010604
    0x14001060b
    0x140010613
    0x140010617
    0x140010629
    0x14001062c
    0x140010633
    0x140010637
    0x14001063a
    0x14001063e
    0x140010659
    0x14001065c
    0x14001066b
    0x14001066e
    0x140010672
    0x140010679
    0x14001067e
    0x140010686
    0x140010692
    0x140010699
    0x14001069d
    0x1400106a2
    0x1400106af
    0x1400106b2
    0x1400106b6
    0x1400106be
    0x1400106c7
    0x1400106ce
    0x1400106d1
    0x1400106d4
    0x1400106d8
    0x1400106ee
    0x1400106f1
    0x1400106fb
    0x140010705
    0x140010708
    0x14001070c
    0x140010722
    0x140010725
    0x140010729
    0x14001072c
    0x140010741
    0x140010747
    0x14001074b
    0x140010757
    0x14001075a
    0x14001075e
    0x140010769
    0x14001076c
    0x140010777
    0x14001077e
    0x14001078a
    0x140010791
    0x140010794
    0x140010798
    0x14001079b
    0x1400107a3
    0x1400107ad
    0x1400107b3
    0x1400107b7
    0x1400107ca
    0x1400107cd
    0x1400107d1
    0x1400107da
    0x1400107dd
    0x1400107e1
    0x1400107ed
    0x1400107ff
    0x140010802
    0x140010806
    0x140010809
    0x140010811
    0x14001081d
    0x140010820
    0x140010828
    0x14001082e
    0x140010837
    0x14001083b
    0x14001084d
    0x140010850
    0x14001085c
    0x140010861
    0x140010865
    0x140010871
    0x140010878
    0x14001087c
    0x14001088f
    0x1400108a2
    0x1400108ab
    0x1400108ae
    0x1400108b9
    0x1400108bf
    0x1400108c8
    0x1400108cc
    0x1400108e3
    0x1400108e6
    0x1400108f1
    0x1400108f7
    0x140010900
    0x140010904
    0x14001090f
    0x14001091d
    0x140010921
    0x140010932
    0x14001093b
    0x14001093e
    0x140010949
    0x140010951
    0x140010955
    0x140010966
    0x140010969
    0x140010974
    0x14001097c
    0x140010980
    0x14001098a
    0x140010997
    0x14001099e
    0x1400109a2
    0x1400109a8
    0x1400109ae
    0x1400109b9
    0x1400109c1
    0x1400109c5
    0x1400109df
    0x1400109e2
    0x1400109e5
    0x1400109ea
    0x1400109ed
    0x1400109f3
    0x1400109fa
    0x1400109fe
    0x140010a01
    0x140010a05
    0x140010a19
    0x140010a1c
    0x140010a2f
    0x140010a32
    0x140010a3b
    0x140010a46
    0x140010a48
    0x140010a4c
    0x140010a4f
    0x140010a52
    0x140010a59
    0x140010a60
    0x140010a62
    0x140010a66
    0x140010a79

    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 68354d835f18592a3392b19952e0fe910a5dfe6a9023353f29145046c6faf481
    • Instruction ID: 022ba38ea2fc746ee1b0595bfd7f682d53a7df84c20089d95d53e5e85305b389
    • Opcode Fuzzy Hash: 68354d835f18592a3392b19952e0fe910a5dfe6a9023353f29145046c6faf481
    • Instruction Fuzzy Hash: E32283B7F744204BD71DCB69EC52FE836A2B75434C709A02CAA17D3F44EA3DEA158A44
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140015170 Relevance: .2, Instructions: 215COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 98%
    			E00000001140015170(unsigned int __ecx, unsigned int __rax, long long __rbx, signed int __rcx, unsigned int __rdx, void* __r8, long long _a8) {
				signed int _t224;
				void* _t225;
				void* _t226;
				void* _t227;
				unsigned long long _t232;
				unsigned long long _t235;
				unsigned long long _t238;
				unsigned long long _t241;
				unsigned long long _t244;
				unsigned long long _t247;
				signed long long _t250;
				unsigned long long _t261;
				signed long long _t263;
				signed long long _t264;
				signed long long _t267;
				signed int* _t276;
				signed int* _t277;
				unsigned long long _t281;
				unsigned long long _t282;

				r9d = __ecx;
				r9d = r9d << 0x10;
				r9d = __ecx;
				r9d = r9d >> 8;
				r9d = r9d & 0x0000ff00;
				if (__r8 == 0) goto 0x400151d9;
				_t224 = r10b & 0x00000003;
				if (_t224 == 0) goto 0x400151d9;
				_t276 = __rdx + 1;
				_t267 = __rdx >> 0x00000018 ^ __rcx;
				_t281 = __r8 - 1;
				if (_t224 != 0) goto 0x400151b0;
				_t225 = _t281 - 0x20;
				if (_t225 < 0) goto 0x40015437;
				_a8 = __rbx;
				_t261 = (_t281 >> 5) * 0xffffffe0;
				_t282 = _t281 + _t261;
				asm("o16 nop [eax+eax]");
				r9d =  *(0x4001a930 + 0x1000 + _t267 * 4) ^  !(((__ecx & 0x0000ff00) + r9d << 8) + r9d + (__ecx >> 0x18)) << 0x00000008 ^  *_t276;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1400 + _t261 * 4);
				_t232 = __rax >> 0x10 >> 8 >> 0x18;
				r8d = r8d ^  *(0x4001a930 + 0x1c00 + _t232 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1000 + _t232 * 4);
				r8d = r8d ^ _t276[1];
				r9d = r8d;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1400 + _t261 * 4);
				_t235 = _t232 >> 0x10 >> 8 >> 0x18;
				r8d = r8d ^  *(0x4001a930 + 0x1c00 + _t235 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1000 + _t235 * 4);
				r8d = r8d ^ _t276[2];
				r9d = r8d;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1400 + _t261 * 4);
				_t238 = _t235 >> 0x10 >> 8 >> 0x18;
				r8d = r8d ^  *(0x4001a930 + 0x1c00 + _t238 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1000 + _t238 * 4);
				r8d = r8d ^ _t276[3];
				r9d = r8d;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1400 + _t261 * 4);
				_t241 = _t238 >> 0x10 >> 8 >> 0x18;
				r8d = r8d ^  *(0x4001a930 + 0x1c00 + _t241 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1000 + _t241 * 4);
				r8d = r8d ^ _t276[4];
				r9d = r8d;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1400 + _t261 * 4);
				_t244 = _t241 >> 0x10 >> 8 >> 0x18;
				r8d = r8d ^  *(0x4001a930 + 0x1c00 + _t244 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1000 + _t244 * 4);
				r8d = r8d ^ _t276[5];
				r9d = r8d;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1400 + _t261 * 4);
				_t247 = _t244 >> 0x10 >> 8 >> 0x18;
				_t277 =  &(_t276[8]);
				r8d = r8d ^  *(0x4001a930 + 0x1c00 + _t247 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1000 + _t247 * 4);
				r8d = r8d ^  *(_t277 - 8);
				r9d = r8d;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1400 + _t261 * 4);
				_t250 = _t247 >> 0x10 >> 8 >> 0x18;
				r8d = r8d ^  *(0x4001a930 + 0x1c00 + _t250 * 4);
				r8d = r8d ^  *(0x4001a930 + 0x1000 + _t250 * 4);
				r8d = r8d ^  *(_t277 - 4);
				if (_t225 != 0) goto 0x40015200;
				_t226 = _t282 - 4;
				if (_t226 < 0) goto 0x40015497;
				_t263 = (_t282 >> 2) * 0xfffffffc;
				r8d =  *(0x4001a930 + 0x1800 + _t267 * 4) ^  *(0x4001a930 + 0x1400 + _t261 * 4) ^  *(0x4001a930 + 0x1c00 + (_t261 >> 0x18) * 4) ^  *(0x4001a930 + 0x1000 + (_t261 >> 0x18) * 4) ^  *_t277;
				_t264 = _t263 >> 0x18;
				if (_t226 != 0) goto 0x40015450;
				_t227 = _t282 + _t263;
				if (_t227 == 0) goto 0x400154c4;
				if (_t227 != 0) goto 0x400154a0;
				return ( !( *(0x4001a930 + 0x1000 + (_t267 >> 0x00000018 ^ _t264) * 4) ^ ( *(0x4001a930 + 0x1800 + _t267 * 4) ^  *(0x4001a930 + 0x1400 + _t263 * 4) ^  *(0x4001a930 + 0x1c00 + _t264 * 4) ^  *(0x4001a930 + 0x1000 + _t264 * 4)) << 0x00000008) >> 0x18) + (( !( *(0x4001a930 + 0x1000 + (_t267 >> 0x00000018 ^ _t264) * 4) ^ ( *(0x4001a930 + 0x1800 + _t267 * 4) ^  *(0x4001a930 + 0x1400 + _t263 * 4) ^  *(0x4001a930 + 0x1c00 + _t264 * 4) ^  *(0x4001a930 + 0x1000 + _t264 * 4)) << 0x00000008) & 0x0000ff00) + ( !( *(0x4001a930 + 0x1000 + (_t267 >> 0x00000018 ^ _t264) * 4) ^ ( *(0x4001a930 + 0x1800 + _t267 * 4) ^  *(0x4001a930 + 0x1400 + _t263 * 4) ^  *(0x4001a930 + 0x1c00 + _t264 * 4) ^  *(0x4001a930 + 0x1000 + _t264 * 4)) << 0x00000008) << 0x10) << 8) + ( !( *(0x4001a930 + 0x1000 + (_t267 >> 0x00000018 ^ _t264) * 4) ^ ( *(0x4001a930 + 0x1800 + _t267 * 4) ^  *(0x4001a930 + 0x1400 + _t263 * 4) ^  *(0x4001a930 + 0x1c00 + _t264 * 4) ^  *(0x4001a930 + 0x1000 + _t264 * 4)) << 0x00000008) >> 0x00000008 & 0x0000ff00);
			}






















    0x140015174
    0x14001517f
    0x140015189
    0x140015192
    0x14001519d
    0x1400151ae
    0x1400151b0
    0x1400151b4
    0x1400151bc
    0x1400151c3
    0x1400151d4
    0x1400151d7
    0x1400151d9
    0x1400151dd
    0x1400151e3
    0x1400151ef
    0x1400151f3
    0x1400151f6
    0x140015203
    0x140015210
    0x140015222
    0x14001522a
    0x14001522e
    0x14001523a
    0x140015242
    0x140015246
    0x140015256
    0x140015268
    0x140015270
    0x140015274
    0x140015280
    0x140015288
    0x14001528c
    0x14001529c
    0x1400152ae
    0x1400152b6
    0x1400152ba
    0x1400152c6
    0x1400152ce
    0x1400152d2
    0x1400152e2
    0x1400152f4
    0x1400152fc
    0x140015300
    0x14001530c
    0x140015314
    0x140015318
    0x140015328
    0x14001533a
    0x140015342
    0x140015346
    0x140015352
    0x14001535a
    0x140015361
    0x140015372
    0x140015380
    0x140015388
    0x14001538c
    0x140015390
    0x14001539c
    0x1400153a4
    0x1400153a8
    0x1400153b8
    0x1400153ca
    0x1400153d2
    0x1400153d6
    0x1400153e2
    0x1400153ea
    0x14001542c
    0x140015437
    0x14001543b
    0x140015444
    0x140015457
    0x14001547c
    0x140015495
    0x140015497
    0x14001549a
    0x1400154c2
    0x1400154eb

    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 503b61509a6e7d9b6eb4f9c1519d37c0dc2229192933667b3bc723eba56df74c
    • Instruction ID: f294bca1e54ba5f97cd1887ffa6c8c7d976b4678fb34f7ffe8470b0002a4fcc7
    • Opcode Fuzzy Hash: 503b61509a6e7d9b6eb4f9c1519d37c0dc2229192933667b3bc723eba56df74c
    • Instruction Fuzzy Hash: 7B8150733301749BE7668A2EA514BE93290F3693CEFC56115FB8487B45CA3EB921CB50
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140015160 Relevance: .2, Instructions: 198COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 100%
    			E00000001140015160(void* __rdx) {

				if (__rdx != 0) goto 0x4001516b;
				return 0;
			}



    0x140015166
    0x14001516a

    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 6b12c9a6a7ee3862a54880f18472b54e1903d2b01c5643e5ee2caa8c01718eea
    • Instruction ID: e67d2bfc1a2697f1f60af7736c02a9787f64ff3490f4c327f028a03746ec3e44
    • Opcode Fuzzy Hash: 6b12c9a6a7ee3862a54880f18472b54e1903d2b01c5643e5ee2caa8c01718eea
    • Instruction Fuzzy Hash: FE715CB23301749BEB658B2E9514BE93390F36A349FC56105EB855BB81CE3EB921CF50
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400154F0 Relevance: .1, Instructions: 120COMMONCrypto
    Download Yara Rule
    C-Code - Quality: 93%
    			E000000011400154F0(signed int __ecx, signed int __edx, signed int __rax, void* __r8) {
				signed int _v136;
				signed char _t34;
				signed char _t36;
				signed char _t38;
				signed char _t40;
				signed int _t62;
				signed int _t65;
				signed int _t68;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int* _t94;
				void* _t96;
				void* _t97;
				void* _t98;

				r11d = __edx;
				r9d = __ecx;
				if (__r8 <= 0) goto 0x40015680;
				 *_t94 = 0xedb88320;
				asm("o16 nop [eax+eax]");
				_t94[__rax] = 1;
				if (__rax + 1 - 0x20 < 0) goto 0x40015520;
				r8d = 0;
				_t34 =  *(_t94 + __r8);
				if (_t34 == 0) goto 0x4001554e;
				_t62 = _t34 & 0x00000001;
				if (_t62 == 0) goto 0x40015546;
				if (_t62 != 0) goto 0x40015540;
				 *(_t94 + __r8 + 0x80) = 0 ^  *_t94;
				_t96 = __r8 + 4;
				if (_t96 - 0x80 < 0) goto 0x40015531;
				r8d = 0;
				_t36 =  *(_t94 + _t96 + 0x80);
				if (_t36 == 0) goto 0x4001558e;
				_t65 = _t36 & 0x00000001;
				if (_t65 == 0) goto 0x40015586;
				if (_t65 != 0) goto 0x40015580;
				 *(_t94 + _t96) = 0 ^ _v136;
				_t97 = _t96 + 4;
				if (_t97 - 0x80 < 0) goto 0x40015566;
				r8d = 0;
				asm("o16 nop [eax+eax]");
				_t38 =  *(_t94 + _t97);
				if (_t38 == 0) goto 0x400155ce;
				_t68 = _t38 & 0x00000001;
				if (_t68 == 0) goto 0x400155c6;
				if (_t68 != 0) goto 0x400155c0;
				 *(_t94 + _t97 + 0x80) = 0 ^  *_t94;
				_t98 = _t97 + 4;
				if (_t98 - 0x80 < 0) goto 0x400155b0;
				if ((r10b & 0x00000001) == 0) goto 0x4001560c;
				if (r9d == 0) goto 0x40015609;
				_t72 = r9b & 0x00000001;
				if (_t72 == 0) goto 0x40015600;
				r9d = r9d >> 1;
				if (_t72 != 0) goto 0x400155f8;
				r9d = 0 ^ _v136;
				if (_t72 == 0) goto 0x4001567d;
				r8d = 0;
				_t40 =  *(_t94 + _t98 + 0x80);
				if (_t40 == 0) goto 0x4001563e;
				asm("o16 nop [eax+eax]");
				_t74 = _t40 & 0x00000001;
				if (_t74 == 0) goto 0x40015636;
				if (_t74 != 0) goto 0x40015630;
				 *(_t94 + _t98) = 0 ^ _v136;
				if (_t98 + 4 - 0x80 < 0) goto 0x40015614;
				if ((r10b & 0x00000001) == 0) goto 0x40015674;
				if (r9d == 0) goto 0x40015671;
				_t78 = r9b & 0x00000001;
				if (_t78 == 0) goto 0x40015668;
				r9d = r9d >> 1;
				if (_t78 != 0) goto 0x40015660;
				r9d = 0 ^  *_t94;
				if (_t78 != 0) goto 0x400155a0;
				r9d = r9d ^ r11d;
				return r9d;
			}


















    0x1400154fa
    0x1400154fd
    0x140015503
    0x14001550e
    0x140015517
    0x140015520
    0x14001552c
    0x14001552e
    0x140015531
    0x14001553d
    0x140015540
    0x140015542
    0x14001554c
    0x14001554e
    0x140015556
    0x140015561
    0x140015563
    0x140015566
    0x14001557a
    0x140015580
    0x140015582
    0x14001558c
    0x14001558e
    0x140015592
    0x14001559d
    0x1400155a0
    0x1400155a7
    0x1400155b0
    0x1400155bc
    0x1400155c0
    0x1400155c2
    0x1400155cc
    0x1400155ce
    0x1400155d6
    0x1400155e1
    0x1400155e7
    0x1400155f6
    0x1400155f8
    0x1400155fc
    0x140015604
    0x140015607
    0x140015609
    0x14001560f
    0x140015611
    0x140015614
    0x140015628
    0x14001562a
    0x140015630
    0x140015632
    0x14001563c
    0x14001563e
    0x14001564d
    0x140015653
    0x14001565e
    0x140015660
    0x140015664
    0x14001566c
    0x14001566f
    0x140015671
    0x140015677
    0x14001567d
    0x14001568a

    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 0114d8148b93b9f8dfc86a188f1120884a474c0a348be332542b91698de2cadc
    • Instruction ID: b94fce4af05d2a3b47cf10f4c42de706c870d6d3f1c440dba90fb4ad6b70bb1c
    • Opcode Fuzzy Hash: 0114d8148b93b9f8dfc86a188f1120884a474c0a348be332542b91698de2cadc
    • Instruction Fuzzy Hash: 3941BB32310640CAFBAA9B1AE020BEE3691E7997C5FD49115DB819FAF0D63BD4058B40
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014001F888 Relevance: .0, Instructions: 1COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: d4d69e87e8d188af22693729d0c47e375fa30932fc4d5870f5534a0f4be2fc6b
    • Instruction ID: dfaea9a5c630ea9301e3db1b4ab310b7254bb6764b8191614c7f5c636ee011c0
    • Opcode Fuzzy Hash: d4d69e87e8d188af22693729d0c47e375fa30932fc4d5870f5534a0f4be2fc6b
    • Instruction Fuzzy Hash:
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000BC94 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 115libraryloaderCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AddressLibraryProcwcslen$FreeInitializeLoadmemsetwcsncpy
    • String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
    • API String ID: 3207362952-4219398408
    • Opcode ID: baf9e754506da9efa04bb7baef11d081e03a89bf48f902bbef2c1cfc2494dcfa
    • Instruction ID: f53257261a77fa7679be829afa5858120bcd1a05ac071047bacb850080d37645
    • Opcode Fuzzy Hash: baf9e754506da9efa04bb7baef11d081e03a89bf48f902bbef2c1cfc2494dcfa
    • Instruction Fuzzy Hash: F7418D72211B8082EB16EF12E8443EA73A4F78CBC8F544125EB4A477A5EF39C95AC700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140016FB4 Relevance: 19.6, APIs: 13, Instructions: 81memoryregistrythreadCOMMON
    Download Yara Rule
    C-Code - Quality: 51%
    			E00000001140016FB4(long long __rax, long long __rbx, long long __rcx, long long __rdx, long long __rsi) {
				void* __rdi;
				void* __r14;
				void* __r15;
				void* _t38;
				void* _t39;
				void* _t40;
				intOrPtr _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t54;
				long long _t56;
				long long _t73;
				void* _t74;
				long long _t79;
				long long _t81;
				void* _t83;
				void* _t84;
				void* _t86;
				void* _t89;
				void* _t92;
				void* _t93;
				long _t94;
				long _t97;

				_t55 = __rax;
				 *((long long*)(_t83 + 8)) = __rbx;
				 *((long long*)(_t83 + 0x10)) = _t79;
				 *((long long*)(_t83 + 0x18)) = __rsi;
				_t84 = _t83 - 0x40;
				if ( *0x40021118 != 0) goto 0x40017001;
				 *0x40021150 = TlsAlloc();
				E0000000114001F7E8(_t26, _t40, _t43, _t46, _t47, _t48,  *0x40021118, _t54, __rax, 0x40021128, 0x40021128, __rdx, _t74, __rsi, _t86, _t89, _t92, _t93, __rdx, __rcx);
				 *0x40021118 = 1;
				_t41 =  *0x40021150; // 0x0
				TlsGetValue(_t97);
				if (__rax != 0) goto 0x400170d6;
				_t4 = _t55 + 8; // 0x8
				_t5 = _t55 + 0x28; // 0x28
				r8d = _t5;
				RtlAllocateHeap(_t74, ??);
				_t81 = __rax;
				if (__rax == 0) goto 0x40017101;
				 *0x4001f7d0();
				_t56 =  *0x40021120; // 0x0
				if (_t56 == 0) goto 0x40017051;
				 *_t56 = __rax;
				 *((long long*)(__rax + 8)) = _t56;
				 *0x40021120 = __rax;
				 *0x4001f7e0();
				GetCurrentProcess();
				GetCurrentThread();
				GetCurrentProcess();
				 *(_t84 + 0x30) =  *(_t84 + 0x30) & 0x00000000;
				 *(_t84 + 0x28) =  *(_t84 + 0x28) & 0x00000000;
				 *(_t84 + 0x20) = 0x100000;
				DuplicateHandle(??, ??, ??, ??, ??, ??, ??);
				_t14 = _t81 + 0x18; // 0x18
				 *(_t84 + 0x28) = 8;
				 *(_t84 + 0x20) =  *(_t84 + 0x20) | 0xffffffff;
				E0000000114001F938(_t39, _t41, _t4, _t46, _t47, _t48, _t56, _t54, _t56, _t56, _t14,  *((intOrPtr*)(__rax + 0x20)), _t56, __rsi, E0000000114001711C, __rax, _t92, _t93, __rdx, __rcx);
				_t73 = __rax;
				TlsSetValue(_t94);
				_t18 = _t73 + 0x18; // 0x18
				r8d = _t18;
				_t38 = RtlAllocateHeap(??, ??, ??);
				if (_t56 == 0) goto 0x40017101;
				 *((long long*)(_t56 + 8)) = __rcx;
				 *((long long*)(_t56 + 0x10)) = __rdx;
				 *_t56 =  *((intOrPtr*)(__rax + 0x10));
				 *((long long*)(__rax + 0x10)) = _t56;
				return _t38;
			}




























    0x140016fb4
    0x140016fb4
    0x140016fb9
    0x140016fbe
    0x140016fc8
    0x140016fe0
    0x140016feb
    0x140016ff1
    0x140016ff7
    0x140017001
    0x140017007
    0x140017013
    0x140017020
    0x140017023
    0x140017023
    0x140017027
    0x14001702d
    0x140017033
    0x14001703c
    0x140017042
    0x14001704c
    0x14001704e
    0x140017054
    0x140017058
    0x14001705f
    0x140017065
    0x14001706e
    0x140017077
    0x14001707d
    0x140017082
    0x140017094
    0x14001709c
    0x1400170a6
    0x1400170b4
    0x1400170bc
    0x1400170c1
    0x1400170cd
    0x1400170d0
    0x1400170df
    0x1400170df
    0x1400170e3
    0x1400170ec
    0x1400170ee
    0x1400170f2
    0x1400170fa
    0x1400170fd
    0x140017119

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Current$AllocateCriticalHeapProcessSectionValue$AcquireAllocDuplicateHandleInitializeLeaveLockObjectRegisterSingleThreadWait
    • String ID:
    • API String ID: 4033017058-0
    • Opcode ID: aef90992288fd509fbd74998ffb1029e6b7b59a5f56d271f65cebbdd5f433d17
    • Instruction ID: 0ebcb89b5f496a055c7edd3f2936d7e00332f328880e18a7a0f049a68aa3c175
    • Opcode Fuzzy Hash: aef90992288fd509fbd74998ffb1029e6b7b59a5f56d271f65cebbdd5f433d17
    • Instruction Fuzzy Hash: 0641E172201B409AEB129F62E8447A977A0F78CBD5F484129EB4D0B774DF39C999D740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000DB18 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 107libraryloaderCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Librarywcscatwcslen$AddressAllocateFreeHeapLoadProcValuewcscpy
    • String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
    • API String ID: 1264281023-287042676
    • Opcode ID: af3ba110e3d0ba57517c83c0fb64a893d7f1b6ff8354fe36c6ead1af46344a34
    • Instruction ID: ffb59ae5301eeda9161766390bd85b6f914ac2b2dd013f36d3426db2d5643a12
    • Opcode Fuzzy Hash: af3ba110e3d0ba57517c83c0fb64a893d7f1b6ff8354fe36c6ead1af46344a34
    • Instruction Fuzzy Hash: A64186B1214A46C2FA27EB57B4947F97291AB8C7D0F540127BB0A0B7F5DEB9C841C611
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140008260 Relevance: 13.7, APIs: 9, Instructions: 249COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: ??3@_wcsdupwcsncpy$Value
    • String ID:
    • API String ID: 3451606040-0
    • Opcode ID: 855c1d7ae1b1267e3e85a177fdbdaaaa4020ada7361163977901554679b3552c
    • Instruction ID: da1d114085ca4aa9233c1495fb0579f216bdf29e57c82a9bb0fca7f891cc91e6
    • Opcode Fuzzy Hash: 855c1d7ae1b1267e3e85a177fdbdaaaa4020ada7361163977901554679b3552c
    • Instruction Fuzzy Hash: AE91BFB2604A8185EA76DF13B9507EA73A0FB48BD5F484225BFCA476E5EB38C542C701
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000BEA0 Relevance: 12.0, APIs: 8, Instructions: 44threadwindowCOMMON
    Download Yara Rule
    C-Code - Quality: 70%
    			E0000000114000BEA0(long* __rax, long long __rbx, long __rcx, long long _a8) {
				void* __rdi;
				long _t9;
				long _t13;
				void* _t20;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t34;
				void* _t45;
				long _t46;
				void* _t47;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_a8 = __rbx;
				_t46 = __rcx;
				_t9 = GetWindowThreadProcessId(??, ??);
				if (_t9 != GetCurrentThreadId()) goto 0x4000bf31;
				if (IsWindowVisible(??) == 0) goto 0x4000bf31;
				E00000001140011CB0(0x28, __rax, 0x40020600);
				__rax[2] = __rcx;
				_t13 = GetCurrentThreadId();
				__rax[4] = 0;
				 *__rax = _t13;
				if ((E0000000114001F9E0(_t13, _t9, _t20, 0xffffffec, _t25, _t26, _t27, IsWindowVisible(??), _t34, __rax, __rax, _t45, __rcx, _t47, _t51, _t52, _t53, _t54, _t55, _t56) & 0x00000008) == 0) goto 0x4000bf0a;
				__rax[4] = 1;
				GetForegroundWindow();
				if (_t46 == __rax) goto 0x4000bf31;
				if (IsWindowEnabled(??) == 0) goto 0x4000bf31;
				__rax[4] = 1;
				EnableWindow(??, ??);
				return 1;
			}




















    0x14000bea0
    0x14000beac
    0x14000beaf
    0x14000bebf
    0x14000becc
    0x14000beda
    0x14000bee2
    0x14000bee6
    0x14000bef4
    0x14000befa
    0x14000bf04
    0x14000bf06
    0x14000bf0a
    0x14000bf13
    0x14000bf20
    0x14000bf27
    0x14000bf2b
    0x14000bf40

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Window$Thread$Current$AllocateEnableEnabledForegroundHeapLongProcessVisible
    • String ID:
    • API String ID: 684997728-0
    • Opcode ID: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
    • Instruction ID: 80f857dfb6a9a2f530fca3cb10c8fb692f8ca5f83b5b0ec86a1534c3d91aadad
    • Opcode Fuzzy Hash: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
    • Instruction Fuzzy Hash: 9D11397020064182EB46AB27A9483B962A1EB8CBC4F448024FA0A4B6B5DF7DC5458301
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140011AB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53librarysleeploaderCOMMON
    Download Yara Rule
    C-Code - Quality: 44%
    			E00000001140011AB8(long long* __rax, long long __rbx, intOrPtr* __rcx, long long* __rdx) {
				void* _t16;
				long long* _t28;
				struct HINSTANCE__* _t40;
				struct HINSTANCE__* _t43;
				long long _t46;
				void* _t48;
				WCHAR* _t53;

				_t28 = __rax;
				 *((long long*)(_t48 + 8)) = __rbx;
				 *((long long*)(_t48 + 0x10)) = _t46;
				LoadLibraryW(_t53);
				_t3 = _t46 + 1; // 0x1
				r14d = _t3;
				if (__rax == 0) goto 0x40011b24;
				GetProcAddress(_t40);
				if (__rax == 0) goto 0x40011b17;
				 *__rax();
				FreeLibrary(_t43);
				if (r14d != 0) goto 0x40011b4f;
				asm("lock inc esp");
				if (0 == 0) goto 0x40011b46;
				if (0 != 0) goto 0x40011b4f;
				_t6 = _t28 + 2; // 0x1
				goto 0x40011b40;
				Sleep(??);
				if ( *__rcx != _t6) goto 0x40011b38;
				goto 0x40011b4f;
				_t16 =  *__rdx();
				 *__rcx = 2;
				return _t16;
			}










    0x140011ab8
    0x140011ab8
    0x140011abd
    0x140011ad9
    0x140011adf
    0x140011adf
    0x140011ae9
    0x140011af5
    0x140011afe
    0x140011b12
    0x140011b1a
    0x140011b22
    0x140011b26
    0x140011b2d
    0x140011b31
    0x140011b33
    0x140011b36
    0x140011b3a
    0x140011b42
    0x140011b44
    0x140011b46
    0x140011b4d
    0x140011b61

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Library$AddressFreeLoadProcSleep
    • String ID: InitOnceExecuteOnce$Kernel32.dll
    • API String ID: 938261879-1339284965
    • Opcode ID: 315e644546469fd2db35d0db39a019d67f841a3b1ec84ab54f403295059e202d
    • Instruction ID: b5645326e5d4f07ede329690aacabb45cf3e43243987f71da7b0cd1098b1f21b
    • Opcode Fuzzy Hash: 315e644546469fd2db35d0db39a019d67f841a3b1ec84ab54f403295059e202d
    • Instruction Fuzzy Hash: B4118F3120874585EB5ADF57A8843E973A0EB8CBD0F488029AB0A0B666EF3AC595C740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000D9C4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46libraryloaderCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Library$AddressAllocateFreeHeapLoadPathProcTempValue
    • String ID: GetLongPathNameW$Kernel32.DLL
    • API String ID: 1451490533-2943376620
    • Opcode ID: c3e4c02f6cb4c0a015bd45f3fcc7f186f913e40d0dd92e763cbbe5d307640fc6
    • Instruction ID: 230e630dded4efaa915c31c3904b5b857ecb3aa047886c8d585020238d201ac5
    • Opcode Fuzzy Hash: c3e4c02f6cb4c0a015bd45f3fcc7f186f913e40d0dd92e763cbbe5d307640fc6
    • Instruction Fuzzy Hash: 74116D3171074086EF159F27A9443A967A5FB8CFC0F481029FF4E4B7A5DE39C4518340
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140001E57 Relevance: 9.3, APIs: 6, Instructions: 259COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: File$NameTemp$Heap$AllocateErrorLastPathValue$AttributesBackslashCreateDeleteDirectoryExtensionFreeRenamememcpywcslenwcsncpy
    • String ID:
    • API String ID: 1881527299-0
    • Opcode ID: 732ba5ba80694de7f15fd7e09e5e5993a015176c44753ff7fa1fe236b8ae750f
    • Instruction ID: 77aa1fd205ec2d48eabb088ee49ef1dd4fb6b524f1726a3c9e39dbd98a5b5f3b
    • Opcode Fuzzy Hash: 732ba5ba80694de7f15fd7e09e5e5993a015176c44753ff7fa1fe236b8ae750f
    • Instruction Fuzzy Hash: 138162FBE69644E5EA07B763BC46BED5220D3AD3D4F504410FF08062A3EE3995EA4B10
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000DE50 Relevance: 9.2, APIs: 6, Instructions: 151filememoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: File$Create$AcquireAllocateCriticalHeapLeaveLockPointerSection
    • String ID:
    • API String ID: 116771325-0
    • Opcode ID: 3acf6fa9c56a0c7a834e2f73706e5fbcdc580a0c2c593d59e461b3465d2a83a2
    • Instruction ID: 19dccfeb25466122eda91520b9d3e1282c027ca6efa307134c14a125255dccfb
    • Opcode Fuzzy Hash: 3acf6fa9c56a0c7a834e2f73706e5fbcdc580a0c2c593d59e461b3465d2a83a2
    • Instruction Fuzzy Hash: CA51B1B261469086E761CF17F9007AA7690B39CBE4F04873AFF6A47BE4DB79C4419B10
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400110DC Relevance: 9.1, APIs: 6, Instructions: 62memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Value$AllocateHeap$Alloc
    • String ID:
    • API String ID: 2511646910-0
    • Opcode ID: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
    • Instruction ID: 773301f083ee798336704ec3d5312664b9b868eef9dc2a5d6ba13fea1fa7b4fd
    • Opcode Fuzzy Hash: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
    • Instruction Fuzzy Hash: 3821F434200B8096EB4A9B92F8843E963A5F7DCBD0F548429FB4D47B79DE3DC8858740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400117FC Relevance: 7.6, APIs: 5, Instructions: 99memoryCOMMON
    Download Yara Rule
    C-Code - Quality: 35%
    			E000000011400117FC(signed int __ecx, intOrPtr __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, long long _a8, intOrPtr _a16, intOrPtr _a24) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t49;
				void* _t57;
				signed int _t58;
				void* _t59;
				void* _t71;
				intOrPtr* _t74;
				long long _t75;
				long long* _t76;
				long long* _t81;
				long long _t90;
				long long _t93;
				long long _t95;
				void* _t99;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_a8 = __rbx;
				_a24 = r8d;
				_a16 = __edx;
				_t58 = r9d;
				_t49 = __ecx & 0x00000007;
				if (__eflags == 0) goto 0x40011831;
				_t95 = __rax + __rcx + __rax - __rax + __rcx;
				if ((bpl & 0x00000004) == 0) goto 0x40011903;
				_t92 = E00000001140011A30;
				E00000001140011AB8(__rax - __rax + __rcx, __rbx, 0x40021058, E00000001140011A30);
				 *0x4001f7d0();
				_t74 =  *0x40021060; // 0x451bc0
				if (_t74 == 0) goto 0x40011883;
				if ( *((intOrPtr*)(_t74 + 0x18)) != _t95) goto 0x40011872;
				if ( *((intOrPtr*)(_t74 + 0x20)) == _t58) goto 0x40011877;
				_t75 =  *_t74;
				goto 0x40011862;
				 *((intOrPtr*)(_t75 + 0x24)) =  *((intOrPtr*)(_t75 + 0x24)) + 1;
				if ( *((intOrPtr*)(_t75 + 0x10)) != 0) goto 0x400118f4;
				_t13 = _t92 + 0x28; // 0x28
				r8d = _t13;
				RtlAllocateHeap(??, ??, ??);
				_t93 = _t75;
				if (_t75 == 0) goto 0x400118f4;
				r8d = _a24;
				r9d = _t58;
				r9d = r9d & 0xfffffffb;
				E000000011400117FC(_t49, _a16, _t75, _t75,  *((intOrPtr*)(_t75 + 0x10)), _t95 - 8);
				if (_t75 == 0) goto 0x400118f4;
				 *((long long*)(_t75 + 0x10)) = _t93;
				 *(_t93 + 8) =  *(_t93 + 8) & 0x00000000;
				 *((long long*)(_t93 + 0x10)) = _t75;
				_t76 =  *0x40021060; // 0x451bc0
				 *((long long*)(_t93 + 0x18)) = _t95;
				 *(_t93 + 0x20) = _t58;
				 *((intOrPtr*)(_t93 + 0x24)) = 1;
				 *_t93 = _t76;
				if (_t76 == 0) goto 0x400118ed;
				 *((long long*)(_t76 + 8)) = _t93;
				 *0x40021060 = _t93;
				 *0x4001f7e0();
				goto 0x40011958;
				_t90 =  *0x40020444; // 0x450000
				_t25 = _t92 + 0x60; // 0x60
				r8d = _t25;
				RtlAllocateHeap(??, ??, ??);
				_t81 = _t76;
				if (_t76 == 0) goto 0x40011958;
				 *_t76 = _t90;
				 *((long long*)(_t76 + 8)) = _t90;
				 *((long long*)(_t76 + 0x10)) = _t90;
				 *((long long*)(_t81 + 0x20)) = _t95;
				 *((intOrPtr*)(_t81 + 0x28)) = _a16;
				 *((intOrPtr*)(_t81 + 0x2c)) = _a24;
				if ((r9d & 0x00000003) - 1 <= 0) goto 0x40011947;
				 *((intOrPtr*)(_t81 + 0x30)) = 0;
				goto 0x40011958;
				_t34 = _t81 + 0x38; // 0x38
				 *((intOrPtr*)(_t81 + 0x30)) = 1;
				return E0000000114001F7E8(_a24, 0, 0, r9d & 0x00000003, _t57, _t59, (r9d & 0x00000003) - 1, _t71, _t76, _t81, _t34, E00000001140011A30, _t93, _t95, _t99, _t100, _t101, _t102, _t103, _t104);
			}
























    0x1400117fc
    0x140011801
    0x140011806
    0x140011816
    0x140011826
    0x140011829
    0x14001182e
    0x140011835
    0x14001183b
    0x140011849
    0x140011855
    0x14001185b
    0x140011865
    0x14001186b
    0x140011870
    0x140011872
    0x140011875
    0x14001187b
    0x140011881
    0x14001188c
    0x14001188c
    0x140011890
    0x140011896
    0x14001189c
    0x14001189e
    0x1400118a7
    0x1400118ae
    0x1400118b2
    0x1400118bd
    0x1400118bf
    0x1400118c3
    0x1400118c8
    0x1400118cc
    0x1400118d3
    0x1400118d7
    0x1400118da
    0x1400118e1
    0x1400118e7
    0x1400118e9
    0x1400118ed
    0x1400118fb
    0x140011901
    0x140011903
    0x14001190c
    0x14001190c
    0x140011910
    0x140011918
    0x14001191e
    0x140011920
    0x140011923
    0x140011927
    0x14001192f
    0x140011933
    0x14001193a
    0x140011940
    0x140011942
    0x140011945
    0x140011947
    0x14001194b
    0x140011967

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AllocateCriticalHeapSection$AcquireInitializeLeaveLock
    • String ID:
    • API String ID: 1976302020-0
    • Opcode ID: 9401c8691c50f740a847db88c587e37cfc3cc7e6b1d7d2a34aa6e1dd6b61c51d
    • Instruction ID: 3c708bd0e8d6be70d523372ffb5b6a2e3cd9d0d7dbc1ea7b56162c86fa93b61b
    • Opcode Fuzzy Hash: 9401c8691c50f740a847db88c587e37cfc3cc7e6b1d7d2a34aa6e1dd6b61c51d
    • Instruction Fuzzy Hash: 5E413932605B8086EB5ADF56E4403E877A4F79CBD0F54812AEB4D4BBA5DF39C8A5C700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140007284 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AcquireCloseCreateCriticalHandleLeaveLockObjectSectionSingleThreadWait
    • String ID:
    • API String ID: 1076354578-0
    • Opcode ID: dccc955c77b5a6b17664b800404429e9a916fd3538430a1521d222f39eb64d12
    • Instruction ID: 37a7c27cb33ea643b241ae4d06e82751f63dd7a6f22fff0809f2f79c8fcd043f
    • Opcode Fuzzy Hash: dccc955c77b5a6b17664b800404429e9a916fd3538430a1521d222f39eb64d12
    • Instruction Fuzzy Hash: 5E21FD76204B0081EB06DB12E8943E973A4FB8CBC4F988126EB8D477B9DF39C906C300
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140011968 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: CriticalFreeHeapSection$AcquireDeleteLeaveLock
    • String ID:
    • API String ID: 829175741-0
    • Opcode ID: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
    • Instruction ID: 030e86aa03d9d600b90796447865b7023312810cb66964dcc71f9bcfbca43c2c
    • Opcode Fuzzy Hash: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
    • Instruction Fuzzy Hash: 4721E735201B4485EB4ADB57E5903E823A4F78CBC4F444115AB5E0B7B6CF3AC4A5C340
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000E824 Relevance: 6.3, APIs: 5, Instructions: 92COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: memset$memcpy
    • String ID:
    • API String ID: 368790112-0
    • Opcode ID: d3cebf725d949ebbd98cb9ef7f68bda467ea1853d0e4d33e0ea42ea6cb49cd70
    • Instruction ID: a94d66f0502d68e3f48ed78985175dce6facf9e9c189752d3e598d0e8768336a
    • Opcode Fuzzy Hash: d3cebf725d949ebbd98cb9ef7f68bda467ea1853d0e4d33e0ea42ea6cb49cd70
    • Instruction Fuzzy Hash: 2231F1B271064081FB16DA2BF4507ED6752E7DDBD0F848126EB1A87BAACE3EC542C740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140013227 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 273COMMON
    Download Yara Rule
    C-Code - Quality: 48%
    			E00000001140013227(signed int __ebx, void* __esi, void* __rdi, void* __r10, long long __r12, void* __r13, signed char* __r14) {
				signed short _t492;
				signed short _t503;
				signed short _t504;
				signed int _t535;
				unsigned int _t541;
				unsigned int _t547;
				signed int _t566;
				signed int _t568;
				signed int _t579;
				signed char _t585;
				signed int _t602;
				signed char _t608;
				void* _t616;
				intOrPtr _t617;
				signed char _t620;
				void* _t627;
				signed short _t628;
				signed int _t641;
				signed int _t643;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t650;
				void* _t651;
				signed int _t656;
				signed int _t657;
				signed int _t659;
				void* _t660;
				signed int _t661;
				void* _t662;
				signed int _t663;
				void* _t664;
				signed int _t665;
				void* _t666;
				signed int _t668;
				signed int _t669;
				void* _t670;
				signed int _t672;
				signed int _t673;
				void* _t674;
				signed int _t676;
				void* _t677;
				signed int _t678;
				signed int _t679;
				void* _t680;
				signed int _t682;
				void* _t683;
				signed int _t684;
				signed int _t686;
				signed int _t687;
				signed char _t715;
				signed char _t719;
				signed int _t721;
				signed int _t726;
				signed char _t742;
				signed char _t744;
				signed char _t776;
				signed char _t779;
				signed char _t785;
				signed char _t809;
				signed char _t812;
				signed char _t818;
				unsigned int _t819;
				void* _t820;
				void* _t821;
				signed char _t822;
				void* _t823;
				signed int _t840;
				unsigned int _t842;
				void* _t844;
				signed int* _t848;
				signed int* _t852;
				signed char _t859;
				signed char _t861;
				void* _t864;
				signed int _t866;
				signed int _t868;
				signed int _t870;
				signed int _t871;
				void* _t873;
				void* _t874;
				void* _t875;
				void* _t876;
				void* _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t884;
				void* _t885;
				void* _t886;
				void* _t887;
				void* _t888;
				intOrPtr _t889;
				intOrPtr _t890;
				void* _t891;
				void* _t892;
				void* _t893;
				void* _t894;
				void* _t895;
				void* _t896;
				void* _t897;
				void* _t899;
				void* _t967;
				void* _t995;
				void* _t1008;
				intOrPtr _t1071;
				intOrPtr _t1073;
				intOrPtr _t1074;
				intOrPtr _t1075;
				intOrPtr _t1076;
				intOrPtr _t1077;
				intOrPtr _t1078;
				intOrPtr _t1079;
				signed long long _t1085;
				signed int _t1086;
				signed long long _t1089;
				signed long long _t1090;
				signed long long _t1091;
				signed int _t1094;
				signed long long _t1097;
				signed long long _t1100;
				void* _t1107;
				intOrPtr _t1109;
				void* _t1110;
				intOrPtr _t1111;
				signed long long _t1112;
				signed long long _t1113;
				long long _t1115;
				signed long long _t1116;
				signed long long _t1117;
				signed long long _t1118;
				signed long long _t1119;
				signed long long _t1120;
				void* _t1123;
				intOrPtr _t1126;
				intOrPtr _t1128;
				void* _t1133;
				intOrPtr _t1145;
				intOrPtr _t1146;
				signed long long _t1148;
				void* _t1151;
				void* _t1153;
				void* _t1155;
				long long _t1156;
				long long _t1158;
				signed long long _t1159;
				intOrPtr _t1160;
				signed long long _t1163;
				signed int* _t1166;
				signed long long _t1170;
				signed long long _t1171;
				signed long long _t1172;
				signed long long _t1173;
				void* _t1175;
				void* _t1176;
				signed int _t1177;
				intOrPtr _t1178;
				long long _t1180;
				signed char* _t1185;
				signed char* _t1186;
				signed char* _t1187;
				signed char* _t1188;
				signed char* _t1189;
				signed char* _t1190;
				signed char* _t1191;
				signed char* _t1192;
				signed char* _t1193;
				signed char* _t1195;
				signed char* _t1196;
				signed char* _t1197;
				signed char* _t1198;
				signed char* _t1199;
				signed char* _t1200;
				signed char* _t1202;
				signed char* _t1203;
				signed char* _t1204;
				signed char* _t1205;
				signed char* _t1206;
				signed char* _t1207;
				signed char* _t1208;
				signed char* _t1209;

				_t1175 = __r10;
				if (__ebx - 0x20 >= 0) goto 0x40013250;
				if (__esi == 0) goto 0x400144ee;
				_t873 = __esi - 1;
				_t1185 =  &(__r14[1]);
				r15d = r15d + (( *__r14 & 0x000000ff) << __ebx);
				if (__ebx + 8 - 0x20 < 0) goto 0x40013230;
				_t1071 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1071 == 0) goto 0x4001325d;
				 *(_t1071 + 4) = r15d;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400132a3;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400132a3;
				 *(_t1151 - 0x50) = r15b;
				r8d = 4;
				 *(_t1151 - 0x4f) = r15d >> 8;
				r15d = r15d >> 0x18;
				 *(_t1151 - 0x4d) = r15b;
				 *((char*)(_t1151 - 0x4e)) = r15d >> 0x10;
				 *(__r13 + 0x20) = E00000001140015160(_t1151 - 0x50);
				r15d = r12d;
				_t641 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f37;
				if (_t641 - 0x10 >= 0) goto 0x400132d8;
				if (_t873 == 0) goto 0x400144ee;
				_t874 = _t873 - 1;
				_t1186 =  &(_t1185[1]);
				r15d = r15d + (( *_t1185 & 0x000000ff) << _t641);
				if (_t641 + 8 - 0x10 < 0) goto 0x400132b8;
				_t1109 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1109 == 0) goto 0x400132f5;
				 *(_t1109 + 8) = r15b & 0xffffffff;
				 *( *((intOrPtr*)(__r13 + 0x28)) + 0xc) = r15d >> 8;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013329;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013329;
				 *(_t1151 - 0x50) = r15b;
				r15d = r15d >> 8;
				 *(_t1151 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1151 - 0x50);
				r15d = r12d;
				_t643 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f38;
				if (( *(__r13 + 0x18) & 0x00000400) == 0) goto 0x400133b3;
				if (_t643 - 0x10 >= 0) goto 0x40013366;
				if (_t874 == 0) goto 0x400144ee;
				_t875 = _t874 - 1;
				_t1187 =  &(_t1186[1]);
				r15d = r15d + (( *_t1186 & 0x000000ff) << _t643);
				if (_t643 + 8 - 0x10 < 0) goto 0x40013346;
				_t1073 =  *((intOrPtr*)(__r13 + 0x28));
				 *(__r13 + 0x50) = r15d;
				if (_t1073 == 0) goto 0x40013377;
				 *(_t1073 + 0x18) = r15d;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400133ab;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400133ab;
				 *(_t1151 - 0x50) = r15b;
				r15d = r15d >> 8;
				_t1123 = _t1151 - 0x50;
				 *(_t1151 - 0x4f) = r15b;
				r8d = 2;
				 *(__r13 + 0x20) = E00000001140015160(_t1123);
				r15d = r12d;
				_t645 = r12d;
				goto 0x400133c0;
				_t1074 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1074 == 0) goto 0x400133c0;
				 *((long long*)(_t1074 + 0x10)) = __r12;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f39;
				if (( *(__r13 + 0x18) & 0x00000400) == 0) goto 0x40013456;
				_t866 =  >  ? _t875 :  *(__r13 + 0x50);
				if (_t866 == 0) goto 0x4001344b;
				_t1075 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1075 == 0) goto 0x4001341c;
				_t1160 =  *((intOrPtr*)(_t1075 + 0x10));
				if (_t1160 == 0) goto 0x4001341c;
				if (__rdi + _t1123 -  *((intOrPtr*)(_t1075 + 0x1c)) <= 0) goto 0x4001340a;
				goto 0x4001340c;
				r8d = _t866;
				_t1110 = _t1109 + _t1160;
				memcpy(??, ??, ??);
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013440;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013440;
				r8d = _t866;
				 *(__r13 + 0x20) = E00000001140015160(_t1187);
				_t876 = _t875 - _t866;
				_t1188 =  &(_t1187[_t1075]);
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - _t866;
				if ( *(__r13 + 0x50) != 0) goto 0x400144ee;
				 *(__r13 + 0x50) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3a;
				if (( *(__r13 + 0x18) & 0x00000800) == 0) goto 0x400134ee;
				if (_t876 == 0) goto 0x400144ee;
				_t868 = r12d + 1;
				r12d =  *(_t1075 + _t1188) & 0x000000ff;
				_t1076 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1076 == 0) goto 0x400134ac;
				_t1126 =  *((intOrPtr*)(_t1076 + 0x20));
				if (_t1126 == 0) goto 0x400134ac;
				if ( *(__r13 + 0x50) -  *((intOrPtr*)(_t1076 + 0x28)) >= 0) goto 0x400134ac;
				 *((intOrPtr*)(_t1110 + _t1126)) = r12b;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + 1;
				if (r12d == 0) goto 0x400134b5;
				if (_t868 - _t876 < 0) goto 0x40013480;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x400134d9;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400134d9;
				r8d = _t868;
				 *(__r13 + 0x20) = E00000001140015160(_t1188);
				_t877 = _t876 - _t868;
				_t1189 =  &(_t1188[_t1076]);
				if (r12d != 0) goto 0x400144ee;
				r12d = 0;
				goto 0x400134fb;
				_t1077 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1077 == 0) goto 0x400134fb;
				 *((long long*)(_t1077 + 0x20)) = __r12;
				 *(__r13 + 0x50) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3b;
				if (( *(__r13 + 0x18) & 0x00001000) == 0) goto 0x4001358e;
				if (_t877 == 0) goto 0x400144ee;
				_t870 = r12d + 1;
				r12d =  *(_t1077 + _t1189) & 0x000000ff;
				_t1078 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1078 == 0) goto 0x4001354c;
				_t1128 =  *((intOrPtr*)(_t1078 + 0x30));
				if (_t1128 == 0) goto 0x4001354c;
				if ( *(__r13 + 0x50) -  *((intOrPtr*)(_t1078 + 0x38)) >= 0) goto 0x4001354c;
				 *((intOrPtr*)(_t1110 + _t1128)) = r12b;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + 1;
				if (r12d == 0) goto 0x40013555;
				if (_t870 - _t877 < 0) goto 0x40013520;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x40013579;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013579;
				r8d = _t870;
				 *(__r13 + 0x20) = E00000001140015160(_t1189);
				_t878 = _t877 - _t870;
				_t1190 =  &(_t1189[_t1078]);
				if (r12d != 0) goto 0x400144ee;
				r12d = 0;
				goto 0x4001359b;
				_t1079 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1079 == 0) goto 0x4001359b;
				 *((long long*)(_t1079 + 0x30)) = __r12;
				_t1145 =  *((intOrPtr*)(_t1151 + 0x20));
				r11d =  *(_t1151 + 0x38);
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3c;
				if (( *(__r13 + 0x18) & 0x00000200) == 0) goto 0x4001360c;
				if (_t645 - 0x10 >= 0) goto 0x400135e0;
				if (_t878 == 0) goto 0x400144ee;
				_t879 = _t878 - 1;
				_t1191 =  &(_t1190[1]);
				r15d = r15d + (( *_t1190 & 0x000000ff) << _t645);
				if (_t645 + 8 - 0x10 < 0) goto 0x400135c0;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x40013606;
				if (r15d == ( *(__r13 + 0x20) & 0x0000ffff)) goto 0x40013606;
				 *(_t1145 + 0x20) = "header crc mismatch";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t647 = r12d;
				_t1111 =  *((intOrPtr*)(__r13 + 0x28));
				if (_t1111 == 0) goto 0x4001362d;
				 *(_t1111 + 0x3c) =  *(__r13 + 0x18) >> 0x00000009 & 0x00000001;
				 *( *((intOrPtr*)(__r13 + 0x28)) + 0x40) = 1;
				r8d = 0;
				_t492 = E00000001140015160(_t1189);
				 *(__r13 + 0x20) = _t492;
				 *(_t1145 + 0x4c) = _t492;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				r11d =  *(_t1151 + 0x38);
				if ( *((intOrPtr*)(__r13 + 8)) - 0x3f34 - 0x1e > 0) goto 0x40014626;
				r10d =  *(_t1151 - 0x4c);
				r12d = 0;
				if (_t647 - 0x20 >= 0) goto 0x40013693;
				if (_t879 == 0) goto 0x400144ee;
				_t880 = _t879 - 1;
				_t1192 =  &(_t1191[1]);
				r15d = r15d + (( *_t1191 & 0x000000ff) << _t647);
				if (_t647 + 8 - 0x20 < 0) goto 0x40013673;
				_t649 = r12d;
				r15d = r15d >> 0x18;
				_t503 = (r15d >> 0x00000008 & 0x0000ff00) + ((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + r15d;
				r15d = r12d;
				 *(__r13 + 0x20) = _t503;
				 *(_t1145 + 0x4c) = _t503;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3e;
				if ( *((intOrPtr*)(__r13 + 0x14)) == 0) goto 0x40014481;
				r8d = 0;
				_t504 = E00000001140015A00(_t503, 0, 0, _t1107, _t1155);
				_t1163 =  *(_t1151 - 0x40);
				r11d =  *(_t1151 + 0x38);
				 *(__r13 + 0x20) = _t504;
				 *(_t1145 + 0x4c) = _t504;
				_t1156 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				if ( *((intOrPtr*)(_t1151 + 0x28)) + 0xfffffffb - 1 <= 0) goto 0x400144ee;
				if ( *(__r13 + 0xc) == 0) goto 0x40013733;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4e;
				_t715 = _t649 & 0x00000007;
				r15d = r15d >> _t715;
				_t650 = _t649 - _t715;
				goto 0x40013650;
				if (_t650 - 3 >= 0) goto 0x40013758;
				if (_t880 == 0) goto 0x400144ee;
				_t651 = _t650 + 8;
				_t881 = _t880 - 1;
				_t1193 =  &(_t1192[1]);
				r15d = r15d + (( *_t1192 & 0x000000ff) << _t650);
				_t967 = _t651 - 3;
				if (_t967 < 0) goto 0x40013738;
				r15d = r15d >> 1;
				 *(__r13 + 0xc) = r15d & 0x00000001;
				if (_t967 == 0) goto 0x400137ed;
				if (_t967 == 0) goto 0x400137ae;
				if (_t967 == 0) goto 0x4001379a;
				if (_t967 != 0) goto 0x400137f5;
				r15d = r15d >> 2;
				 *(_t1145 + 0x20) = "invalid block type";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r15d >> 2;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f44;
				goto 0x40013650;
				 *_t1156 = 9;
				 *(__r13 + 0x60) = 0x40019e70;
				 *((intOrPtr*)(__r13 + 0x74)) = 5;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				 *((long long*)(__r13 + 0x68)) = 0x4001a670;
				if ( *((intOrPtr*)(_t1151 + 0x28)) != 6) goto 0x400137f5;
				r15d = r15d >> 2;
				goto 0x400144f1;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f41;
				r15d = r15d >> 2;
				_t656 = _t651 - 1 + 0x3fffffff8;
				_t719 = _t656 & 0x00000007;
				_t657 = _t656 - _t719;
				r15d = r15d >> _t719;
				if (_t657 - 0x20 >= 0) goto 0x40013830;
				if (_t881 == 0) goto 0x400144ee;
				_t882 = _t881 - 1;
				r15d = r15d + (( *_t1193 & 0x000000ff) << _t657);
				if (_t657 + 8 - 0x20 < 0) goto 0x40013810;
				_t721 = r15w & 0xffffffff;
				if (_t721 ==  !r15d >> 0x10) goto 0x40013858;
				_t1085 = "invalid stored block lengths";
				 *(_t1145 + 0x20) = _t1085;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x50) = _t721;
				r15d = r12d;
				_t659 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f42;
				if ( *((intOrPtr*)(_t1151 + 0x28)) == 6) goto 0x400144f1;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f43;
				r12d =  *(__r13 + 0x50);
				if (r12d == 0) goto 0x400138d8;
				r12d =  >  ? _t882 : r12d;
				r12d =  >  ? r11d : r12d;
				if (r12d == 0) goto 0x400144ee;
				r8d = r12d;
				_t1112 = _t1163;
				_t871 = r12d;
				memcpy(??, ??, ??);
				r11d =  *(_t1151 + 0x38);
				r11d = r11d - r12d;
				_t1195 =  &(( &(_t1193[1]))[_t1145]);
				_t1146 =  *((intOrPtr*)(_t1151 + 0x20));
				_t883 = _t882 - r12d;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - r12d;
				 *(_t1151 + 0x38) = r11d;
				 *(_t1151 - 0x40) =  *(_t1151 - 0x40) + _t1145;
				goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				if (_t659 - 0xe >= 0) goto 0x40013910;
				asm("o16 nop [eax+eax]");
				if (_t883 == 0) goto 0x400144ee;
				_t660 = _t659 + 8;
				_t884 = _t883 - 1;
				_t1196 =  &(_t1195[1]);
				r15d = r15d + (( *_t1195 & 0x000000ff) << _t659);
				if (_t660 - 0xe < 0) goto 0x400138f0;
				r15d = r15d >> 5;
				_t661 = _t660 + 0xfffffff2;
				r15d = r15d >> 5;
				_t726 = (r15d & 0x0000001f) + 0x101;
				_t840 = (r15d & 0x0000001f) + 1;
				r15d = r15d >> 4;
				 *(__r13 + 0x7c) = _t726;
				 *(__r13 + 0x80) = _t840;
				 *((intOrPtr*)(__r13 + 0x78)) = (r15d & 0x0000000f) + 4;
				if (_t726 - 0x11e > 0) goto 0x40013a7b;
				if (_t840 - 0x1e > 0) goto 0x40013a7b;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f45;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) >= 0) goto 0x400139e3;
				if (_t661 - 3 >= 0) goto 0x400139a8;
				if (_t884 == 0) goto 0x400144ee;
				_t662 = _t661 + 8;
				_t885 = _t884 - 1;
				_t1197 =  &(_t1196[1]);
				r15d = r15d + (( *_t1196 & 0x000000ff) << _t661);
				if (_t662 - 3 < 0) goto 0x40013988;
				_t663 = _t662 + 0xfffffffd;
				r15d = r15d >> 3;
				 *(__r13 + 0x90 + _t1085 * 2) = r15w & 7;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) < 0) goto 0x40013983;
				if ( *(__r13 + 0x84) - 0x13 >= 0) goto 0x40013a19;
				 *(__r13 + 0x90 + _t1085 * 2) = r12w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) - 0x13 < 0) goto 0x400139f0;
				_t1086 = __r13 + 0x550;
				_t1166 = __r13 + 0x88;
				 *_t1166 = _t1086;
				 *(__r13 + 0x60) = _t1086;
				 *((long long*)(_t1153 + 0x28)) = __r13 + 0x310;
				 *_t1156 = 7;
				 *((long long*)(_t1153 + 0x20)) = _t1156;
				_t218 = _t1112 + 0x13; // 0x13
				r8d = _t218;
				_t1133 = __r13 + 0x90;
				_t535 = E00000001140015DD0(0, _t871, _t899, __r13 + 0x310, _t1133, _t1156, _t1166, _t1175, __r12);
				r11d =  *(_t1151 + 0x38);
				 *(_t1151 + 0x30) = _t535;
				if (_t535 == 0) goto 0x40013a93;
				 *(_t1146 + 0x20) = "invalid code lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t1089 = "too many length or distance symbols";
				 *(_t1146 + 0x20) = _t1089;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f46;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) >= 0) goto 0x40013cca;
				asm("o16 nop [eax+eax]");
				_t1113 = _t1112 & _t1089;
				_t1090 =  *(__r13 + 0x60);
				_t541 =  *(_t1090 + _t1113 * 4);
				 *(_t1151 - 0x48) = _t541;
				if ((_t541 >> 0x00000008 & 0x000000ff) - _t663 <= 0) goto 0x40013b44;
				if (_t885 == 0) goto 0x400144ee;
				_t664 = _t663 + 8;
				_t886 = _t885 - 1;
				r15d = r15d + (( *_t1197 & 0x000000ff) << _t663);
				_t1198 =  &(_t1197[1]);
				_t1091 =  *(__r13 + 0x60);
				_t547 =  *(_t1091 + (_t1113 & _t1090) * 4);
				 *(_t1151 - 0x48) = _t547;
				if ((_t547 >> 0x00000008 & 0x000000ff) - _t664 > 0) goto 0x40013b00;
				_t842 = _t547 >> 0x10;
				_t995 = _t842 - 0x10;
				if (_t995 >= 0) goto 0x40013b72;
				_t742 = _t547 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x90 + _t1091 * 2) = _t842;
				r15d = r15d >> _t742;
				_t665 = _t664 - _t742;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				goto 0x40013caf;
				if (_t995 != 0) goto 0x40013bd4;
				_t844 = (r10d >> 0x00000008 & 0x000000ff) + 2;
				if (_t665 - _t844 >= 0) goto 0x40013ba0;
				if (_t886 == 0) goto 0x400144ee;
				_t666 = _t665 + 8;
				_t887 = _t886 - 1;
				_t1199 =  &(_t1198[1]);
				r15d = r15d + (( *_t1198 & 0x000000ff) << _t665);
				if (_t666 - _t844 < 0) goto 0x40013b81;
				_t744 =  *(_t1151 - 0x47) & 0x000000ff;
				r15d = r15d >> _t744;
				if (r10d == 0) goto 0x40013cfb;
				r15d = r15d >> 2;
				r8d =  *(__r13 + 0x90 + _t1091 * 2) & 0x0000ffff;
				_t668 = _t666 - _t744 + 0xfffffffe;
				goto 0x40013c6f;
				r9d =  *(_t1151 - 0x47) & 0x000000ff;
				if ( *(_t1151 - 0x46) != 0x11) goto 0x40013c21;
				_t848 =  &(_t1166[0]);
				if (_t668 - _t848 >= 0) goto 0x40013c07;
				if (_t887 == 0) goto 0x400144ee;
				_t669 = _t668 + 8;
				_t888 = _t887 - 1;
				_t1200 =  &(_t1199[1]);
				r15d = r15d + (( *_t1199 & 0x000000ff) << _t668);
				if (_t669 - _t848 < 0) goto 0x40013be8;
				r15d = r15d >> r9d;
				r15d = r15d >> 3;
				goto 0x40013c67;
				_t852 =  &(_t1166[1]);
				if (_t669 - _t852 >= 0) goto 0x40013c4f;
				if (_t888 == 0) goto 0x400144ee;
				_t670 = _t669 + 8;
				_t889 = _t888 - 1;
				r15d = r15d + (( *_t1200 & 0x000000ff) << _t669);
				if (_t670 - _t852 < 0) goto 0x40013c30;
				r15d = r15d >> r9d;
				r15d = r15d >> 7;
				r8d = r12d;
				if (_t1175 + _t1133 -  *(__r13 + 0x80) +  *(__r13 + 0x7c) > 0) goto 0x40013cfb;
				_t1008 = (r15d & 0x0000007f) + 0xb;
				if (_t1008 == 0) goto 0x40013cab;
				asm("o16 nop [eax+eax]");
				 *(__r13 + 0x90 + _t1091 * 2) = r8w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if (_t1008 != 0) goto 0x40013c90;
				_t1158 = __r13 + 0x70;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) < 0) goto 0x40013ad0;
				if ( *((intOrPtr*)(__r13 + 8)) == 0x3f51) goto 0x4001364c;
				if ( *((short*)(__r13 + 0x290)) != 0) goto 0x40013d13;
				 *(_t1146 + 0x20) = "invalid code -- missing end-of-block";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				 *(_t1146 + 0x20) = "invalid bit length repeat";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t1094 = __r13 + 0x550;
				 *_t1158 = 9;
				_t1180 = __r13 + 0x310;
				 *((long long*)(_t1153 + 0x28)) = _t1180;
				 *((long long*)(_t1153 + 0x20)) = _t1158;
				r8d =  *(__r13 + 0x7c);
				 *(__r13 + 0x88) = _t1094;
				 *(__r13 + 0x60) = _t1094;
				_t566 = E00000001140015DD0(1, _t871, _t899, _t1094, __r13 + 0x90, _t1158, __r13 + 0x88, _t1175, _t1180);
				 *(_t1151 + 0x30) = _t566;
				if (_t566 == 0) goto 0x40013d7c;
				 *((long long*)( *((intOrPtr*)(_t1151 + 0x20)) + 0x20)) = "invalid literal/lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				r8d =  *(__r13 + 0x80);
				_t1115 = __r13 + 0x74;
				 *((long long*)(__r13 + 0x68)) =  *(__r13 + 0x88);
				 *_t1115 = 6;
				 *((long long*)(_t1153 + 0x28)) = _t1180;
				 *((long long*)(_t1153 + 0x20)) = _t1115;
				_t568 = E00000001140015DD0(2, _t871, _t899,  *(__r13 + 0x88), 0x90 +  *(__r13 + 0x88) * 2 + __r13, _t1158, __r13 + 0x88, _t1175, _t1180);
				r12d = _t568;
				 *(_t1151 + 0x30) = _t568;
				if (_t568 == 0) goto 0x40013dd5;
				_t1097 = "invalid distances set";
				goto 0x40013d67;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				if ( *((intOrPtr*)(_t1151 + 0x28)) == 6) goto 0x400144f5;
				_t1148 =  *((intOrPtr*)(_t1151 + 0x20));
				r10d =  *(_t1151 - 0x4c);
				r11d =  *(_t1151 + 0x38);
				r12d = 0;
				_t1159 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (_t889 - 6 < 0) goto 0x40013e73;
				if (r11d - 0x102 < 0) goto 0x40013e73;
				 *((long long*)(_t1148 + 0x10)) =  *(_t1151 - 0x40);
				 *(_t1148 + 0x18) = r11d;
				 *_t1148 =  &(_t1200[1]);
				 *((intOrPtr*)(_t1148 + 8)) = _t889;
				_t1116 = _t1148;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t670 + 0xfffffff9 - r9d;
				E00000001140016210(r10d, _t1097, _t1116, 0x90 +  *(__r13 + 0x88) * 2 + __r13,  *(_t1151 - 0x40), _t1175, _t1176);
				_t1170 =  *((intOrPtr*)(_t1148 + 0x10));
				r11d =  *(_t1148 + 0x18);
				_t1202 =  *_t1148;
				_t890 =  *((intOrPtr*)(_t1148 + 8));
				r15d =  *(__r13 + 0x48);
				_t672 =  *(__r13 + 0x4c);
				 *(_t1151 - 0x40) = _t1170;
				 *(_t1151 + 0x38) = r11d;
				if ( *((intOrPtr*)(__r13 + 8)) != 0x3f3f) goto 0x40013650;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013650;
				_t1177 =  *(__r13 + 0x60);
				 *(__r13 + 0x1be4) = r12d;
				_t1117 = _t1116 & _t1097;
				if (( *(_t1177 + _t1117 * 4) >> 0x00000008 & 0x000000ff) - _t672 <= 0) goto 0x40013ee2;
				if (_t890 == 0) goto 0x400144ee;
				_t673 = _t672 + 8;
				_t891 = _t890 - 1;
				r15d = r15d + (( *_t1202 & 0x000000ff) << _t672);
				_t1203 =  &(_t1202[1]);
				_t1118 = _t1117 & _t1097;
				_t579 =  *( *(__r13 + 0x60) + _t1118 * 4);
				if ((_t579 >> 0x00000008 & 0x000000ff) - _t673 > 0) goto 0x40013ea1;
				if (_t579 == 0) goto 0x40013fb0;
				if ((_t579 & 0x000000f0) != 0) goto 0x40013fb0;
				r10d = _t579;
				 *(_t1151 - 0x48) = _t579;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t579 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t579 >> 0x10);
				r11d =  *(_t1151 - 0x47) & 0x000000ff;
				r8d =  *(_t1177 + _t1170 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t673 <= 0) goto 0x40013fa0;
				r10d =  *(_t1151 - 0x46) & 0x0000ffff;
				if (_t891 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t1203 & 0x000000ff) << _t673);
				r8d = r8d << (_t579 & 0x000000ff) + r9d;
				_t674 = _t673 + 8;
				r8d = r8d - 1;
				_t892 = _t891 - 1;
				_t1204 =  &(_t1203[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t585 =  *( *(__r13 + 0x60) + _t1159 * 4);
				r8d = _t585 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t674 > 0) goto 0x40013f46;
				_t776 = r11b & 0xffffffff;
				r15d = r15d >> _t776;
				 *(__r13 + 0x1be4) = _t776;
				_t779 = _t585 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t779;
				r15d = r15d >> _t779;
				_t676 = _t674 - _t776 - _t779;
				 *(__r13 + 0x50) = _t585 >> 0x10;
				if (_t585 != 0) goto 0x40013fde;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4d;
				goto 0x40013648;
				if ((_t585 & 0x00000020) == 0) goto 0x40013ff2;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013640;
				if ((_t585 & 0x00000040) == 0) goto 0x4001400e;
				_t1100 = "invalid literal/length code";
				 *(_t1148 + 0x20) = _t1100;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f49;
				 *(__r13 + 0x58) = _t585 & 0xf;
				_t859 =  *(__r13 + 0x58);
				if (_t859 == 0) goto 0x4001406d;
				if (_t676 - _t859 >= 0) goto 0x4001404f;
				if (_t892 == 0) goto 0x400144ee;
				_t677 = _t676 + 8;
				_t893 = _t892 - 1;
				_t1205 =  &(_t1204[1]);
				r15d = r15d + (( *_t1204 & 0x000000ff) << _t676);
				if (_t677 - _t859 < 0) goto 0x40014030;
				_t785 = _t859;
				_t678 = _t677 - _t859;
				r15d = r15d >> _t785;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + ((0x00000001 << _t785) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t859;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4a;
				 *(__r13 + 0x1be8) =  *(__r13 + 0x50);
				_t1178 =  *((intOrPtr*)(__r13 + 0x68));
				_t1119 = _t1118 & _t1100;
				if (( *(_t1178 + _t1119 * 4) >> 0x00000008 & 0x000000ff) - _t678 <= 0) goto 0x400140f0;
				asm("o16 nop [eax+eax]");
				if (_t893 == 0) goto 0x400144ee;
				_t679 = _t678 + 8;
				_t894 = _t893 - 1;
				r15d = r15d + (( *_t1205 & 0x000000ff) << _t678);
				_t1206 =  &(_t1205[1]);
				_t1120 = _t1119 & _t1100;
				_t602 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t1120 * 4);
				if ((_t602 >> 0x00000008 & 0x000000ff) - _t679 > 0) goto 0x400140b0;
				if ((_t602 & 0x000000f0) != 0) goto 0x400141ba;
				r10d = _t602;
				 *(_t1151 - 0x48) = _t602;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t602 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t602 >> 0x10);
				r11d =  *(_t1151 - 0x47) & 0x000000ff;
				r8d =  *(_t1178 + _t1170 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t679 <= 0) goto 0x400141aa;
				r10d =  *(_t1151 - 0x46) & 0x0000ffff;
				if (_t894 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t1206 & 0x000000ff) << _t679);
				r8d = r8d << (_t602 & 0x000000ff) + r9d;
				_t680 = _t679 + 8;
				r8d = r8d - 1;
				_t895 = _t894 - 1;
				_t1207 =  &(_t1206[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t608 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t1159 * 4);
				r8d = _t608 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t680 > 0) goto 0x40014150;
				_t809 = r11b & 0xffffffff;
				r15d = r15d >> _t809;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t809;
				_t1171 =  *(_t1151 - 0x40);
				r11d =  *(_t1151 + 0x38);
				_t812 = _t608 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t812;
				r15d = r15d >> _t812;
				_t682 = _t680 - _t809 - _t812;
				if ((_t608 & 0x00000040) == 0) goto 0x400141f2;
				 *(_t1148 + 0x20) = "invalid distance code";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r10d =  *(_t1151 - 0x4c);
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4b;
				 *(__r13 + 0x54) = _t608 >> 0x10;
				 *(__r13 + 0x58) = _t608 & 0xf;
				_t861 =  *(__r13 + 0x58);
				if (_t861 == 0) goto 0x4001425d;
				if (_t682 - _t861 >= 0) goto 0x4001423f;
				if (_t895 == 0) goto 0x400144ee;
				_t683 = _t682 + 8;
				_t896 = _t895 - 1;
				_t1208 =  &(_t1207[1]);
				r15d = r15d + (( *_t1207 & 0x000000ff) << _t682);
				if (_t683 - _t861 < 0) goto 0x40014220;
				_t818 = _t861;
				_t684 = _t683 - _t861;
				r15d = r15d >> _t818;
				 *(__r13 + 0x54) =  *(__r13 + 0x54) + ((0x00000001 << _t818) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t861;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4c;
				if (r11d == 0) goto 0x400144ee;
				_t819 =  *(__r13 + 0x54);
				_t616 = r10d - r11d;
				if (_t819 - _t616 <= 0) goto 0x400142ca;
				_t820 = _t819 - _t616;
				if (_t820 -  *((intOrPtr*)(__r13 + 0x38)) <= 0) goto 0x400142a6;
				if ( *((intOrPtr*)(__r13 + 0x1be0)) == 0) goto 0x400142a6;
				 *(_t1148 + 0x20) = "invalid distance too far back";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				_t617 =  *((intOrPtr*)(__r13 + 0x3c));
				if (_t820 - _t617 <= 0) goto 0x400142b8;
				_t821 = _t820 - _t617;
				goto 0x400142bc;
				_t864 = _t617 - _t821;
				if (_t821 -  *(__r13 + 0x50) <= 0) goto 0x400142d6;
				goto 0x400142d4;
				_t620 =  *(__r13 + 0x50);
				_t822 = _t620;
				_t823 =  >  ? r11d : _t822;
				r11d = r11d - _t823;
				 *(_t1151 + 0x38) = r11d;
				 *(__r13 + 0x50) = _t620 - _t823;
				_t1172 = _t1171 + 1;
				 *((char*)(_t1172 - 1)) =  *(_t1171 - _t1120 - _t1171 + _t1171) & 0x000000ff;
				if (_t822 != r11d) goto 0x400142f0;
				 *(_t1151 - 0x40) = _t1172;
				if ( *(__r13 + 0x50) != _t823 - 1) goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (r11d == 0) goto 0x400144ee;
				_t1173 = _t1172 + 1;
				r11d = r11d - 1;
				 *((char*)(_t1173 - 1)) =  *(__r13 + 0x50) & 0x000000ff;
				 *(_t1151 + 0x38) = r11d;
				 *(_t1151 - 0x40) = _t1173;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				goto 0x40013650;
				if ( *((intOrPtr*)(_t1151 + 0x10)) == 0) goto 0x40014420;
				if (_t684 - 0x20 >= 0) goto 0x40014378;
				if (_t896 == 0) goto 0x400144ee;
				_t897 = _t896 - 1;
				_t1209 =  &(_t1208[1]);
				r15d = r15d + (( *_t1208 & 0x000000ff) << _t684);
				if (_t684 + 8 - 0x20 < 0) goto 0x40014358;
				r10d = r10d - r11d;
				 *((intOrPtr*)(_t1148 + 0x1c)) =  *((intOrPtr*)(_t1148 + 0x1c)) + r10d;
				 *((intOrPtr*)(__r13 + 0x24)) =  *((intOrPtr*)(__r13 + 0x24)) + r10d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400143c1;
				if (r10d == 0) goto 0x400143c1;
				r8d = r10d;
				if ( *(__r13 + 0x18) == 0) goto 0x400143ad;
				_t627 = E00000001140015160(_t1173 - "invalid distance too far back");
				goto 0x400143b2;
				_t628 = E00000001140015A00(_t627,  *(__r13 + 0x20), _t864, _t1107, _t1159);
				r11d =  *(_t1151 + 0x38);
				 *(__r13 + 0x20) = _t628;
				 *(_t1148 + 0x4c) = _t628;
				 *(_t1151 - 0x4c) = r11d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x4001441a;
				if ( *(__r13 + 0x18) != 0) goto 0x400143fc;
				if (((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + (r15d >> 0x00000008 & 0x0000ff00) + (r15d >> 0x18) ==  *(__r13 + 0x20)) goto 0x4001441a;
				 *(_t1148 + 0x20) = "incorrect data check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t686 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4f;
				if ( *(__r13 + 0x10) == 0) goto 0x400144c7;
				if ( *(__r13 + 0x18) == 0) goto 0x400144c7;
				if (_t686 - 0x20 >= 0) goto 0x40014463;
				if (_t897 == 0) goto 0x400144ee;
				_t687 = _t686 + 8;
				r15d = r15d + (( *_t1209 & 0x000000ff) << _t686);
				if (_t687 - 0x20 < 0) goto 0x40014443;
				if (r15d ==  *((intOrPtr*)(__r13 + 0x24))) goto 0x400144c1;
				 *(_t1148 + 0x20) = "incorrect length check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *((long long*)(_t1148 + 0x10)) =  *(_t1151 - 0x40);
				 *(_t1148 + 0x18) = r11d;
				 *_t1148 =  &(_t1209[1]);
				 *((intOrPtr*)(_t1148 + 8)) = _t897 - 1;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t687;
				return 2;
			}



























































































































































































    0x140013227
    0x14001322a
    0x140013232
    0x140013243
    0x140013245
    0x140013248
    0x14001324e
    0x140013250
    0x140013257
    0x140013259
    0x140013265
    0x14001326c
    0x140013271
    0x14001327c
    0x140013282
    0x140013288
    0x14001328f
    0x140013293
    0x14001329f
    0x1400132a3
    0x1400132a6
    0x1400132a9
    0x1400132b6
    0x1400132ba
    0x1400132cb
    0x1400132cd
    0x1400132d0
    0x1400132d6
    0x1400132d8
    0x1400132df
    0x1400132e5
    0x1400132f2
    0x1400132fd
    0x140013304
    0x140013306
    0x14001330a
    0x140013312
    0x14001331a
    0x140013325
    0x140013329
    0x14001332c
    0x14001332f
    0x14001333f
    0x140013344
    0x140013348
    0x140013359
    0x14001335b
    0x14001335e
    0x140013364
    0x140013366
    0x14001336a
    0x140013371
    0x140013373
    0x14001337f
    0x140013386
    0x140013388
    0x14001338c
    0x140013390
    0x140013394
    0x14001339c
    0x1400133a7
    0x1400133ab
    0x1400133ae
    0x1400133b1
    0x1400133b3
    0x1400133ba
    0x1400133bc
    0x1400133c0
    0x1400133d0
    0x1400133de
    0x1400133e3
    0x1400133e5
    0x1400133ec
    0x1400133ee
    0x1400133f5
    0x140013404
    0x140013408
    0x14001340c
    0x140013414
    0x140013417
    0x140013424
    0x14001342b
    0x140013431
    0x14001343c
    0x140013442
    0x140013444
    0x140013447
    0x140013450
    0x140013456
    0x14001345a
    0x14001346a
    0x140013472
    0x140013482
    0x140013484
    0x140013489
    0x140013490
    0x140013492
    0x140013499
    0x1400134a2
    0x1400134a4
    0x1400134a8
    0x1400134af
    0x1400134b3
    0x1400134bd
    0x1400134c4
    0x1400134ca
    0x1400134d5
    0x1400134db
    0x1400134dd
    0x1400134e3
    0x1400134e9
    0x1400134ec
    0x1400134ee
    0x1400134f5
    0x1400134f7
    0x1400134fb
    0x1400134ff
    0x14001350f
    0x140013513
    0x140013522
    0x140013524
    0x140013529
    0x140013530
    0x140013532
    0x140013539
    0x140013542
    0x140013544
    0x140013548
    0x14001354f
    0x140013553
    0x14001355d
    0x140013564
    0x14001356a
    0x140013575
    0x14001357b
    0x14001357d
    0x140013583
    0x140013589
    0x14001358c
    0x14001358e
    0x140013595
    0x140013597
    0x14001359b
    0x1400135a3
    0x1400135a7
    0x1400135b7
    0x1400135bc
    0x1400135c2
    0x1400135d3
    0x1400135d5
    0x1400135d8
    0x1400135de
    0x1400135e5
    0x1400135ef
    0x1400135f8
    0x1400135fc
    0x140013604
    0x140013606
    0x140013609
    0x14001360c
    0x140013613
    0x14001361f
    0x140013626
    0x14001362d
    0x140013634
    0x140013639
    0x14001363d
    0x140013640
    0x140013648
    0x14001365c
    0x140013662
    0x140013666
    0x140013671
    0x140013675
    0x140013686
    0x140013688
    0x14001368b
    0x140013691
    0x140013699
    0x1400136aa
    0x1400136bb
    0x1400136be
    0x1400136c1
    0x1400136c5
    0x1400136c8
    0x1400136d5
    0x1400136db
    0x1400136e2
    0x1400136e7
    0x1400136eb
    0x1400136ef
    0x1400136f3
    0x1400136f6
    0x1400136fa
    0x14001370f
    0x14001371a
    0x14001371e
    0x140013726
    0x140013729
    0x14001372c
    0x14001372e
    0x140013736
    0x14001373a
    0x140013746
    0x14001374b
    0x14001374d
    0x140013750
    0x140013753
    0x140013756
    0x14001375b
    0x140013763
    0x14001376d
    0x140013771
    0x140013775
    0x140013779
    0x140013782
    0x140013789
    0x14001378d
    0x140013795
    0x14001379a
    0x14001379e
    0x1400137a9
    0x1400137b8
    0x1400137bf
    0x1400137ca
    0x1400137d0
    0x1400137d8
    0x1400137df
    0x1400137e1
    0x1400137e8
    0x1400137ed
    0x1400137f5
    0x1400137f9
    0x140013803
    0x140013806
    0x140013808
    0x14001380e
    0x140013812
    0x140013823
    0x140013828
    0x14001382e
    0x140013833
    0x14001383e
    0x140013840
    0x140013847
    0x14001384b
    0x140013853
    0x140013858
    0x14001385f
    0x140013862
    0x140013865
    0x140013870
    0x140013876
    0x14001387e
    0x140013885
    0x14001388a
    0x140013891
    0x140013898
    0x14001389e
    0x1400138a4
    0x1400138a7
    0x1400138aa
    0x1400138af
    0x1400138b7
    0x1400138ba
    0x1400138c0
    0x1400138c4
    0x1400138c7
    0x1400138cb
    0x1400138cf
    0x1400138d3
    0x1400138d8
    0x1400138e8
    0x1400138ea
    0x1400138f2
    0x1400138fe
    0x140013903
    0x140013905
    0x140013908
    0x14001390e
    0x140013913
    0x140013917
    0x14001391d
    0x14001392a
    0x140013933
    0x140013935
    0x14001393c
    0x140013940
    0x140013947
    0x140013951
    0x14001395a
    0x140013960
    0x140013967
    0x140013981
    0x140013986
    0x14001398a
    0x140013996
    0x14001399b
    0x14001399d
    0x1400139a0
    0x1400139a6
    0x1400139b3
    0x1400139c2
    0x1400139c6
    0x1400139cf
    0x1400139e1
    0x1400139eb
    0x1400139ff
    0x140013a08
    0x140013a17
    0x140013a19
    0x140013a20
    0x140013a29
    0x140013a2c
    0x140013a37
    0x140013a3c
    0x140013a43
    0x140013a48
    0x140013a48
    0x140013a4c
    0x140013a53
    0x140013a58
    0x140013a5c
    0x140013a61
    0x140013a6a
    0x140013a6e
    0x140013a76
    0x140013a7b
    0x140013a82
    0x140013a86
    0x140013a8e
    0x140013a93
    0x140013a9a
    0x140013aad
    0x140013abb
    0x140013ac5
    0x140013ae0
    0x140013ae3
    0x140013ae7
    0x140013aec
    0x140013af7
    0x140013b02
    0x140013b0e
    0x140013b16
    0x140013b18
    0x140013b20
    0x140013b2e
    0x140013b32
    0x140013b37
    0x140013b42
    0x140013b46
    0x140013b49
    0x140013b4d
    0x140013b52
    0x140013b58
    0x140013b61
    0x140013b64
    0x140013b66
    0x140013b6d
    0x140013b72
    0x140013b7a
    0x140013b7f
    0x140013b83
    0x140013b8f
    0x140013b94
    0x140013b96
    0x140013b99
    0x140013b9e
    0x140013ba0
    0x140013ba4
    0x140013bac
    0x140013bb9
    0x140013bbd
    0x140013bcc
    0x140013bcf
    0x140013bd9
    0x140013bde
    0x140013be0
    0x140013be6
    0x140013bea
    0x140013bf6
    0x140013bfb
    0x140013bfd
    0x140013c00
    0x140013c05
    0x140013c0f
    0x140013c1b
    0x140013c1f
    0x140013c21
    0x140013c27
    0x140013c32
    0x140013c3e
    0x140013c43
    0x140013c48
    0x140013c4d
    0x140013c57
    0x140013c63
    0x140013c6a
    0x140013c80
    0x140013c82
    0x140013c84
    0x140013c86
    0x140013c97
    0x140013ca0
    0x140013ca9
    0x140013cab
    0x140013cb6
    0x140013cc4
    0x140013cd2
    0x140013ce1
    0x140013cea
    0x140013cee
    0x140013cf6
    0x140013d02
    0x140013d06
    0x140013d0e
    0x140013d13
    0x140013d1a
    0x140013d21
    0x140013d28
    0x140013d2d
    0x140013d32
    0x140013d49
    0x140013d50
    0x140013d54
    0x140013d59
    0x140013d5e
    0x140013d6b
    0x140013d6f
    0x140013d77
    0x140013d83
    0x140013d8a
    0x140013d8e
    0x140013d96
    0x140013da4
    0x140013da9
    0x140013dbd
    0x140013dc2
    0x140013dc5
    0x140013dca
    0x140013dcc
    0x140013dd3
    0x140013dd8
    0x140013de3
    0x140013de9
    0x140013df1
    0x140013df5
    0x140013df9
    0x140013dfc
    0x140013e00
    0x140013e0b
    0x140013e14
    0x140013e16
    0x140013e1a
    0x140013e1e
    0x140013e21
    0x140013e27
    0x140013e2a
    0x140013e2e
    0x140013e32
    0x140013e3f
    0x140013e43
    0x140013e47
    0x140013e4a
    0x140013e4d
    0x140013e51
    0x140013e55
    0x140013e59
    0x140013e5d
    0x140013e63
    0x140013e6e
    0x140013e76
    0x140013e81
    0x140013e8e
    0x140013e9f
    0x140013ea3
    0x140013eaf
    0x140013eb7
    0x140013eb9
    0x140013ec1
    0x140013ecc
    0x140013ed3
    0x140013ee0
    0x140013ee4
    0x140013eec
    0x140013ef2
    0x140013ef8
    0x140013efb
    0x140013eff
    0x140013f07
    0x140013f11
    0x140013f17
    0x140013f1a
    0x140013f1d
    0x140013f20
    0x140013f27
    0x140013f31
    0x140013f39
    0x140013f3f
    0x140013f41
    0x140013f48
    0x140013f54
    0x140013f5a
    0x140013f66
    0x140013f6d
    0x140013f73
    0x140013f76
    0x140013f79
    0x140013f7b
    0x140013f7e
    0x140013f81
    0x140013f84
    0x140013f8b
    0x140013f94
    0x140013f98
    0x140013f9e
    0x140013fa0
    0x140013fa4
    0x140013fa9
    0x140013fb5
    0x140013fb8
    0x140013fbf
    0x140013fc2
    0x140013fc9
    0x140013fcf
    0x140013fd1
    0x140013fd9
    0x140013fe0
    0x140013fe2
    0x140013fed
    0x140013ff4
    0x140013ff6
    0x140013ffd
    0x140014001
    0x140014009
    0x140014011
    0x14001401c
    0x140014020
    0x140014026
    0x14001402a
    0x140014032
    0x14001403e
    0x140014043
    0x140014045
    0x140014048
    0x14001404d
    0x14001404f
    0x140014056
    0x14001405f
    0x140014062
    0x140014066
    0x140014071
    0x14001407d
    0x140014086
    0x140014097
    0x1400140a8
    0x1400140aa
    0x1400140b2
    0x1400140be
    0x1400140c5
    0x1400140c7
    0x1400140cf
    0x1400140da
    0x1400140e1
    0x1400140ee
    0x1400140f2
    0x1400140f8
    0x1400140fe
    0x140014101
    0x140014105
    0x14001410d
    0x140014117
    0x14001411d
    0x140014120
    0x140014123
    0x140014126
    0x14001412d
    0x140014137
    0x14001413f
    0x140014145
    0x140014147
    0x140014152
    0x14001415e
    0x140014164
    0x140014170
    0x140014177
    0x14001417d
    0x140014180
    0x140014183
    0x140014185
    0x140014188
    0x14001418b
    0x14001418e
    0x140014195
    0x14001419e
    0x1400141a2
    0x1400141a8
    0x1400141aa
    0x1400141ae
    0x1400141b3
    0x1400141ba
    0x1400141be
    0x1400141c7
    0x1400141ca
    0x1400141d1
    0x1400141d4
    0x1400141d8
    0x1400141e1
    0x1400141e5
    0x1400141ed
    0x1400141f2
    0x1400141f8
    0x140014203
    0x14001420d
    0x140014211
    0x140014217
    0x14001421b
    0x140014222
    0x14001422e
    0x140014233
    0x140014235
    0x140014238
    0x14001423d
    0x14001423f
    0x140014246
    0x14001424f
    0x140014252
    0x140014256
    0x14001425d
    0x140014268
    0x14001426e
    0x140014275
    0x14001427a
    0x14001427c
    0x140014282
    0x14001428c
    0x140014295
    0x140014299
    0x1400142a1
    0x1400142a6
    0x1400142ac
    0x1400142b2
    0x1400142b6
    0x1400142ba
    0x1400142c6
    0x1400142c8
    0x1400142ca
    0x1400142d4
    0x1400142d9
    0x1400142dd
    0x1400142e5
    0x1400142e9
    0x1400142f5
    0x1400142f8
    0x1400142fe
    0x140014300
    0x140014308
    0x14001430e
    0x14001431e
    0x140014329
    0x14001432c
    0x14001432f
    0x140014333
    0x140014337
    0x14001433b
    0x140014343
    0x14001434d
    0x140014356
    0x14001435a
    0x14001436b
    0x14001436d
    0x140014370
    0x140014376
    0x140014378
    0x14001437b
    0x14001437f
    0x140014388
    0x14001438d
    0x1400143a1
    0x1400143a4
    0x1400143a6
    0x1400143ab
    0x1400143ad
    0x1400143b6
    0x1400143ba
    0x1400143be
    0x1400143c6
    0x1400143ca
    0x1400143d4
    0x140014400
    0x140014409
    0x14001440d
    0x140014415
    0x14001441a
    0x14001441d
    0x140014420
    0x14001442d
    0x140014438
    0x140014441
    0x140014445
    0x140014451
    0x14001445b
    0x140014461
    0x140014467
    0x140014470
    0x140014474
    0x14001447c
    0x140014481
    0x140014485
    0x140014489
    0x14001448c
    0x140014494
    0x140014498
    0x1400144c0

    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID:
    • String ID: $ $header crc mismatch
    • API String ID: 0-4092041874
    • Opcode ID: 0d8a49af6a2df4ef2af7fe927b35aed744aa650c6fb9240ef3bac2ba5ceae6a4
    • Instruction ID: 7b7c0dcb7b367ac831aed03830ec8ef67ea91f0dce79e30e5349fd19ccede3bc
    • Opcode Fuzzy Hash: 0d8a49af6a2df4ef2af7fe927b35aed744aa650c6fb9240ef3bac2ba5ceae6a4
    • Instruction Fuzzy Hash: F6B1A4726002D48BE7A79B16C488BAE3BEAFB4CB94F164518FB854B3E1D775C940C740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140007A50 Relevance: 6.2, APIs: 4, Instructions: 163memoryCOMMON
    Download Yara Rule
    C-Code - Quality: 44%
    			E00000001140007A50(signed short* __rax, void* __rcx, void* __rdx, long long __r13) {
				void* _t43;
				intOrPtr _t44;
				intOrPtr _t50;
				signed int _t55;
				signed int _t61;
				intOrPtr _t67;
				signed short* _t92;
				void* _t101;
				signed short* _t103;
				signed short* _t104;
				signed short* _t105;
				signed short* _t106;
				long _t124;
				signed long long _t125;
				void* _t129;
				signed short* _t131;
				long _t135;
				void* _t139;
				void* _t140;
				long _t148;
				void* _t156;
				signed short* _t157;
				signed short* _t160;
				signed short* _t161;
				signed long long _t163;
				signed long long _t164;

				_t92 = __rax;
				 *((intOrPtr*)(_t139 + 0x20)) = r9d;
				 *((intOrPtr*)(_t139 + 0x18)) = r8d;
				_t140 = _t139 - 0x30;
				_t164 = _t163 | 0xffffffff;
				if (__rcx == 0) goto 0x40007a8b;
				if ( *((intOrPtr*)(__rcx + (_t164 + 1) * 2)) != 0) goto 0x40007a80;
				goto 0x40007a8d;
				_t43 = E00000001140012630(__rax, __rcx);
				_t44 = E00000001140012630(__rax, __rdx);
				r12d = _t44;
				 *((intOrPtr*)(_t140 + 0x70)) = _t44;
				E000000011400126D0(0,  *((intOrPtr*)(_t140 + 0x98)), __rax, _t163);
				_t157 = _t92;
				if (_t43 == 0) goto 0x40007ac2;
				E00000001140012850(_t43, _t92);
				_t103 = _t92;
				if (r12d == 0) goto 0x40007ad2;
				E00000001140012850(r12d, _t92);
				_t131 = _t92;
				 *((long long*)(_t140 + 0x78)) = __r13;
				 *(_t140 + 0x28) = _t157;
				if (_t103 == 0) goto 0x40007c58;
				if ( *_t103 == 0) goto 0x40007c58;
				if (_t131 == 0) goto 0x40007c35;
				if ( *_t131 == 0) goto 0x40007c35;
				 *(_t140 + 0x20) = _t103;
				asm("o16 nop [eax+eax]");
				if (_t131[_t164 + 1] != 0) goto 0x40007b10;
				if (r12d == 0) goto 0x40007b66;
				RtlAllocateHeap(_t156, _t148, _t124);
				asm("o16 nop [eax+eax]");
				_t61 =  *_t131 & 0x0000ffff;
				_t13 =  &(_t131[1]); // 0x7c0000005c0000
				 *(_t92 - _t131 + _t13 - 2) = _t61;
				if (_t61 != 0) goto 0x40007b50;
				goto 0x40007b6b;
				_t150 =  !=  ? 0x1400070ba : 0x1400070a2;
				_t50 =  *((intOrPtr*)(_t140 + 0x88));
				if (_t50 - 1 <= 0) goto 0x40007bac;
				_t125 = _t50 - 1;
				0x400070ae();
				_t104 =  &(_t103[_t125]);
				if ( *_t104 == 0) goto 0x40007c02;
				_t67 =  *((intOrPtr*)(_t140 + 0x90));
				if ( *((long long*)( !=  ? 0x1400070ba : 0x1400070a2))() != 0) goto 0x40007c1d;
				_t105 =  &(_t104[r15d]);
				if (_t67 == 0xffffffff) goto 0x40007c2d;
				if (_t67 - 1 > 0) goto 0x40007c2d;
				0x400070ae();
				if ( *((intOrPtr*)(_t140 + 0x70)) == 0) goto 0x40007c58;
				HeapFree(_t129, _t135, _t101);
				goto 0x40007c58;
				_t160 =  &(( &(( &(_t157[_t125]))[0 - (_t105 -  *(_t140 + 0x20) >> 1)]))[1]);
				_t106 =  &(_t105[1]);
				 *((short*)(_t160 - 2)) =  *_t105 & 0x0000ffff;
				if ( *_t106 != 0) goto 0x40007bc0;
				goto 0x40007c02;
				_t55 =  *_t106 & 0x0000ffff;
				 *(_t160 - _t106 +  &(_t106[1]) - 2) = _t55;
				if (_t55 != 0) goto 0x40007c40;
				_t161 = _t160;
				E00000001140012900(0 - _t55, _t161 -  *(_t140 + 0x28) >> 1);
				 *_t161 = 0;
				return 0;
			}





























    0x140007a50
    0x140007a50
    0x140007a55
    0x140007a64
    0x140007a6a
    0x140007a77
    0x140007a87
    0x140007a89
    0x140007a8d
    0x140007a97
    0x140007aa5
    0x140007aa8
    0x140007aac
    0x140007ab1
    0x140007ab6
    0x140007aba
    0x140007abf
    0x140007ac5
    0x140007aca
    0x140007acf
    0x140007ad2
    0x140007ad7
    0x140007adf
    0x140007ae9
    0x140007af2
    0x140007afc
    0x140007b02
    0x140007b07
    0x140007b19
    0x140007b1e
    0x140007b33
    0x140007b46
    0x140007b50
    0x140007b53
    0x140007b57
    0x140007b5f
    0x140007b64
    0x140007b81
    0x140007b85
    0x140007b8f
    0x140007b99
    0x140007b9f
    0x140007ba8
    0x140007bb0
    0x140007bb2
    0x140007bce
    0x140007bd0
    0x140007bd7
    0x140007bdd
    0x140007bf9
    0x140007c07
    0x140007c15
    0x140007c1b
    0x140007c20
    0x140007c24
    0x140007c28
    0x140007c31
    0x140007c33
    0x140007c40
    0x140007c47
    0x140007c4f
    0x140007c54
    0x140007c67
    0x140007c73
    0x140007c85

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Heapwcsncpy$AllocateFree
    • String ID:
    • API String ID: 2817115924-0
    • Opcode ID: 40ee9cac18b19adf81de10f9415423a000891180c934b402eeda7a486017a1b9
    • Instruction ID: b6b9e846c04cb6e9a04139aff3d7e83eda40acee9614ff25bed0c888bce5a2ba
    • Opcode Fuzzy Hash: 40ee9cac18b19adf81de10f9415423a000891180c934b402eeda7a486017a1b9
    • Instruction Fuzzy Hash: 3651B2B2B0068485EA66DF26A404BEA77E1F789BD4F588125EF5D477E5EB3CC542C300
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014001147C Relevance: 6.1, APIs: 4, Instructions: 122memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AllocateHeap$AcquireCriticalLeaveLockSection
    • String ID:
    • API String ID: 811089001-0
    • Opcode ID: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
    • Instruction ID: a4d5f086a96e389f2db612197d0023b8b07f868559dabceebcf4944cd54701ff
    • Opcode Fuzzy Hash: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
    • Instruction Fuzzy Hash: 47513A72601B44C7EB5ACF26E18039873A5F78CF88F188526EB4E4B766DB35D4A1C750
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000E620 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
    Download Yara Rule
    C-Code - Quality: 28%
    			E0000000114000E620(void* __edi, long long __rax, long long __rbx, void* __rcx, void* __rdx) {
				void* _t25;
				void* _t35;
				void* _t49;
				long _t52;
				void* _t55;
				void* _t57;
				void* _t58;

				 *((long long*)(_t57 + 0x10)) = __rbx;
				_t58 = _t57 - 0x30;
				 *((intOrPtr*)(_t58 + 0x50)) = 0;
				if ( *((intOrPtr*)(__rcx + 0x24)) != 0) goto 0x4000e75e;
				if ( *((intOrPtr*)(__rcx + 0x1c)) != 1) goto 0x4000e673;
				_t6 = _t55 + 1; // 0x1
				r9d = _t6;
				 *((long long*)(_t58 + 0x68)) = __rax;
				SetFilePointer(_t49, _t52);
				 *((intOrPtr*)(__rcx + 0x1c)) = 0;
				 *((intOrPtr*)(__rcx + 0x14)) =  *((intOrPtr*)(__rcx + 0x10));
				_t35 =  *((intOrPtr*)(__rcx + 0x14)) - __edi;
				if (_t35 <= 0) goto 0x4000e6ff;
				if (_t35 == 0) goto 0x4000e6e7;
				if (_t35 == 0) goto 0x4000e6ce;
				if (__edi == 2) goto 0x4000e6b7;
				_t25 = memcpy(_t55, ??);
				 *((intOrPtr*)(__rcx + 0x14)) =  *((intOrPtr*)(__rcx + 0x14)) - __edi;
				return _t25;
			}










    0x14000e620
    0x14000e628
    0x14000e637
    0x14000e63e
    0x14000e648
    0x14000e650
    0x14000e650
    0x14000e65f
    0x14000e664
    0x14000e66d
    0x14000e670
    0x14000e676
    0x14000e678
    0x14000e68e
    0x14000e692
    0x14000e697
    0x14000e69f
    0x14000e6a4
    0x14000e6b6

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: FilePointermemcpy
    • String ID:
    • API String ID: 1104741977-0
    • Opcode ID: d3ec28a03912e6d80b261c35e196ed703beb3e203bb26ae9a29097b16b2476ce
    • Instruction ID: b9f44d82ba4cb6c24f152d63ce96d8852f082d92484b54d7365d071901ec84b9
    • Opcode Fuzzy Hash: d3ec28a03912e6d80b261c35e196ed703beb3e203bb26ae9a29097b16b2476ce
    • Instruction Fuzzy Hash: 7541837770468086DB01CF7AF1402ADF7A4EB98BD9F084426EF4C43BA5DA39C591CB50
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140013801 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 105COMMON
    Download Yara Rule
    C-Code - Quality: 43%
    			E00000001140013801(signed int __ebx, void* __esi, void* __rdi, long long __r8, signed int __r9, void* __r10, void* __r13, signed char* __r14) {
				signed int _t315;
				unsigned int _t321;
				unsigned int _t327;
				signed int _t346;
				signed int _t348;
				signed int _t359;
				signed char _t365;
				signed int _t382;
				signed char _t388;
				void* _t396;
				intOrPtr _t397;
				signed char _t400;
				void* _t407;
				intOrPtr _t408;
				signed int _t420;
				signed int _t422;
				void* _t423;
				signed int _t424;
				void* _t425;
				signed int _t426;
				void* _t427;
				signed int _t428;
				void* _t429;
				signed int _t431;
				signed int _t432;
				void* _t433;
				signed int _t435;
				signed int _t436;
				void* _t437;
				signed int _t439;
				void* _t440;
				signed int _t441;
				signed int _t442;
				void* _t443;
				signed int _t445;
				void* _t446;
				signed int _t447;
				signed int _t449;
				signed int _t450;
				signed char _t452;
				signed int _t454;
				signed int _t459;
				signed char _t475;
				signed char _t477;
				signed char _t509;
				signed char _t512;
				signed char _t518;
				signed char _t542;
				signed char _t545;
				signed char _t551;
				unsigned int _t552;
				void* _t553;
				void* _t554;
				signed char _t555;
				void* _t556;
				signed int _t569;
				unsigned int _t571;
				void* _t573;
				signed int* _t577;
				signed int* _t581;
				signed char _t588;
				signed char _t590;
				void* _t593;
				signed int _t594;
				void* _t596;
				void* _t597;
				void* _t598;
				void* _t599;
				void* _t600;
				void* _t601;
				void* _t602;
				intOrPtr _t603;
				intOrPtr _t604;
				void* _t605;
				void* _t606;
				void* _t607;
				void* _t608;
				void* _t609;
				void* _t610;
				void* _t611;
				void* _t613;
				void* _t640;
				void* _t653;
				signed long long _t716;
				signed int _t717;
				signed long long _t720;
				signed long long _t721;
				signed long long _t722;
				signed int _t725;
				signed long long _t728;
				signed long long _t731;
				void* _t738;
				signed long long _t741;
				long long _t743;
				signed long long _t744;
				signed long long _t745;
				signed long long _t746;
				signed long long _t747;
				signed long long _t748;
				void* _t751;
				intOrPtr _t763;
				signed long long _t765;
				void* _t768;
				void* _t770;
				long long _t774;
				signed long long _t775;
				signed int* _t779;
				signed long long _t783;
				signed long long _t784;
				signed long long _t785;
				signed long long _t786;
				void* _t789;
				signed int _t790;
				intOrPtr _t791;
				void* _t792;
				long long _t793;
				signed char* _t799;
				signed char* _t800;
				signed char* _t801;
				signed char* _t802;
				signed char* _t803;
				signed char* _t804;
				signed char* _t806;
				signed char* _t807;
				signed char* _t808;
				signed char* _t809;
				signed char* _t810;
				signed char* _t811;
				signed char* _t812;
				signed char* _t813;

				_t452 = __ebx & 0x00000007;
				_t420 = __ebx - _t452;
				r15d = r15d >> _t452;
				if (_t420 - 0x20 >= 0) goto 0x40013830;
				if (__esi == 0) goto 0x400144ee;
				_t596 = __esi - 1;
				r15d = r15d + (( *__r14 & 0x000000ff) << _t420);
				if (_t420 + 8 - 0x20 < 0) goto 0x40013810;
				_t454 = r15w & 0xffffffff;
				if (_t454 ==  !r15d >> 0x10) goto 0x40013858;
				_t716 = "invalid stored block lengths";
				 *(__rdi + 0x20) = _t716;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x50) = _t454;
				r15d = r12d;
				_t422 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f42;
				if ( *((intOrPtr*)(_t768 + 0x28)) == 6) goto 0x400144f1;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f43;
				r12d =  *(__r13 + 0x50);
				if (r12d == 0) goto 0x400138d8;
				r12d =  >  ? _t596 : r12d;
				r12d =  >  ? r11d : r12d;
				if (r12d == 0) goto 0x400144ee;
				r8d = r12d;
				_t740 = __r9;
				_t594 = r12d;
				memcpy(??, ??, ??);
				r11d =  *(_t768 + 0x38);
				r11d = r11d - r12d;
				_t799 =  &(( &(__r14[1]))[__rdi]);
				_t763 =  *((intOrPtr*)(_t768 + 0x20));
				_t597 = _t596 - r12d;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) - r12d;
				 *(_t768 + 0x38) = r11d;
				 *(_t768 - 0x40) =  *(_t768 - 0x40) + __rdi;
				goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f3f;
				if (_t422 - 0xe >= 0) goto 0x40013910;
				asm("o16 nop [eax+eax]");
				if (_t597 == 0) goto 0x400144ee;
				_t423 = _t422 + 8;
				_t598 = _t597 - 1;
				_t800 =  &(_t799[1]);
				r15d = r15d + (( *_t799 & 0x000000ff) << _t422);
				if (_t423 - 0xe < 0) goto 0x400138f0;
				r15d = r15d >> 5;
				_t424 = _t423 + 0xfffffff2;
				r15d = r15d >> 5;
				_t459 = (r15d & 0x0000001f) + 0x101;
				_t569 = (r15d & 0x0000001f) + 1;
				r15d = r15d >> 4;
				 *(__r13 + 0x7c) = _t459;
				 *(__r13 + 0x80) = _t569;
				 *((intOrPtr*)(__r13 + 0x78)) = (r15d & 0x0000000f) + 4;
				if (_t459 - 0x11e > 0) goto 0x40013a7b;
				if (_t569 - 0x1e > 0) goto 0x40013a7b;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f45;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) >= 0) goto 0x400139e3;
				if (_t424 - 3 >= 0) goto 0x400139a8;
				if (_t598 == 0) goto 0x400144ee;
				_t425 = _t424 + 8;
				_t599 = _t598 - 1;
				_t801 =  &(_t800[1]);
				r15d = r15d + (( *_t800 & 0x000000ff) << _t424);
				if (_t425 - 3 < 0) goto 0x40013988;
				_t426 = _t425 + 0xfffffffd;
				r15d = r15d >> 3;
				 *(__r13 + 0x90 + _t716 * 2) = r15w & 7;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) -  *((intOrPtr*)(__r13 + 0x78)) < 0) goto 0x40013983;
				if ( *(__r13 + 0x84) - 0x13 >= 0) goto 0x40013a19;
				 *(__r13 + 0x90 + _t716 * 2) = r12w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if ( *(__r13 + 0x84) - 0x13 < 0) goto 0x400139f0;
				_t717 = __r13 + 0x550;
				_t779 = __r13 + 0x88;
				 *_t779 = _t717;
				 *(__r13 + 0x60) = _t717;
				 *((long long*)(_t770 + 0x28)) = __r13 + 0x310;
				 *((intOrPtr*)(__r8)) = 7;
				 *((long long*)(_t770 + 0x20)) = __r8;
				_t52 = _t740 + 0x13; // 0x13
				r8d = _t52;
				_t751 = __r13 + 0x90;
				_t315 = E00000001140015DD0(0, _t594, _t613, __r13 + 0x310, _t751, __r8, _t779, __r10, _t792);
				r11d =  *(_t768 + 0x38);
				 *(_t768 + 0x30) = _t315;
				if (_t315 == 0) goto 0x40013a93;
				 *(_t763 + 0x20) = "invalid code lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t720 = "too many length or distance symbols";
				 *(_t763 + 0x20) = _t720;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *(__r13 + 0x84) = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f46;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) >= 0) goto 0x40013cca;
				asm("o16 nop [eax+eax]");
				_t741 = __r9 & _t720;
				_t721 =  *(__r13 + 0x60);
				_t321 =  *(_t721 + _t741 * 4);
				 *(_t768 - 0x48) = _t321;
				if ((_t321 >> 0x00000008 & 0x000000ff) - _t426 <= 0) goto 0x40013b44;
				if (_t599 == 0) goto 0x400144ee;
				_t427 = _t426 + 8;
				_t600 = _t599 - 1;
				r15d = r15d + (( *_t801 & 0x000000ff) << _t426);
				_t802 =  &(_t801[1]);
				_t722 =  *(__r13 + 0x60);
				_t327 =  *(_t722 + (_t741 & _t721) * 4);
				 *(_t768 - 0x48) = _t327;
				if ((_t327 >> 0x00000008 & 0x000000ff) - _t427 > 0) goto 0x40013b00;
				_t571 = _t327 >> 0x10;
				_t640 = _t571 - 0x10;
				if (_t640 >= 0) goto 0x40013b72;
				_t475 = _t327 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x90 + _t722 * 2) = _t571;
				r15d = r15d >> _t475;
				_t428 = _t427 - _t475;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				goto 0x40013caf;
				if (_t640 != 0) goto 0x40013bd4;
				_t573 = (r10d >> 0x00000008 & 0x000000ff) + 2;
				if (_t428 - _t573 >= 0) goto 0x40013ba0;
				if (_t600 == 0) goto 0x400144ee;
				_t429 = _t428 + 8;
				_t601 = _t600 - 1;
				_t803 =  &(_t802[1]);
				r15d = r15d + (( *_t802 & 0x000000ff) << _t428);
				if (_t429 - _t573 < 0) goto 0x40013b81;
				_t477 =  *(_t768 - 0x47) & 0x000000ff;
				r15d = r15d >> _t477;
				if (r10d == 0) goto 0x40013cfb;
				r15d = r15d >> 2;
				r8d =  *(__r13 + 0x90 + _t722 * 2) & 0x0000ffff;
				_t431 = _t429 - _t477 + 0xfffffffe;
				goto 0x40013c6f;
				r9d =  *(_t768 - 0x47) & 0x000000ff;
				if ( *(_t768 - 0x46) != 0x11) goto 0x40013c21;
				_t577 =  &(_t779[0]);
				if (_t431 - _t577 >= 0) goto 0x40013c07;
				if (_t601 == 0) goto 0x400144ee;
				_t432 = _t431 + 8;
				_t602 = _t601 - 1;
				_t804 =  &(_t803[1]);
				r15d = r15d + (( *_t803 & 0x000000ff) << _t431);
				if (_t432 - _t577 < 0) goto 0x40013be8;
				r15d = r15d >> r9d;
				r15d = r15d >> 3;
				goto 0x40013c67;
				_t581 =  &(_t779[1]);
				if (_t432 - _t581 >= 0) goto 0x40013c4f;
				if (_t602 == 0) goto 0x400144ee;
				_t433 = _t432 + 8;
				_t603 = _t602 - 1;
				r15d = r15d + (( *_t804 & 0x000000ff) << _t432);
				if (_t433 - _t581 < 0) goto 0x40013c30;
				r15d = r15d >> r9d;
				r15d = r15d >> 7;
				r8d = r12d;
				if (__r10 + _t751 -  *(__r13 + 0x80) +  *(__r13 + 0x7c) > 0) goto 0x40013cfb;
				_t653 = (r15d & 0x0000007f) + 0xb;
				if (_t653 == 0) goto 0x40013cab;
				asm("o16 nop [eax+eax]");
				 *(__r13 + 0x90 + _t722 * 2) = r8w;
				 *(__r13 + 0x84) =  *(__r13 + 0x84) + 1;
				if (_t653 != 0) goto 0x40013c90;
				_t774 = __r13 + 0x70;
				r10d =  *(__r13 + 0x84);
				if (r10d -  *(__r13 + 0x80) +  *(__r13 + 0x7c) < 0) goto 0x40013ad0;
				if ( *((intOrPtr*)(__r13 + 8)) == 0x3f51) goto 0x4001364c;
				if ( *((short*)(__r13 + 0x290)) != 0) goto 0x40013d13;
				 *(_t763 + 0x20) = "invalid code -- missing end-of-block";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				 *(_t763 + 0x20) = "invalid bit length repeat";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x4001364c;
				_t725 = __r13 + 0x550;
				 *_t774 = 9;
				_t793 = __r13 + 0x310;
				 *((long long*)(_t770 + 0x28)) = _t793;
				 *((long long*)(_t770 + 0x20)) = _t774;
				r8d =  *(__r13 + 0x7c);
				 *(__r13 + 0x88) = _t725;
				 *(__r13 + 0x60) = _t725;
				_t346 = E00000001140015DD0(1, _t594, _t613, _t725, __r13 + 0x90, _t774, __r13 + 0x88, __r10, _t793);
				 *(_t768 + 0x30) = _t346;
				if (_t346 == 0) goto 0x40013d7c;
				 *((long long*)( *((intOrPtr*)(_t768 + 0x20)) + 0x20)) = "invalid literal/lengths set";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				r8d =  *(__r13 + 0x80);
				_t743 = __r13 + 0x74;
				 *((long long*)(__r13 + 0x68)) =  *(__r13 + 0x88);
				 *_t743 = 6;
				 *((long long*)(_t770 + 0x28)) = _t793;
				 *((long long*)(_t770 + 0x20)) = _t743;
				_t348 = E00000001140015DD0(2, _t594, _t613,  *(__r13 + 0x88), 0x90 +  *(__r13 + 0x88) * 2 + __r13, _t774, __r13 + 0x88, __r10, _t793);
				r12d = _t348;
				 *(_t768 + 0x30) = _t348;
				if (_t348 == 0) goto 0x40013dd5;
				_t728 = "invalid distances set";
				goto 0x40013d67;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f47;
				if ( *((intOrPtr*)(_t768 + 0x28)) == 6) goto 0x400144f5;
				_t765 =  *((intOrPtr*)(_t768 + 0x20));
				r10d =  *(_t768 - 0x4c);
				r11d =  *(_t768 + 0x38);
				r12d = 0;
				_t775 = __r13 + 0x70;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (_t603 - 6 < 0) goto 0x40013e73;
				if (r11d - 0x102 < 0) goto 0x40013e73;
				 *((long long*)(_t765 + 0x10)) =  *(_t768 - 0x40);
				 *(_t765 + 0x18) = r11d;
				 *_t765 =  &(_t804[1]);
				 *((intOrPtr*)(_t765 + 8)) = _t603;
				_t744 = _t765;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t433 + 0xfffffff9 - r9d;
				E00000001140016210(r10d, _t728, _t744, 0x90 +  *(__r13 + 0x88) * 2 + __r13,  *(_t768 - 0x40), __r10, _t789);
				_t783 =  *((intOrPtr*)(_t765 + 0x10));
				r11d =  *(_t765 + 0x18);
				_t806 =  *_t765;
				_t604 =  *((intOrPtr*)(_t765 + 8));
				r15d =  *(__r13 + 0x48);
				_t435 =  *(__r13 + 0x4c);
				 *(_t768 - 0x40) = _t783;
				 *(_t768 + 0x38) = r11d;
				if ( *((intOrPtr*)(__r13 + 8)) != 0x3f3f) goto 0x40013650;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013650;
				_t790 =  *(__r13 + 0x60);
				 *(__r13 + 0x1be4) = r12d;
				_t745 = _t744 & _t728;
				if (( *(_t790 + _t745 * 4) >> 0x00000008 & 0x000000ff) - _t435 <= 0) goto 0x40013ee2;
				if (_t604 == 0) goto 0x400144ee;
				_t436 = _t435 + 8;
				_t605 = _t604 - 1;
				r15d = r15d + (( *_t806 & 0x000000ff) << _t435);
				_t807 =  &(_t806[1]);
				_t746 = _t745 & _t728;
				_t359 =  *( *(__r13 + 0x60) + _t746 * 4);
				if ((_t359 >> 0x00000008 & 0x000000ff) - _t436 > 0) goto 0x40013ea1;
				if (_t359 == 0) goto 0x40013fb0;
				if ((_t359 & 0x000000f0) != 0) goto 0x40013fb0;
				r10d = _t359;
				 *(_t768 - 0x48) = _t359;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t359 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t359 >> 0x10);
				r11d =  *(_t768 - 0x47) & 0x000000ff;
				r8d =  *(_t790 + _t783 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t436 <= 0) goto 0x40013fa0;
				r10d =  *(_t768 - 0x46) & 0x0000ffff;
				if (_t605 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t807 & 0x000000ff) << _t436);
				r8d = r8d << (_t359 & 0x000000ff) + r9d;
				_t437 = _t436 + 8;
				r8d = r8d - 1;
				_t606 = _t605 - 1;
				_t808 =  &(_t807[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t365 =  *( *(__r13 + 0x60) + _t775 * 4);
				r8d = _t365 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t437 > 0) goto 0x40013f46;
				_t509 = r11b & 0xffffffff;
				r15d = r15d >> _t509;
				 *(__r13 + 0x1be4) = _t509;
				_t512 = _t365 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t512;
				r15d = r15d >> _t512;
				_t439 = _t437 - _t509 - _t512;
				 *(__r13 + 0x50) = _t365 >> 0x10;
				if (_t365 != 0) goto 0x40013fde;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4d;
				goto 0x40013648;
				if ((_t365 & 0x00000020) == 0) goto 0x40013ff2;
				 *(__r13 + 0x1be4) = 0xffffffff;
				goto 0x40013640;
				if ((_t365 & 0x00000040) == 0) goto 0x4001400e;
				_t731 = "invalid literal/length code";
				 *(_t765 + 0x20) = _t731;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013648;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f49;
				 *(__r13 + 0x58) = _t365 & 0xf;
				_t588 =  *(__r13 + 0x58);
				if (_t588 == 0) goto 0x4001406d;
				if (_t439 - _t588 >= 0) goto 0x4001404f;
				if (_t606 == 0) goto 0x400144ee;
				_t440 = _t439 + 8;
				_t607 = _t606 - 1;
				_t809 =  &(_t808[1]);
				r15d = r15d + (( *_t808 & 0x000000ff) << _t439);
				if (_t440 - _t588 < 0) goto 0x40014030;
				_t518 = _t588;
				_t441 = _t440 - _t588;
				r15d = r15d >> _t518;
				 *(__r13 + 0x50) =  *(__r13 + 0x50) + ((0x00000001 << _t518) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t588;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4a;
				 *(__r13 + 0x1be8) =  *(__r13 + 0x50);
				_t791 =  *((intOrPtr*)(__r13 + 0x68));
				_t747 = _t746 & _t731;
				if (( *(_t791 + _t747 * 4) >> 0x00000008 & 0x000000ff) - _t441 <= 0) goto 0x400140f0;
				asm("o16 nop [eax+eax]");
				if (_t607 == 0) goto 0x400144ee;
				_t442 = _t441 + 8;
				_t608 = _t607 - 1;
				r15d = r15d + (( *_t809 & 0x000000ff) << _t441);
				_t810 =  &(_t809[1]);
				_t748 = _t747 & _t731;
				_t382 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t748 * 4);
				if ((_t382 >> 0x00000008 & 0x000000ff) - _t442 > 0) goto 0x400140b0;
				if ((_t382 & 0x000000f0) != 0) goto 0x400141ba;
				r10d = _t382;
				 *(_t768 - 0x48) = _t382;
				r10d = r10d >> 8;
				r9d = 1;
				r8d = r10b & 0xffffffff;
				r9d = r9d << (_t382 & 0x000000ff) + r8d;
				r9d = r9d - 1;
				r9d = r9d & r15d;
				r9d = r9d >> r8d;
				r9d = r9d + (_t382 >> 0x10);
				r11d =  *(_t768 - 0x47) & 0x000000ff;
				r8d =  *(_t791 + _t783 * 4) >> 0x00000008 & 0x000000ff;
				r8d = r8d + (r10b & 0xffffffff);
				if (r8d - _t442 <= 0) goto 0x400141aa;
				r10d =  *(_t768 - 0x46) & 0x0000ffff;
				if (_t608 == 0) goto 0x400144ee;
				r9d = r11b & 0xffffffff;
				r8d = 1;
				r15d = r15d + (( *_t810 & 0x000000ff) << _t442);
				r8d = r8d << (_t382 & 0x000000ff) + r9d;
				_t443 = _t442 + 8;
				r8d = r8d - 1;
				_t609 = _t608 - 1;
				_t811 =  &(_t810[1]);
				r8d = r8d & r15d;
				r8d = r8d >> r9d;
				r8d = r8d + (r10w & 0xffffffff);
				_t388 =  *( *((intOrPtr*)(__r13 + 0x68)) + _t775 * 4);
				r8d = _t388 >> 0x00000008 & 0x000000ff;
				r8d = r8d + r9d;
				if (r8d - _t443 > 0) goto 0x40014150;
				_t542 = r11b & 0xffffffff;
				r15d = r15d >> _t542;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t542;
				_t784 =  *(_t768 - 0x40);
				r11d =  *(_t768 + 0x38);
				_t545 = _t388 >> 0x00000008 & 0x000000ff;
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t545;
				r15d = r15d >> _t545;
				_t445 = _t443 - _t542 - _t545;
				if ((_t388 & 0x00000040) == 0) goto 0x400141f2;
				 *(_t765 + 0x20) = "invalid distance code";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r10d =  *(_t768 - 0x4c);
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4b;
				 *(__r13 + 0x54) = _t388 >> 0x10;
				 *(__r13 + 0x58) = _t388 & 0xf;
				_t590 =  *(__r13 + 0x58);
				if (_t590 == 0) goto 0x4001425d;
				if (_t445 - _t590 >= 0) goto 0x4001423f;
				if (_t609 == 0) goto 0x400144ee;
				_t446 = _t445 + 8;
				_t610 = _t609 - 1;
				_t812 =  &(_t811[1]);
				r15d = r15d + (( *_t811 & 0x000000ff) << _t445);
				if (_t446 - _t590 < 0) goto 0x40014220;
				_t551 = _t590;
				_t447 = _t446 - _t590;
				r15d = r15d >> _t551;
				 *(__r13 + 0x54) =  *(__r13 + 0x54) + ((0x00000001 << _t551) - 0x00000001 & r15d);
				 *(__r13 + 0x1be4) =  *(__r13 + 0x1be4) + _t590;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4c;
				if (r11d == 0) goto 0x400144ee;
				_t552 =  *(__r13 + 0x54);
				_t396 = r10d - r11d;
				if (_t552 - _t396 <= 0) goto 0x400142ca;
				_t553 = _t552 - _t396;
				if (_t553 -  *((intOrPtr*)(__r13 + 0x38)) <= 0) goto 0x400142a6;
				if ( *((intOrPtr*)(__r13 + 0x1be0)) == 0) goto 0x400142a6;
				 *(_t765 + 0x20) = "invalid distance too far back";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				_t397 =  *((intOrPtr*)(__r13 + 0x3c));
				if (_t553 - _t397 <= 0) goto 0x400142b8;
				_t554 = _t553 - _t397;
				goto 0x400142bc;
				_t593 = _t397 - _t554;
				if (_t554 -  *(__r13 + 0x50) <= 0) goto 0x400142d6;
				goto 0x400142d4;
				_t400 =  *(__r13 + 0x50);
				_t555 = _t400;
				_t556 =  >  ? r11d : _t555;
				r11d = r11d - _t556;
				 *(_t768 + 0x38) = r11d;
				 *(__r13 + 0x50) = _t400 - _t556;
				_t785 = _t784 + 1;
				 *((char*)(_t785 - 1)) =  *(_t784 - _t748 - _t784 + _t784) & 0x000000ff;
				if (_t555 != r11d) goto 0x400142f0;
				 *(_t768 - 0x40) = _t785;
				if ( *(__r13 + 0x50) != _t556 - 1) goto 0x40013650;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				if (r11d == 0) goto 0x400144ee;
				_t786 = _t785 + 1;
				r11d = r11d - 1;
				 *((char*)(_t786 - 1)) =  *(__r13 + 0x50) & 0x000000ff;
				 *(_t768 + 0x38) = r11d;
				 *(_t768 - 0x40) = _t786;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f48;
				goto 0x40013650;
				if ( *((intOrPtr*)(_t768 + 0x10)) == 0) goto 0x40014420;
				if (_t447 - 0x20 >= 0) goto 0x40014378;
				if (_t610 == 0) goto 0x400144ee;
				_t611 = _t610 - 1;
				_t813 =  &(_t812[1]);
				r15d = r15d + (( *_t812 & 0x000000ff) << _t447);
				if (_t447 + 8 - 0x20 < 0) goto 0x40014358;
				r10d = r10d - r11d;
				 *((intOrPtr*)(_t765 + 0x1c)) =  *((intOrPtr*)(_t765 + 0x1c)) + r10d;
				 *((intOrPtr*)(__r13 + 0x24)) =  *((intOrPtr*)(__r13 + 0x24)) + r10d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x400143c1;
				if (r10d == 0) goto 0x400143c1;
				r8d = r10d;
				if ( *((intOrPtr*)(__r13 + 0x18)) == 0) goto 0x400143ad;
				_t407 = E00000001140015160(_t786 - "invalid distance too far back");
				goto 0x400143b2;
				_t408 = E00000001140015A00(_t407,  *((intOrPtr*)(__r13 + 0x20)), _t593, _t738, _t775);
				r11d =  *(_t768 + 0x38);
				 *((intOrPtr*)(__r13 + 0x20)) = _t408;
				 *((intOrPtr*)(_t765 + 0x4c)) = _t408;
				 *(_t768 - 0x4c) = r11d;
				if (( *(__r13 + 0x10) & 0x00000004) == 0) goto 0x4001441a;
				if ( *((intOrPtr*)(__r13 + 0x18)) != 0) goto 0x400143fc;
				if (((r15d & 0x0000ff00) + (r15d << 0x10) << 8) + (r15d >> 0x00000008 & 0x0000ff00) + (r15d >> 0x18) ==  *((intOrPtr*)(__r13 + 0x20))) goto 0x4001441a;
				 *(_t765 + 0x20) = "incorrect data check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				r15d = r12d;
				_t449 = r12d;
				 *((intOrPtr*)(__r13 + 8)) = 0x3f4f;
				if ( *(__r13 + 0x10) == 0) goto 0x400144c7;
				if ( *((intOrPtr*)(__r13 + 0x18)) == 0) goto 0x400144c7;
				if (_t449 - 0x20 >= 0) goto 0x40014463;
				if (_t611 == 0) goto 0x400144ee;
				_t450 = _t449 + 8;
				r15d = r15d + (( *_t813 & 0x000000ff) << _t449);
				if (_t450 - 0x20 < 0) goto 0x40014443;
				if (r15d ==  *((intOrPtr*)(__r13 + 0x24))) goto 0x400144c1;
				 *(_t765 + 0x20) = "incorrect length check";
				 *((intOrPtr*)(__r13 + 8)) = 0x3f51;
				goto 0x40013650;
				 *((long long*)(_t765 + 0x10)) =  *(_t768 - 0x40);
				 *(_t765 + 0x18) = r11d;
				 *_t765 =  &(_t813[1]);
				 *((intOrPtr*)(_t765 + 8)) = _t611 - 1;
				 *(__r13 + 0x48) = r15d;
				 *(__r13 + 0x4c) = _t450;
				return 2;
			}





































































































































    0x140013803
    0x140013806
    0x140013808
    0x14001380e
    0x140013812
    0x140013823
    0x140013828
    0x14001382e
    0x140013833
    0x14001383e
    0x140013840
    0x140013847
    0x14001384b
    0x140013853
    0x140013858
    0x14001385f
    0x140013862
    0x140013865
    0x140013870
    0x140013876
    0x14001387e
    0x140013885
    0x14001388a
    0x140013891
    0x140013898
    0x14001389e
    0x1400138a4
    0x1400138a7
    0x1400138aa
    0x1400138af
    0x1400138b7
    0x1400138ba
    0x1400138c0
    0x1400138c4
    0x1400138c7
    0x1400138cb
    0x1400138cf
    0x1400138d3
    0x1400138d8
    0x1400138e8
    0x1400138ea
    0x1400138f2
    0x1400138fe
    0x140013903
    0x140013905
    0x140013908
    0x14001390e
    0x140013913
    0x140013917
    0x14001391d
    0x14001392a
    0x140013933
    0x140013935
    0x14001393c
    0x140013940
    0x140013947
    0x140013951
    0x14001395a
    0x140013960
    0x140013967
    0x140013981
    0x140013986
    0x14001398a
    0x140013996
    0x14001399b
    0x14001399d
    0x1400139a0
    0x1400139a6
    0x1400139b3
    0x1400139c2
    0x1400139c6
    0x1400139cf
    0x1400139e1
    0x1400139eb
    0x1400139ff
    0x140013a08
    0x140013a17
    0x140013a19
    0x140013a20
    0x140013a29
    0x140013a2c
    0x140013a37
    0x140013a3c
    0x140013a43
    0x140013a48
    0x140013a48
    0x140013a4c
    0x140013a53
    0x140013a58
    0x140013a5c
    0x140013a61
    0x140013a6a
    0x140013a6e
    0x140013a76
    0x140013a7b
    0x140013a82
    0x140013a86
    0x140013a8e
    0x140013a93
    0x140013a9a
    0x140013aad
    0x140013abb
    0x140013ac5
    0x140013ae0
    0x140013ae3
    0x140013ae7
    0x140013aec
    0x140013af7
    0x140013b02
    0x140013b0e
    0x140013b16
    0x140013b18
    0x140013b20
    0x140013b2e
    0x140013b32
    0x140013b37
    0x140013b42
    0x140013b46
    0x140013b49
    0x140013b4d
    0x140013b52
    0x140013b58
    0x140013b61
    0x140013b64
    0x140013b66
    0x140013b6d
    0x140013b72
    0x140013b7a
    0x140013b7f
    0x140013b83
    0x140013b8f
    0x140013b94
    0x140013b96
    0x140013b99
    0x140013b9e
    0x140013ba0
    0x140013ba4
    0x140013bac
    0x140013bb9
    0x140013bbd
    0x140013bcc
    0x140013bcf
    0x140013bd9
    0x140013bde
    0x140013be0
    0x140013be6
    0x140013bea
    0x140013bf6
    0x140013bfb
    0x140013bfd
    0x140013c00
    0x140013c05
    0x140013c0f
    0x140013c1b
    0x140013c1f
    0x140013c21
    0x140013c27
    0x140013c32
    0x140013c3e
    0x140013c43
    0x140013c48
    0x140013c4d
    0x140013c57
    0x140013c63
    0x140013c6a
    0x140013c80
    0x140013c82
    0x140013c84
    0x140013c86
    0x140013c97
    0x140013ca0
    0x140013ca9
    0x140013cab
    0x140013cb6
    0x140013cc4
    0x140013cd2
    0x140013ce1
    0x140013cea
    0x140013cee
    0x140013cf6
    0x140013d02
    0x140013d06
    0x140013d0e
    0x140013d13
    0x140013d1a
    0x140013d21
    0x140013d28
    0x140013d2d
    0x140013d32
    0x140013d49
    0x140013d50
    0x140013d54
    0x140013d59
    0x140013d5e
    0x140013d6b
    0x140013d6f
    0x140013d77
    0x140013d83
    0x140013d8a
    0x140013d8e
    0x140013d96
    0x140013da4
    0x140013da9
    0x140013dbd
    0x140013dc2
    0x140013dc5
    0x140013dca
    0x140013dcc
    0x140013dd3
    0x140013dd8
    0x140013de3
    0x140013de9
    0x140013df1
    0x140013df5
    0x140013df9
    0x140013dfc
    0x140013e00
    0x140013e0b
    0x140013e14
    0x140013e16
    0x140013e1a
    0x140013e1e
    0x140013e21
    0x140013e27
    0x140013e2a
    0x140013e2e
    0x140013e32
    0x140013e3f
    0x140013e43
    0x140013e47
    0x140013e4a
    0x140013e4d
    0x140013e51
    0x140013e55
    0x140013e59
    0x140013e5d
    0x140013e63
    0x140013e6e
    0x140013e76
    0x140013e81
    0x140013e8e
    0x140013e9f
    0x140013ea3
    0x140013eaf
    0x140013eb7
    0x140013eb9
    0x140013ec1
    0x140013ecc
    0x140013ed3
    0x140013ee0
    0x140013ee4
    0x140013eec
    0x140013ef2
    0x140013ef8
    0x140013efb
    0x140013eff
    0x140013f07
    0x140013f11
    0x140013f17
    0x140013f1a
    0x140013f1d
    0x140013f20
    0x140013f27
    0x140013f31
    0x140013f39
    0x140013f3f
    0x140013f41
    0x140013f48
    0x140013f54
    0x140013f5a
    0x140013f66
    0x140013f6d
    0x140013f73
    0x140013f76
    0x140013f79
    0x140013f7b
    0x140013f7e
    0x140013f81
    0x140013f84
    0x140013f8b
    0x140013f94
    0x140013f98
    0x140013f9e
    0x140013fa0
    0x140013fa4
    0x140013fa9
    0x140013fb5
    0x140013fb8
    0x140013fbf
    0x140013fc2
    0x140013fc9
    0x140013fcf
    0x140013fd1
    0x140013fd9
    0x140013fe0
    0x140013fe2
    0x140013fed
    0x140013ff4
    0x140013ff6
    0x140013ffd
    0x140014001
    0x140014009
    0x140014011
    0x14001401c
    0x140014020
    0x140014026
    0x14001402a
    0x140014032
    0x14001403e
    0x140014043
    0x140014045
    0x140014048
    0x14001404d
    0x14001404f
    0x140014056
    0x14001405f
    0x140014062
    0x140014066
    0x140014071
    0x14001407d
    0x140014086
    0x140014097
    0x1400140a8
    0x1400140aa
    0x1400140b2
    0x1400140be
    0x1400140c5
    0x1400140c7
    0x1400140cf
    0x1400140da
    0x1400140e1
    0x1400140ee
    0x1400140f2
    0x1400140f8
    0x1400140fe
    0x140014101
    0x140014105
    0x14001410d
    0x140014117
    0x14001411d
    0x140014120
    0x140014123
    0x140014126
    0x14001412d
    0x140014137
    0x14001413f
    0x140014145
    0x140014147
    0x140014152
    0x14001415e
    0x140014164
    0x140014170
    0x140014177
    0x14001417d
    0x140014180
    0x140014183
    0x140014185
    0x140014188
    0x14001418b
    0x14001418e
    0x140014195
    0x14001419e
    0x1400141a2
    0x1400141a8
    0x1400141aa
    0x1400141ae
    0x1400141b3
    0x1400141ba
    0x1400141be
    0x1400141c7
    0x1400141ca
    0x1400141d1
    0x1400141d4
    0x1400141d8
    0x1400141e1
    0x1400141e5
    0x1400141ed
    0x1400141f2
    0x1400141f8
    0x140014203
    0x14001420d
    0x140014211
    0x140014217
    0x14001421b
    0x140014222
    0x14001422e
    0x140014233
    0x140014235
    0x140014238
    0x14001423d
    0x14001423f
    0x140014246
    0x14001424f
    0x140014252
    0x140014256
    0x14001425d
    0x140014268
    0x14001426e
    0x140014275
    0x14001427a
    0x14001427c
    0x140014282
    0x14001428c
    0x140014295
    0x140014299
    0x1400142a1
    0x1400142a6
    0x1400142ac
    0x1400142b2
    0x1400142b6
    0x1400142ba
    0x1400142c6
    0x1400142c8
    0x1400142ca
    0x1400142d4
    0x1400142d9
    0x1400142dd
    0x1400142e5
    0x1400142e9
    0x1400142f5
    0x1400142f8
    0x1400142fe
    0x140014300
    0x140014308
    0x14001430e
    0x14001431e
    0x140014329
    0x14001432c
    0x14001432f
    0x140014333
    0x140014337
    0x14001433b
    0x140014343
    0x14001434d
    0x140014356
    0x14001435a
    0x14001436b
    0x14001436d
    0x140014370
    0x140014376
    0x140014378
    0x14001437b
    0x14001437f
    0x140014388
    0x14001438d
    0x1400143a1
    0x1400143a4
    0x1400143a6
    0x1400143ab
    0x1400143ad
    0x1400143b6
    0x1400143ba
    0x1400143be
    0x1400143c6
    0x1400143ca
    0x1400143d4
    0x140014400
    0x140014409
    0x14001440d
    0x140014415
    0x14001441a
    0x14001441d
    0x140014420
    0x14001442d
    0x140014438
    0x140014441
    0x140014445
    0x140014451
    0x14001445b
    0x140014461
    0x140014467
    0x140014470
    0x140014474
    0x14001447c
    0x140014481
    0x140014485
    0x140014489
    0x14001448c
    0x140014494
    0x140014498
    0x1400144c0

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: memcpy
    • String ID: $ $invalid stored block lengths
    • API String ID: 3510742995-1718185709
    • Opcode ID: 5f3785c6bdba46eb60d69e78c4f4265f0dc23295ab4a8ac60ddc5c93de800f58
    • Instruction ID: c92309fc0d38d6234d0408f55a04ce57e81ba093b92e9b8f78a366b710634dd8
    • Opcode Fuzzy Hash: 5f3785c6bdba46eb60d69e78c4f4265f0dc23295ab4a8ac60ddc5c93de800f58
    • Instruction Fuzzy Hash: F041AC726107A09BE7668F26C4847AD3BA9F70C7C4F215129FF4A4BBA4D735D890CB40
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000C4F0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: EntryFunctionLookup$UnwindVirtual
    • String ID:
    • API String ID: 3286588846-0
    • Opcode ID: 5ffe1ae6781f616f05b09686b59ef02f87d61e133bf716f3c3af1d3ad7213900
    • Instruction ID: 3ebace1c390976f506d0f99ca18ed721a427f0b26ede3763bfd5663c46823d1b
    • Opcode Fuzzy Hash: 5ffe1ae6781f616f05b09686b59ef02f87d61e133bf716f3c3af1d3ad7213900
    • Instruction Fuzzy Hash: 48512E66A15FC481EA61CB29E5453ED63A0FB9DB84F09A215DF8C13756EF34D2D4C700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000D02C Relevance: 6.1, APIs: 4, Instructions: 75memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AllocateHeapmemsetwcscpywcslen
    • String ID:
    • API String ID: 2037025450-0
    • Opcode ID: b978c47abf32f50db09605b5f54ccf2d2c55a7be9a486567f80230ab28ac97f2
    • Instruction ID: 6743f53f77a36836f55a7605488c5dfe466d4e7a0e85049e430ca513693cbf19
    • Opcode Fuzzy Hash: b978c47abf32f50db09605b5f54ccf2d2c55a7be9a486567f80230ab28ac97f2
    • Instruction Fuzzy Hash: 6D3109B5605B4081EB16EF27A5443ECB7A1EB8CFD4F588126AF4D0B7AADF39C4518350
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000CCD8 Relevance: 6.1, APIs: 4, Instructions: 75memoryCOMMON
    Download Yara Rule
    C-Code - Quality: 23%
    			E0000000114000CCD8(signed long long __edx, signed long long __rax, long long __rbx, signed long long __rcx, void* __rdx, long long __rsi, long long __rbp, signed long long __r8, signed long long** __r9, long long _a8, long long _a16, long long _a24, intOrPtr _a40) {
				signed int _t40;
				signed long long _t53;
				void* _t66;
				signed long long* _t67;
				signed long long _t72;
				signed long long _t83;

				_t66 = __rdx;
				_t55 = __rbx;
				_t53 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t83 = __rcx;
				_t72 = __r8;
				r15d = __edx;
				E0000000114000CE30(__rbx,  *__r9);
				_t4 = _t66 + 0x60; // 0x60
				r8d = _t4;
				RtlAllocateHeap(??, ??, ??);
				_t67 = _t53;
				if (_t53 == 0) goto 0x4000cde0;
				_t39 =  <=  ? 1 : _a40;
				RtlAllocateHeap(??, ??, ??);
				_t67[1] = _t53;
				if (_t53 == 0) goto 0x4000cdcc;
				 *_t67 =  *_t67 & 0x00000000;
				_t67[8] = _t67[8] & 0x00000000;
				_t67[8] = _t67[8] & 0x00000000;
				_t67[0xa] = _t67[0xa] & 0x00000000;
				_t67[7] =  <=  ? 1 : _a40;
				_t67[6] = _t83;
				_t67[7] = r15d;
				_t67[4] = _t72;
				_t67[9] = __r9;
				E000000011400167C0(_t53, _t72);
				if (_t53 == 0) goto 0x4000cd86;
				_t67[8] = _t67[8] | 0x00000002;
				_t21 = _t83 + 0x10; // 0x18
				r8d = 0x10000;
				_t22 = _t66 - 0xc; // 0x4
				r9d = _t22;
				E000000011400117FC(_t40, 0x10, _t53, _t53, _t55, _t21);
				_t67[0xb] = _t53;
				RtlAllocateHeap(??, ??, ??);
				_t67[3] = _t53;
				 *((long long*)(_t53 + 8)) = 0x4001963c;
				 *__r9 = _t67;
				goto 0x4000cde0;
				return HeapFree(??, ??, ??);
			}









    0x14000ccd8
    0x14000ccd8
    0x14000ccd8
    0x14000ccd8
    0x14000ccdd
    0x14000cce2
    0x14000ccf0
    0x14000ccf9
    0x14000ccfc
    0x14000ccff
    0x14000cd0d
    0x14000cd0d
    0x14000cd11
    0x14000cd17
    0x14000cd1d
    0x14000cd38
    0x14000cd42
    0x14000cd48
    0x14000cd4f
    0x14000cd51
    0x14000cd55
    0x14000cd59
    0x14000cd5d
    0x14000cd65
    0x14000cd68
    0x14000cd6c
    0x14000cd70
    0x14000cd74
    0x14000cd78
    0x14000cd80
    0x14000cd82
    0x14000cd8b
    0x14000cd8f
    0x14000cd95
    0x14000cd95
    0x14000cd99
    0x14000cda7
    0x14000cdb2
    0x14000cdbf
    0x14000cdc3
    0x14000cdc7
    0x14000cdca
    0x14000cdfb

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: Heap$Free$Allocate
    • String ID:
    • API String ID: 3472947110-0
    • Opcode ID: d245e5653b3efa210e15e45dc3095293edc3cbf2e23a43fbe2619f5dacf3537d
    • Instruction ID: 5bc8d6a19ab5820ea12ddcb4c1614eb0e390fbda2a9c6e8bfd6285e08278190a
    • Opcode Fuzzy Hash: d245e5653b3efa210e15e45dc3095293edc3cbf2e23a43fbe2619f5dacf3537d
    • Instruction Fuzzy Hash: B73142B2211B409BE702DF13EA807A977A4F788BC0F448429EB4847B65DF79E4A6C740
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400085F0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: CharLower
    • String ID:
    • API String ID: 1615517891-0
    • Opcode ID: aabfa1885bbcdd7278eb26932432713e72225ea50af0810a3f1a86d8e5eb4003
    • Instruction ID: 89447f37e157e5f910190f26039f07b44efb98263a832e051549732566d91b47
    • Opcode Fuzzy Hash: aabfa1885bbcdd7278eb26932432713e72225ea50af0810a3f1a86d8e5eb4003
    • Instruction Fuzzy Hash: BB2181766006A092EA66EF13A8047BA76A0F748BF5F5A4211FFD5072E0DB35C495D710
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400174E0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: ByteCharMultiWide_malloc_dbg
    • String ID:
    • API String ID: 3363118916-0
    • Opcode ID: c3b8fcaeda161a58b67eb2a29d4de436d169905ef7e21983a714ce1bab924364
    • Instruction ID: eb7332db7f165f027367f4732026c4c5e1ffc84dd66e6814e4cbb0aaa670ffe8
    • Opcode Fuzzy Hash: c3b8fcaeda161a58b67eb2a29d4de436d169905ef7e21983a714ce1bab924364
    • Instruction Fuzzy Hash: 2C216532208B8086D725CF16B44079AB7A5F7887E4F488725FF9917BA5DF79C551C700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00000001400112A8 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: AllocateHeap$AcquireCriticalLeaveLockSection
    • String ID:
    • API String ID: 811089001-0
    • Opcode ID: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
    • Instruction ID: 37e1212d5150fef44f5374ae18cee5b2af0a62904f946070966fd9e2c84ce28f
    • Opcode Fuzzy Hash: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
    • Instruction Fuzzy Hash: 7B210872615B4482EB198F66E5403EC6361F78CFD4F548612EB6E4B7AACF38C552C350
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140017410 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: ByteCharMultiWide_malloc_dbg
    • String ID:
    • API String ID: 3363118916-0
    • Opcode ID: b82687d318f43acb72b95e327159745dac6b4a7bc8d4a8e935ee1388842a16e4
    • Instruction ID: 40dc39d6401ac23dbbf15f28fc1e93d87451d781889f5abbfcb2521dceb51717
    • Opcode Fuzzy Hash: b82687d318f43acb72b95e327159745dac6b4a7bc8d4a8e935ee1388842a16e4
    • Instruction Fuzzy Hash: 3A118F3260878086EB25CF66B41076ABBA5FB8CBE4F544328EF9D57BA5DF39C4118704
    Uniqueness

    Uniqueness Score: -1.00%

    Function 0000000140011668 Relevance: 6.0, APIs: 4, Instructions: 39memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: FreeHeap$AcquireCriticalLeaveLockSection
    • String ID:
    • API String ID: 3765687422-0
    • Opcode ID: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
    • Instruction ID: 5186432533761a1e63310800083548d259c5d54e134ea9fda60ce401f62d664d
    • Opcode Fuzzy Hash: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
    • Instruction Fuzzy Hash: 76114C76600B4082EB5A9F53E5943E823A0FB9CBC5F4C8416EB091B6A7DF3AC4A5C300
    Uniqueness

    Uniqueness Score: -1.00%

    Function 000000014000CE30 Relevance: 5.0, APIs: 4, Instructions: 37memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.328631593.0000000140001000.00000040.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true
    • Associated: 00000000.00000002.328627264.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328665371.0000000140064000.00000040.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328670410.0000000140066000.00000080.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328675712.0000000140067000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328681568.0000000140083000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328690464.00000001400A7000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.328700905.00000001400A9000.00000004.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_140000000_WCTBt2z7KE.jbxd
    Similarity
    • API ID: FreeHeap$AcquireCriticalLeaveLockSectionmemset
    • String ID:
    • API String ID: 425131248-0
    • Opcode ID: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
    • Instruction ID: bd40ed23f28c7418c8be6727045953eb2e8c2f29468db0d1e18b21a18f306043
    • Opcode Fuzzy Hash: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
    • Instruction Fuzzy Hash: FD01C8B5600B8492EB06EB63E9903E923A1FBCDBD0F488416AF0D1B776CF39D4518740
    Uniqueness

    Uniqueness Score: -1.00%