Edit tour

Windows Analysis Report
XShSI2OXaC.exe

Overview

General Information

Sample Name:	XShSI2OXaC.exe
Analysis ID:	736966
MD5:	b69c9170ffab277e1bd13fde891a5ae5
SHA1:	8928e5d360edbecd1547cf61831d4f055bed92af
SHA256:	a81489460818664146f756543f081b702bcb69244ebf8f6a240b02b2357c577c
Tags:	exesigned
Infos:

Detection

GuLoader

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Tries to detect virtualization through RDTSC time measurements

Uses 32bit PE files

Drops PE files

Contains functionality to shutdown / reboot the system

Detected potential crypto function

PE / OLE file has an invalid certificate

Contains functionality to dynamically determine API calls

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

XShSI2OXaC.exe (PID: 5820 cmdline: C:\Users\user\Desktop\XShSI2OXaC.exe MD5: B69C9170FFAB277E1BD13FDE891A5AE5)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.777436198.0000000003220000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: XShSI2OXaC.exe	ReversingLabs: Detection: 40%
Source: XShSI2OXaC.exe	Virustotal: Detection: 8%			Perma Link

Source: XShSI2OXaC.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\One

Jump to behavior

Source: XShSI2OXaC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_00405B6C CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405B6C
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_004028D5 FindFirstFileW,	0_2_004028D5
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_0040679D FindFirstFileW,FindClose,	0_2_0040679D

Source: XShSI2OXaC.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: XShSI2OXaC.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: XShSI2OXaC.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: XShSI2OXaC.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: XShSI2OXaC.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: XShSI2OXaC.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: XShSI2OXaC.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: XShSI2OXaC.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: XShSI2OXaC.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: XShSI2OXaC.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: XShSI2OXaC.exe	String found in binary or memory: http://www.certum.pl/CPS0

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Code function: 0_2_00405601 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405601

Source: XShSI2OXaC.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Code function: 0_2_0040350D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040350D

Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_00406B64		0_2_00406B64
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_73791B5F		0_2_73791B5F

Source: XShSI2OXaC.exe

Static PE information: invalid certificate

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Process Stats: CPU usage > 98%

Source: XShSI2OXaC.exe	ReversingLabs: Detection: 40%
Source: XShSI2OXaC.exe	Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

File read: C:\Users\user\Desktop\XShSI2OXaC.exe

Jump to behavior

Source: XShSI2OXaC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

0_2_0040350D

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

File created: C:\Users\user\AppData\Local\Temp\nsyA070.tmp

Jump to behavior

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Contentness\Filialbestyrerens\Talkability\Platybrachycephalous\Plugin_Status.ini

Jump to behavior

Source: classification engine

Classification label: mal60.troj.evad.winEXE@1/6@0/0

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Code function: 0_2_00402171 CoCreateInstance,

0_2_00402171

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Code function: 0_2_004048B8 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004048B8

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\One

Jump to behavior

Source: XShSI2OXaC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.777436198.0000000003220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Code function: 0_2_73791B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73791B5F

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

File created: C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

RDTSC instruction interceptor: First address: 0000000003221D6F second address: 0000000003221D6F instructions: 0x00000000 rdtsc 0x00000002 test ch, 00000040h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F6E649CF979h 0x0000000d test cx, bx 0x00000010 inc ebp 0x00000011 cmp ax, cx 0x00000014 inc ebx 0x00000015 jmp 00007F6E649CFB35h 0x0000001a test bx, dx 0x0000001d rdtsc

Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_00405B6C CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405B6C
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_004028D5 FindFirstFileW,	0_2_004028D5
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	Code function: 0_2_0040679D FindFirstFileW,FindClose,	0_2_0040679D

Source: C:\Users\user\Desktop\XShSI2OXaC.exe	API call chain: ExitProcess graph end node			graph_0-4420
Source: C:\Users\user\Desktop\XShSI2OXaC.exe	API call chain: ExitProcess graph end node			graph_0-4577

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

Code function: 0_2_73791B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73791B5F

Source: C:\Users\user\Desktop\XShSI2OXaC.exe

0_2_0040350D

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 Windows Service	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Windows Service	Rootkit	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XShSI2OXaC.exe	40%	ReversingLabs	Win32.Trojan.InjectorX
XShSI2OXaC.exe	8%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll	4%	Metadefender	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://subca.ocsp-certum.com05	0%	URL Reputation	safe
http://subca.ocsp-certum.com05	0%	URL Reputation	safe
http://subca.ocsp-certum.com02	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.certum.pl/ctnca2.crl0l	XShSI2OXaC.exe	false		high
http://repository.certum.pl/ctnca2.cer09	XShSI2OXaC.exe	false		high
http://crl.certum.pl/ctsca2021.crl0o	XShSI2OXaC.exe	false		high
http://repository.certum.pl/ctnca.cer09	XShSI2OXaC.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	XShSI2OXaC.exe	false		high
http://repository.certum.pl/ctsca2021.cer0	XShSI2OXaC.exe	false		high
http://crl.certum.pl/ctnca.crl0k	XShSI2OXaC.exe	false		high
http://subca.ocsp-certum.com05	XShSI2OXaC.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.certum.pl/CPS0	XShSI2OXaC.exe	false		high
http://subca.ocsp-certum.com02	XShSI2OXaC.exe	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com01	XShSI2OXaC.exe	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	736966
Start date and time:	2022-11-03 12:40:26 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	XShSI2OXaC.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.troj.evad.winEXE@1/6@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 86.1% (good quality ratio 84.8%) Quality average: 88.3% Quality standard deviation: 20.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll	Zapytanie o najlepsz#U0105 cen#U0119.exe	Get hash	malicious	Browse
	Zapytanie o najlepsz#U0105 cen#U0119.exe	Get hash	malicious	Browse
	Zapytanie o najlepsz#U0105 cen#U0119.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.12223.13002.2933.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.12223.13002.2933.exe	Get hash	malicious	Browse
	AP0145.exe	Get hash	malicious	Browse
	AP0145.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.12223.14774.825.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.12223.14774.825.exe	Get hash	malicious	Browse
	SOLICITUD DE OFERTA.exe	Get hash	malicious	Browse
	SOLICITUD DE OFERTA.exe	Get hash	malicious	Browse
	SOLICITUD DE OFERTA.exe	Get hash	malicious	Browse
	SOLICITUD DE OFERTA.exe	Get hash	malicious	Browse
	R_018996_GRUPO OCLEM_RCL181378_SEPTEMBER_2022.exe	Get hash	malicious	Browse
	R_018996_GRUPO OCLEM_RCL181378_SEPTEMBER_2022.exe	Get hash	malicious	Browse
	351521.exe	Get hash	malicious	Browse
	Skaanebetrkkenes.exe	Get hash	malicious	Browse
	351521.exe	Get hash	malicious	Browse
	Skaanebetrkkenes.exe	Get hash	malicious	Browse
	ORDEM N#U00ba 78341.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\hale4r.lnk

Download File

Process:	C:\Users\user\Desktop\XShSI2OXaC.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	852
Entropy (8bit):	2.8931668942154323
Encrypted:	false
SSDEEP:	12:8gl0gsXou41w/tz+7RafgKDuKiP/3NJkKAd4t2Y+xIBjK:8/f4eaRMgKxiX9HAv7aB
MD5:	4C35348ABAD84AE5B63C7EE3148E0F95
SHA1:	6805EF5D68BFDFF71F2841255892BC1957AE40AA
SHA-256:	0D6C1CB8C1BB8471AA59E453AE72C69B894A85EB2CE3AE3EFAE789CC89D92ADF
SHA-512:	74CB2490211DC4163D2AEA5C550338806070CD90FA7A461A2DBFBBC96B49CB44E2F351BAFAD5D3B201263923A2E674209C6DEBD1C3C7F746DDBE694216EB8320
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	L..................F........................................................#....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................h.a.r.d.z.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....P.1...........Local.<............................................L.o.c.a.l.....N.1...........Temp..:............................................T.e.m.p.....`.2...........hale4r.txt..F............................................h.a.l.e.4.r...t.x.t...........\.h.a.l.e.4.r...t.x.t.........(.................l^".`G...3..qs................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.................

C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\XShSI2OXaC.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	12288
Entropy (8bit):	5.737504888129487
Encrypted:	false
SSDEEP:	192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
MD5:	8CF2AC271D7679B1D68EEFC1AE0C5618
SHA1:	7CC1CAAA747EE16DC894A600A4256F64FA65A9B8
SHA-256:	6950991102462D84FDC0E3B0AE30C95AF8C192F77CE3D78E8D54E6B22F7C09BA
SHA-512:	CE828FB9ECD7655CC4C974F78F209D3326BA71CED60171A45A437FC3FFF3BD0D69A0997ADACA29265C7B5419BDEA2B17F8CC8CEAE1B8CE6B22B7ED9120BB5AD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 4%, Browse
Joe Sandbox View:	Filename: Zapytanie o najlepsz#U0105 cen#U0119.exe, Detection: malicious, Browse Filename: Zapytanie o najlepsz#U0105 cen#U0119.exe, Detection: malicious, Browse Filename: Zapytanie o najlepsz#U0105 cen#U0119.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.12223.13002.2933.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.12223.13002.2933.exe, Detection: malicious, Browse Filename: AP0145.exe, Detection: malicious, Browse Filename: AP0145.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.12223.14774.825.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Nemesis.12223.14774.825.exe, Detection: malicious, Browse Filename: SOLICITUD DE OFERTA.exe, Detection: malicious, Browse Filename: SOLICITUD DE OFERTA.exe, Detection: malicious, Browse Filename: SOLICITUD DE OFERTA.exe, Detection: malicious, Browse Filename: SOLICITUD DE OFERTA.exe, Detection: malicious, Browse Filename: R_018996_GRUPO OCLEM_RCL181378_SEPTEMBER_2022.exe, Detection: malicious, Browse Filename: R_018996_GRUPO OCLEM_RCL181378_SEPTEMBER_2022.exe, Detection: malicious, Browse Filename: 351521.exe, Detection: malicious, Browse Filename: Skaanebetrkkenes.exe, Detection: malicious, Browse Filename: 351521.exe, Detection: malicious, Browse Filename: Skaanebetrkkenes.exe, Detection: malicious, Browse Filename: ORDEM N#U00ba 78341.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L......]...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Contentness\Filialbestyrerens\Talkability\Platybrachycephalous\Plugin_Status.ini

Download File

Process:	C:\Users\user\Desktop\XShSI2OXaC.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	3.52328456258532
Encrypted:	false
SSDEEP:	3:Q++l3293myVfslYx5hev/LmRlfVRlVl:Q++lQWyVkixm3up
MD5:	4F9A42DF26A7D4555300076765236140
SHA1:	1F97D929B2FEC9B8171BC8433F046753E66A10A9
SHA-256:	35BFF73B98E198313A09FDC972F7E9F16014C7E96ACA96A094510D3F6462473C
SHA-512:	26C627C99A9F1BE9C311C3B185A258BC5FE2DF9DB3AB7657BB2582940C185252AB586F6F20A8086E530D4A946BD9DF495F0C43C4C9259225945E16AC61AF5C00
Malicious:	false
Reputation:	low
Preview:	..[.A.R.M.O.U.R.Y. .C.R.A.T.E. .S.T.A.T.U.S.].....A.u.r.a.P.l.u.g.I.n._.V.e.r.s.i.o.n.=.4...0...0...0.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Contentness\Filialbestyrerens\Talkability\Platybrachycephalous\vfslog.c

Download File

Process:	C:\Users\user\Desktop\XShSI2OXaC.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	22849
Entropy (8bit):	5.11077967265171
Encrypted:	false
SSDEEP:	384:mF+fT69ihYf2GM4R07AZI5dNkWb5jaxZBqOVSSZREtMOPSXCm:mf6AZINJb5jaxDqRSZgk
MD5:	1C9F1050DD84B2B185741F28309D3B30
SHA1:	740C9AAFF5D67D3254239B5509D613E4BE9B5B85
SHA-256:	669D3FF0B8649789381CDBB589746248898AFB4EBC2053952E57EB9475F5064A
SHA-512:	4A568558B4EF9ED4CA579E8DFBB0FDFFFFE6A442AE11E1FF48E1DB93267469BF66BC3B10DA3397A30C362E4F4CE0A1367E6266D0A78BC61060C103BB4625A1CF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/.* 2013-10-09.. The author disclaims copyright to this source code. In place of. a legal notice, here is a blessing:.. May you do good and not evil.. May you find forgiveness for yourself and forgive others.. May you share freely, never taking more than you give...****************************************************************************.. This file contains the implementation of an SQLite vfs wrapper for. unix that generates per-database log files of all disk activity../../. This module contains code for a wrapper VFS that causes a log of. most VFS calls to be written into a file on disk... Each database connection creates a separate log file in the same. directory as the original database and named after the original. database. A unique suffix is added to avoid name collisions. . Separate log files are used so that concurrent processes do not. try to write log operations to the same file at the same instant, .** resulting in

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Coronoid.Ano

Download File

Process:	C:\Users\user\Desktop\XShSI2OXaC.exe
File Type:	data
Category:	dropped
Size (bytes):	169398
Entropy (8bit):	6.943066252449536
Encrypted:	false
SSDEEP:	1536:kYNzSfaJrHw2kpeuoo3koyTLZbsBnqxlkTfIYsZYR0JY6nue2HSPKb4aBSBXPVso:OaRSpXo/DLZe9rlsU0JDnUAKb4USV2M
MD5:	41A2DEFADC6A543205116432277F62D5
SHA1:	FEBF4BE1B62529495501EAECE3E4691342F021C7
SHA-256:	13DC3B2288380DB05CF9DDFA1EEBB66DB7C01035D3B895242824BC7CE2E6DC55
SHA-512:	3C548C50A93B730B903A1EBEB65DC73C07238E56F2EFBCFFA986B8A63C4628FA677A157A0C3AE52123B2FA21FEFBF2966EEB7E0646EB43A4EEC9A25D035D86CC
Malicious:	false
Preview:	.../.{....kD..>...I^{..h.}:).v}..e....D(.\|Y).....j.....?.nA..0..m..>.r...V..'j1.=.......d...../s.+8..@.0.j...?6g,^v..:....mF...P4.O....BM.s..,mq.u....!2L..h..p..h.%:wm..GH.K.....S..}....hB.N.=.E0)....S.@2..Q5.T...m.].}...cYqL......_....s.....S....4..hs...T..R...R?%.=.s.@N...Q..F...!.a......."...M....[3..-.....h....xe.M........5$..d\|.c.;...T.S..SE.V.]...?a...0.l...!"..Rc..y.-1....[.Ou...c./UOEf.}T]..?r.[A...F..F@:..\|-x".........k....ll"4.pY.....0.j..3.I....J6.P..2.(.Js..U:...N..Qp..e.....Q.uLF...Xg..*.4..x.....j>W.m.t.X..\.w.H:)y......}....v.<..y..q1.{..&f/...h.......vh..d.(..vi...._......E.q..'N.uHKt9Y.R.#:m.\|.S..FLU9`.,N...S{.6l....frgH.Q..r..1...;Y.->..e7:2)k@-S.P....\...6.(m.xm.C.H..&R.<3An.n..B....N.z}...\mX`...^!..(@.Y.I..QKk...Ik..A@Z....>T.Pp.~./...F.(..q.<b"%......;XO...W......".4..UA._.=.\|..\|.......at_....^..%!...K..\.b..S.,..R...[..2i..!.c.hs9]1za.X.F-o\...q..L...a..6.q....l.l..Y...V.T.J.7..{..@&.%v....T]..R..b..B...D...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen\view-more-horizontal-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\XShSI2OXaC.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	136
Entropy (8bit):	5.506031499655005
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBll8xn9gR5XfixtIS2kj7QJ/lsg1p:6v/lhPys6aorIStC2up
MD5:	1E05E353B63930E92518EC5136819E9E
SHA1:	82E22F6A10959DDF998F17799BC8257528DF9C8E
SHA-256:	8E686112200E526D3928BF2F717A00B2E6EC74826AB3DC3AB63F7B5D6F760348
SHA-512:	E2896BB1D9C1514C7F6E6A60F4E1614FEF8DCBE774AEE4FA977C7DE91BBF37DDE6D45ECA73730082182226B8D3F755A06528FF57C4294F7F1AAD50910FB7A39E
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....?IDAT8.c`....x200<b``x....A..c....P..I!Q.L...7...S...'P.+>........_Di>.....IEND.B`.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.775192199206559
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XShSI2OXaC.exe
File size:	192936
MD5:	b69c9170ffab277e1bd13fde891a5ae5
SHA1:	8928e5d360edbecd1547cf61831d4f055bed92af
SHA256:	a81489460818664146f756543f081b702bcb69244ebf8f6a240b02b2357c577c
SHA512:	0bf095bdc0bd8c0898952e83249930fd02f68415915681a11cfed7276f7949384ed8cea8ee2339dfd567ca298402768e86a6e795086629c642c11a9d932d0196
SSDEEP:	3072:PSrFD0QAGq6muqIpb5Hp15W0Om6GHAPulczSd8/Zjx5lY8pV+DdhLeWxSbTEZfSu:7QA4WaniPVSd8xflY8Ygmjd
TLSH:	8214F1513AB0E507ED275A3118796F273FF1791A19918B0B6350BBAA7D23380866F31F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV._...PV..PW.MPV._...PV..sf..PV..VP..PV.Rich.PV.........PE..L......].................f...*.......5............@

File Icon


Icon Hash:	f4f0d0dc4cccdcd4

Static PE Info

General

Entrypoint:	0x40350d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DF6D4ED [Mon Dec 16 00:50:53 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	24f4223e271413c25abad52fd456a9bc

Authenticode Signature

Signature Valid:	false
Signature Issuer:	OU="Mesterlig Efterbehandlingen Buggy ", E=rykninger@Vasks.Ud, O=Professionalisere, L=Paris 14, S=\xcele-de-France, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	11/2/2022 4:13:09 PM 11/1/2025 4:13:09 PM
Subject Chain	OU="Mesterlig Efterbehandlingen Buggy ", E=rykninger@Vasks.Ud, O=Professionalisere, L=Paris 14, S=\xcele-de-France, C=FR
Version:	3
Thumbprint MD5:	C6482E31BD649A8F80BC03910D4D9041
Thumbprint SHA-1:	D014D5D190B882F8D11FE7402087EB970E60A7DB
Thumbprint SHA-256:	44451256F3DBCD4B695F950230470C038611B2648483EF95256B6744B7A32134
Serial:	08753235BB3B561B

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F6E64BD9BC3h
push ebx
call 00007F6E64BDCE97h
cmp eax, ebx
je 00007F6E64BD9BB9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F6E64BDCE11h
push esi
call dword ptr [00408154h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F6E64BD9B9Ch
push 0000000Ah
call 00007F6E64BDCE6Ah
push 00000008h
call 00007F6E64BDCE63h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F6E64BDCE57h
cmp eax, ebx
je 00007F6E64BD9BC1h
push 0000001Eh
call eax
test eax, eax
je 00007F6E64BD9BB9h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408040h]
push ebx
call dword ptr [0040829Ch]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408184h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x65000	0x36e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2d280	0x1f28	.ndata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x647b	0x6600	False	0.6578967524509803	data	6.426522741823245	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1384	0x1400	False	0.45	data	5.136348990166042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	False	0.5032552083333334	data	4.005849468822358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x3a000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x65000	0x36e0	0x3800	False	0.44998604910714285	data	5.471517583781187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x652b0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States
RT_ICON	0x65618	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_DIALOG	0x67bc0	0x144	data	English	United States
RT_DIALOG	0x67d08	0x13c	data	English	United States
RT_DIALOG	0x67e48	0x100	data	English	United States
RT_DIALOG	0x67f48	0x11c	data	English	United States
RT_DIALOG	0x68068	0xc4	data	English	United States
RT_DIALOG	0x68130	0x60	data	English	United States
RT_GROUP_ICON	0x68190	0x14	data	English	United States
RT_VERSION	0x681a8	0x1f4	data	English	United States
RT_MANIFEST	0x683a0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, MoveFileW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, lstrcmpW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, DeleteFileW, FindFirstFileW, FindNextFileW, FindClose, SetFilePointer, ReadFile, MulDiv, lstrlenA, WideCharToMultiByte, MultiByteToWideChar, WritePrivateProfileStringW, FreeLibrary, GetPrivateProfileStringW, GetModuleHandleW, LoadLibraryExW
USER32.dll	GetWindowRect, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, ScreenToClient, EnableMenuItem, GetDlgItem, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, SystemParametersInfoW, EndDialog, RegisterClassW, DialogBoxParamW, CreateWindowExW, GetClassInfoW, DestroyWindow, CharNextW, ExitWindowsEx, SetWindowTextW, LoadImageW, SetTimer, ShowWindow, PostQuitMessage, wsprintfW, SetWindowLongW, FindWindowExW, IsWindow, CreatePopupMenu, AppendMenuW, GetSystemMetrics, DrawTextW, EndPaint, CreateDialogParamW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetTextColor, SetBkMode, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
SHELL32.dll	ShellExecuteExW, SHGetPathFromIDListW, SHGetSpecialFolderLocation, SHGetFileInfoW, SHFileOperationW, SHBrowseForFolderW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: XShSI2OXaC.exePID: 5820, Parent PID: 3452

General

Target ID:	0
Start time:	12:41:19
Start date:	03/11/2022
Path:	C:\Users\user\Desktop\XShSI2OXaC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\XShSI2OXaC.exe
Imagebase:	0x400000
File size:	192936 bytes
MD5 hash:	B69C9170FFAB277E1BD13FDE891A5AE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.777436198.0000000003220000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: XShSI2OXaC.exePID: 5820, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.2%
Total number of Nodes:	1588
Total number of Limit Nodes:	48

Executed Functions

Function 0040350D Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_() {
				signed int _t51;
				intOrPtr* _t56;
				WCHAR* _t60;
				char* _t62;
				void* _t65;
				void* _t67;
				int _t69;
				int _t71;
				int _t74;
				intOrPtr* _t75;
				int _t76;
				int _t78;
				void* _t102;
				signed int _t119;
				void* _t122;
				void* _t127;
				intOrPtr _t146;
				intOrPtr _t147;
				intOrPtr* _t148;
				int _t150;
				void* _t153;
				int _t154;
				signed int _t158;
				signed int _t163;
				signed int _t168;
				void* _t170;
				WCHAR* _t171;
				signed int _t174;
				signed int _t177;
				CHAR* _t178;
				void* _t181;
				int* _t183;
				void* _t191;
				char* _t192;
				void* _t195;
				void* _t196;
				void* _t242;

				_t170 = 0x20;
				_t150 = 0;
				 *(_t196 + 0x14) = 0;
				 *(_t196 + 0x10) = L"Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t196 + 0x1c) = 0;
				SetErrorMode(0x8001); // executed
				_t51 = GetVersion() & 0xbfffffff;
				 *0x42a24c = _t51;
				if(_t51 != 6) {
					_t148 = E00406834(0);
					if(_t148 != 0) {
						 *_t148(0xc00);
					}
				}
				_t178 = "UXTHEME";
				goto L4;
				L8:
				__imp__#17(_t191);
				__imp__OleInitialize(_t150); // executed
				 *0x42a318 = _t56;
				SHGetFileInfoW(0x4216e8, _t150, _t196 + 0x34, 0x2b4, _t150); // executed
				E0040645A(0x429240, L"NSIS Error");
				_t60 = GetCommandLineW();
				_t192 = L"\"C:\\Users\\hardz\\Desktop\\XShSI2OXaC.exe\"";
				E0040645A(_t192, _t60);
				 *0x42a240 = 0x400000;
				_t62 = _t192;
				if(L"\"C:\\Users\\hardz\\Desktop\\XShSI2OXaC.exe\"" == 0x22) {
					_t62 =  &M00435002;
					_t170 = 0x22;
				}
				_t154 = CharNextW(E00405D5C(_t62, _t170));
				 *(_t196 + 0x18) = _t154;
				_t65 =  *_t154;
				if(_t65 == _t150) {
					L33:
					_t171 = L"C:\\Users\\hardz\\AppData\\Local\\Temp\\";
					GetTempPathW(0x400, _t171);
					_t67 = E004034DC(_t154, 0);
					_t224 = _t67;
					if(_t67 != 0) {
						L36:
						DeleteFileW(L"1033"); // executed
						_t69 = E00402F9D(_t226,  *(_t196 + 0x1c)); // executed
						 *(_t196 + 0x10) = _t69;
						if(_t69 != _t150) {
							L48:
							E00403A4E();
							__imp__OleUninitialize();
							_t238 =  *(_t196 + 0x10) - _t150;
							if( *(_t196 + 0x10) == _t150) {
								__eflags =  *0x42a2f4 - _t150;
								if( *0x42a2f4 == _t150) {
									L72:
									_t71 =  *0x42a30c;
									__eflags = _t71 - 0xffffffff;
									if(_t71 != 0xffffffff) {
										 *(_t196 + 0x10) = _t71;
									}
									ExitProcess( *(_t196 + 0x10));
								}
								_t74 = OpenProcessToken(GetCurrentProcess(), 0x28, _t196 + 0x14);
								__eflags = _t74;
								if(_t74 != 0) {
									LookupPrivilegeValueW(_t150, L"SeShutdownPrivilege", _t196 + 0x20);
									 *(_t196 + 0x34) = 1;
									 *(_t196 + 0x40) = 2;
									AdjustTokenPrivileges( *(_t196 + 0x28), _t150, _t196 + 0x24, _t150, _t150, _t150);
								}
								_t75 = E00406834(4);
								__eflags = _t75 - _t150;
								if(_t75 == _t150) {
									L70:
									_t76 = ExitWindowsEx(2, 0x80040002);
									__eflags = _t76;
									if(_t76 != 0) {
										goto L72;
									}
									goto L71;
								} else {
									_t78 =  *_t75(_t150, _t150, _t150, 0x25, 0x80040002);
									__eflags = _t78;
									if(_t78 == 0) {
										L71:
										E0040140B(9);
										goto L72;
									}
									goto L70;
								}
							}
							E00405AC0( *(_t196 + 0x10), 0x200010);
							ExitProcess(2);
						}
						if( *0x42a260 == _t150) {
							L47:
							 *0x42a30c =  *0x42a30c | 0xffffffff;
							 *(_t196 + 0x14) = E00403B40( *0x42a30c);
							goto L48;
						}
						_t183 = E00405D5C(_t192, _t150);
						if(_t183 < _t192) {
							L44:
							_t235 = _t183 - _t192;
							 *(_t196 + 0x10) = L"Error launching installer";
							if(_t183 < _t192) {
								_t181 = E00405A2B(_t238);
								lstrcatW(_t171, L"~nsu");
								if(_t181 != _t150) {
									lstrcatW(_t171, "A");
								}
								lstrcatW(_t171, L".tmp");
								_t194 = L"C:\\Users\\hardz\\Desktop";
								if(lstrcmpiW(_t171, L"C:\\Users\\hardz\\Desktop") != 0) {
									_push(_t171);
									if(_t181 == _t150) {
										E00405A0E();
									} else {
										E00405991();
									}
									SetCurrentDirectoryW(_t171);
									_t242 = L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren" - _t150; // 0x43
									if(_t242 == 0) {
										E0040645A(L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren", _t194);
									}
									E0040645A(0x42b000,  *(_t196 + 0x18));
									_t155 = "A" & 0x0000ffff;
									 *0x42b800 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
									_t195 = 0x1a;
									do {
										E0040647C(_t150, _t171, 0x420ee8, 0x420ee8,  *((intOrPtr*)( *0x42a254 + 0x120)));
										DeleteFileW(0x420ee8);
										if( *(_t196 + 0x10) != _t150 && CopyFileW(L"C:\\Users\\hardz\\Desktop\\XShSI2OXaC.exe", 0x420ee8, 1) != 0) {
											E00406220(_t155, 0x420ee8, _t150);
											E0040647C(_t150, _t171, 0x420ee8, 0x420ee8,  *((intOrPtr*)( *0x42a254 + 0x124)));
											_t102 = E00405A43(0x420ee8);
											if(_t102 != _t150) {
												CloseHandle(_t102);
												 *(_t196 + 0x10) = _t150;
											}
										}
										 *0x42b800 =  *0x42b800 + 1;
										_t195 = _t195 - 1;
									} while (_t195 != 0);
									E00406220(_t155, _t171, _t150);
								}
								goto L48;
							}
							 *_t183 = _t150;
							_t184 =  &(_t183[2]);
							if(E00405E37(_t235,  &(_t183[2])) == 0) {
								goto L48;
							}
							E0040645A(L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren", _t184);
							E0040645A(L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren\\Parfaits\\Produktoversigts\\Newcomers\\Igennen", _t184);
							 *(_t196 + 0x10) = _t150;
							goto L47;
						}
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_t158 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
						_t119 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t163 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
						while( *_t183 != _t158 || _t183[1] != _t119) {
							_t183 = _t183;
							if(_t183 >= _t192) {
								continue;
							}
							break;
						}
						_t150 = 0;
						goto L44;
					}
					GetWindowsDirectoryW(_t171, 0x3fb);
					lstrcatW(_t171, L"\\Temp");
					_t122 = E004034DC(_t154, _t224);
					_t225 = _t122;
					if(_t122 != 0) {
						goto L36;
					}
					GetTempPathW(0x3fc, _t171);
					lstrcatW(_t171, L"Low");
					SetEnvironmentVariableW(L"TEMP", _t171);
					SetEnvironmentVariableW(L"TMP", _t171);
					_t127 = E004034DC(_t154, _t225);
					_t226 = _t127;
					if(_t127 == 0) {
						goto L48;
					}
					goto L36;
				} else {
					do {
						_t153 = 0x20;
						if(_t65 != _t153) {
							L13:
							if( *_t154 == 0x22) {
								_t154 = _t154 + 2;
								_t153 = 0x22;
							}
							if( *_t154 != 0x2f) {
								goto L27;
							} else {
								_t154 = _t154 + 2;
								if( *_t154 == 0x53) {
									_t147 =  *((intOrPtr*)(_t154 + 2));
									if(_t147 == 0x20 || _t147 == 0) {
										 *0x42a300 = 1;
									}
								}
								asm("cdq");
								asm("cdq");
								_t168 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t174 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t168;
								if( *_t154 == (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t168) &&  *((intOrPtr*)(_t154 + 4)) == _t174) {
									_t146 =  *((intOrPtr*)(_t154 + 8));
									if(_t146 == 0x20 || _t146 == 0) {
										 *(_t196 + 0x1c) =  *(_t196 + 0x1c) | 0x00000004;
									}
								}
								asm("cdq");
								asm("cdq");
								_t163 = L" /D=" & 0x0000ffff;
								asm("cdq");
								_t177 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t163;
								if( *(_t154 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t163) ||  *_t154 != _t177) {
									goto L27;
								} else {
									 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
									__eflags = _t154;
									E0040645A(L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren", _t154);
									L32:
									_t150 = 0;
									goto L33;
								}
							}
						} else {
							goto L12;
						}
						do {
							L12:
							_t154 = _t154 + 2;
						} while ( *_t154 == _t153);
						goto L13;
						L27:
						_t154 = E00405D5C(_t154, _t153);
						if( *_t154 == 0x22) {
							_t154 = _t154 + 2;
						}
						_t65 =  *_t154;
					} while (_t65 != 0);
					goto L32;
				}
				L4:
				E004067C4(_t178); // executed
				_t178 =  &(_t178[lstrlenA(_t178) + 1]);
				if( *_t178 != 0) {
					goto L4;
				} else {
					E00406834(0xa);
					 *0x42a244 = E00406834(8);
					_t56 = E00406834(6);
					if(_t56 != _t150) {
						_t56 =  *_t56(0x1e);
						if(_t56 != 0) {
							 *0x42a24f =  *0x42a24f | 0x00000040;
						}
					}
					goto L8;
				}
			}

0x00403518
0x00403519
0x00403520
0x00403524
0x0040352c
0x00403530
0x0040353c
0x00403545
0x0040354a
0x0040354d
0x00403554
0x0040355b
0x0040355b
0x00403554
0x0040355d
0x0040355d
0x004035a5
0x004035a6
0x004035ad
0x004035b3
0x004035c9
0x004035d9
0x004035de
0x004035e4
0x004035eb
0x004035f8
0x00403602
0x00403604
0x00403608
0x0040360d
0x0040360d
0x0040361c
0x0040361e
0x00403622
0x00403628
0x0040373f
0x00403745
0x00403750
0x00403752
0x00403757
0x00403759
0x004037b1
0x004037b6
0x004037c0
0x004037c7
0x004037cb
0x0040387c
0x0040387c
0x00403881
0x00403887
0x0040388c
0x004039b2
0x004039b8
0x00403a36
0x00403a36
0x00403a3b
0x00403a3e
0x00403a40
0x00403a40
0x00403a48
0x00403a48
0x004039c8
0x004039ce
0x004039d0
0x004039dd
0x004039f0
0x004039f8
0x00403a00
0x00403a00
0x00403a08
0x00403a0d
0x00403a14
0x00403a22
0x00403a25
0x00403a2b
0x00403a2d
0x00000000
0x00000000
0x00000000
0x00403a16
0x00403a1c
0x00403a1e
0x00403a20
0x00403a2f
0x00403a31
0x00000000
0x00403a31
0x00000000
0x00403a20
0x00403a14
0x0040389b
0x004038a2
0x004038a2
0x004037d7
0x0040386c
0x0040386c
0x00403878
0x00000000
0x00403878
0x004037e4
0x004037e8
0x00403836
0x00403836
0x00403838
0x00403840
0x004038b3
0x004038b5
0x004038bc
0x004038c4
0x004038c4
0x004038cf
0x004038d4
0x004038e3
0x004038e7
0x004038e8
0x004038f1
0x004038ea
0x004038ea
0x004038ea
0x004038f7
0x004038fd
0x00403904
0x0040390c
0x0040390c
0x0040391a
0x00403926
0x00403934
0x00403939
0x0040393f
0x0040394b
0x00403951
0x0040395b
0x00403971
0x00403982
0x00403988
0x0040398f
0x00403992
0x00403998
0x00403998
0x0040398f
0x0040399c
0x004039a3
0x004039a3
0x004039a8
0x004039a8
0x00000000
0x004038e3
0x00403842
0x00403845
0x00403850
0x00000000
0x00000000
0x00403858
0x00403863
0x00403868
0x00000000
0x00403868
0x004037f1
0x00403809
0x0040381a
0x0040381b
0x0040381f
0x00403821
0x0040382f
0x00403832
0x00000000
0x00000000
0x00000000
0x00403832
0x00403834
0x00000000
0x00403834
0x00403761
0x0040376d
0x00403772
0x00403777
0x00403779
0x00000000
0x00000000
0x00403781
0x00403789
0x0040379a
0x004037a2
0x004037a4
0x004037a9
0x004037ab
0x00000000
0x00000000
0x00000000
0x0040362e
0x0040362e
0x00403630
0x00403634
0x0040363d
0x00403641
0x00403646
0x00403647
0x00403647
0x0040364c
0x00000000
0x00403652
0x00403653
0x00403658
0x0040365a
0x00403662
0x00403669
0x00403669
0x00403662
0x0040367a
0x0040368d
0x0040368e
0x004036a3
0x004036a8
0x004036ac
0x004036b5
0x004036bd
0x004036c4
0x004036c4
0x004036bd
0x004036d0
0x004036e3
0x004036e4
0x004036f9
0x004036ff
0x00403703
0x00000000
0x0040372a
0x0040372a
0x0040372f
0x00403738
0x0040373d
0x0040373d
0x00000000
0x0040373d
0x00403703
0x00000000
0x00000000
0x00000000
0x00403636
0x00403636
0x00403637
0x00403638
0x00000000
0x0040370b
0x00403712
0x00403718
0x0040371b
0x0040371b
0x0040371c
0x0040371f
0x00000000
0x00403728
0x00403562
0x00403563
0x0040356f
0x00403576
0x00000000
0x00403578
0x0040357a
0x00403588
0x0040358d
0x00403594
0x00403598
0x0040359c
0x0040359e
0x0040359e
0x0040359c
0x00000000
0x00403594

APIs

SetErrorMode.KERNELBASE ref: 00403530
GetVersion.KERNEL32 ref: 00403536
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403569
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 004035A6
OleInitialize.OLE32(00000000), ref: 004035AD
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 004035C9
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004035DE
CharNextW.USER32(00000000,"C:\Users\user\Desktop\XShSI2OXaC.exe",00000020,"C:\Users\user\Desktop\XShSI2OXaC.exe",00000000,?,00000006,00000008,0000000A), ref: 00403616

Part of subcall function 00406834: GetModuleHandleA.KERNEL32(?,00000020,?,0040357F,0000000A), ref: 00406846
Part of subcall function 00406834: GetProcAddress.KERNEL32(00000000,?), ref: 00406861

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403750
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 00403761
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040376D
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403781
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403789
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040379A
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004037A2
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004037B6

Part of subcall function 0040645A: lstrcpynW.KERNEL32(?,?,00000400,004035DE,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00406467

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403881
ExitProcess.KERNEL32 ref: 004038A2
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 004038B5
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 004038C4
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 004038CF
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\XShSI2OXaC.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 004038DB
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004038F7
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 00403951
CopyFileW.KERNEL32(C:\Users\user\Desktop\XShSI2OXaC.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 00403965
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 00403992
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 004039C1
OpenProcessToken.ADVAPI32(00000000), ref: 004039C8
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004039DD
AdjustTokenPrivileges.ADVAPI32 ref: 00403A00
ExitWindowsEx.USER32 ref: 00403A25
ExitProcess.KERNEL32 ref: 00403A48

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403524
.tmp, xrefs: 004038C9
Error launching installer, xrefs: 00403838
NSIS Error, xrefs: 004035CF
SeShutdownPrivilege, xrefs: 004039D7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren, xrefs: 00403733, 00403853, 004038FD, 00403907
"C:\Users\user\Desktop\XShSI2OXaC.exe", xrefs: 004035E4, 004035EA, 004037DE
TMP, xrefs: 0040379D
1033, xrefs: 004037B1
\Temp, xrefs: 00403767
UXTHEME, xrefs: 0040355D, 00403562, 00403568
C:\Users\user\Desktop\XShSI2OXaC.exe, xrefs: 00403960
C:\Users\user\Desktop, xrefs: 004038D4, 004038D9, 00403906
Low, xrefs: 00403783
C:\Users\user\AppData\Local\Temp\, xrefs: 00403745, 0040374A, 00403760, 0040376C, 0040377B, 00403788, 00403794, 0040379C, 004038B2, 004038C3, 004038CE, 004038DA, 004038E7, 004038F6, 004039A7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen, xrefs: 0040385E
~nsu, xrefs: 004038AD
TEMP, xrefs: 00403795

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\XShSI2OXaC.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen$C:\Users\user\Desktop$C:\Users\user\Desktop\XShSI2OXaC.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-566025169
Opcode ID: 3e8747d56691bb26e08fa747eae0a3977ccf601b63c92c55a4794589a7caad5d
Instruction ID: 4cab6859f2c1af7d00cb4a4359f450754b474d2827a13810a9f88dd282f2012a
Opcode Fuzzy Hash: 3e8747d56691bb26e08fa747eae0a3977ccf601b63c92c55a4794589a7caad5d
Instruction Fuzzy Hash: 49D10371600310ABD720BF659D49B2B3AE8EB40749F50843FF981B62E2DB7D8945C66E

Uniqueness

Uniqueness Score: -1.00%

Function 73791B5F Relevance: 20.1, APIs: 13, Instructions: 597
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E73791B5F() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				WCHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				WCHAR* _t208;
				signed int _t211;
				void* _t213;
				void* _t215;
				WCHAR* _t217;
				void* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t227;
				struct HINSTANCE__* _t229;
				signed short _t231;
				struct HINSTANCE__* _t234;
				struct HINSTANCE__* _t236;
				void* _t237;
				intOrPtr* _t238;
				void* _t249;
				signed char _t250;
				signed int _t251;
				void* _t255;
				struct HINSTANCE__* _t257;
				void* _t258;
				signed int _t260;
				signed int _t261;
				signed short* _t264;
				signed int _t269;
				signed int _t272;
				signed int _t274;
				void* _t277;
				void* _t281;
				struct HINSTANCE__* _t283;
				signed int _t286;
				void _t287;
				signed int _t288;
				signed int _t300;
				signed int _t301;
				signed short _t304;
				void* _t305;
				signed int _t309;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed short* _t321;
				WCHAR* _t322;
				WCHAR* _t324;
				WCHAR* _t325;
				struct HINSTANCE__* _t326;
				void* _t328;
				signed int _t331;
				void* _t332;

				_t283 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t332 = 0;
				_v52 = 0;
				_v44 = 0;
				_t208 = E7379121B();
				_v24 = _t208;
				_v28 = _t208;
				_v48 = E7379121B();
				_t321 = E73791243();
				_v56 = _t321;
				_v12 = _t321;
				while(1) {
					_t211 = _v32;
					_v60 = _t211;
					if(_t211 != _t283 && _t332 == _t283) {
						break;
					}
					_t286 =  *_t321 & 0x0000ffff;
					_t213 = _t286 - _t283;
					if(_t213 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t215 = _v60 - _t283;
						if(_t215 == 0) {
							__eflags = _t332 - _t283;
							 *_v28 = _t283;
							if(_t332 == _t283) {
								_t255 = GlobalAlloc(0x40, 0x1ca4); // executed
								_t332 = _t255;
								 *(_t332 + 0x1010) = _t283;
								 *(_t332 + 0x1014) = _t283;
							}
							_t287 = _v36;
							_t47 = _t332 + 8; // 0x8
							_t217 = _t47;
							_t48 = _t332 + 0x808; // 0x808
							_t322 = _t48;
							 *_t332 = _t287;
							_t288 = _t287 - _t283;
							__eflags = _t288;
							 *_t217 = _t283;
							 *_t322 = _t283;
							 *(_t332 + 0x1008) = _t283;
							 *(_t332 + 0x100c) = _t283;
							 *(_t332 + 4) = _t283;
							if(_t288 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t328 = 0;
								GlobalFree(_t332);
								_t332 = E73791311(_v24);
								__eflags = _t332 - _t283;
								if(_t332 == _t283) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t249 =  *(_t332 + 0x1ca0);
									__eflags = _t249 - _t283;
									if(_t249 == _t283) {
										break;
									}
									_t328 = _t332;
									_t332 = _t249;
									__eflags = _t332 - _t283;
									if(_t332 != _t283) {
										continue;
									}
									break;
								}
								__eflags = _t328 - _t283;
								if(_t328 != _t283) {
									 *(_t328 + 0x1ca0) = _t283;
								}
								_t250 =  *(_t332 + 0x1010);
								__eflags = _t250 & 0x00000008;
								if((_t250 & 0x00000008) == 0) {
									_t251 = _t250 | 0x00000002;
									__eflags = _t251;
									 *(_t332 + 0x1010) = _t251;
								} else {
									_t332 = E7379158F(_t332);
									 *(_t332 + 0x1010) =  *(_t332 + 0x1010) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t300 = _t288 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									L31:
									lstrcpyW(_t217, _v48);
									L32:
									lstrcpyW(_t322, _v24);
									goto L42;
								}
								_t301 = _t300 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									goto L32;
								}
								__eflags = _t301 != 1;
								if(_t301 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t215 == 1) {
								_t257 = _v16;
								if(_v40 == _t283) {
									_t257 = _t257 - 1;
								}
								 *(_t332 + 0x1014) = _t257;
							}
							L42:
							_v12 = _v12 + 2;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t321 = _v12;
								continue;
							}
							break;
						}
					}
					_t258 = _t213 - 0x23;
					if(_t258 == 0) {
						__eflags = _t321 - _v56;
						if(_t321 <= _v56) {
							L17:
							__eflags = _v44 - _t283;
							if(_v44 != _t283) {
								L43:
								_t260 = _v32 - _t283;
								__eflags = _t260;
								if(_t260 == 0) {
									_t261 = _t286;
									while(1) {
										__eflags = _t261 - 0x22;
										if(_t261 != 0x22) {
											break;
										}
										_t321 =  &(_t321[1]);
										__eflags = _v44 - _t283;
										_v12 = _t321;
										if(_v44 == _t283) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[0]);
											 *_v28 =  *_t321;
											L58:
											_t331 =  &(_t321[1]);
											__eflags = _t331;
											_v12 = _t331;
											goto L59;
										}
										_t261 =  *_t321 & 0x0000ffff;
										_v44 = _t283;
									}
									__eflags = _t261 - 0x2a;
									if(_t261 == 0x2a) {
										_v36 = 2;
										L57:
										_t321 = _v12;
										_v28 = _v24;
										_t283 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t261 - 0x2d;
									if(_t261 == 0x2d) {
										L151:
										_t304 =  *_t321;
										__eflags = _t304 - 0x2d;
										if(_t304 != 0x2d) {
											L154:
											_t264 =  &(_t321[1]);
											__eflags =  *_t264 - 0x3a;
											if( *_t264 != 0x3a) {
												goto L162;
											}
											__eflags = _t304 - 0x2d;
											if(_t304 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t264;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 = _t283;
											} else {
												 *_v28 = _t283;
												lstrcpyW(_v48, _v24);
											}
											goto L57;
										}
										_t264 =  &(_t321[1]);
										__eflags =  *_t264 - 0x3e;
										if( *_t264 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t261 - 0x3a;
									if(_t261 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t269 = _t260 - 1;
								__eflags = _t269;
								if(_t269 == 0) {
									L80:
									_t305 = _t286 + 0xffffffde;
									__eflags = _t305 - 0x55;
									if(_t305 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t305 + 0x73792348) & 0x000000ff) * 4 +  &M737922BC))) {
										case 0:
											__ecx = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												L131:
												__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
												if( *((intOrPtr*)(__edi + 2)) != __dx) {
													L136:
													 *__ecx =  *__ecx & 0x00000000;
													__eax = E7379122C(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __ax;
												if(__ax == 0) {
													goto L136;
												}
												__eflags = __ax - __dx;
												if(__ax == __dx) {
													__edi = __edi + 1;
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__ax =  *__edi;
												 *__ecx =  *__edi;
												__ecx = __ecx + 1;
												__ecx = __ecx + 1;
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 2;
											__ebx = E7379121B();
											 &_v12 = E73791AE6( &_v12);
											__eax = E73791470(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E73791AE6( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t271 =  *(_t332 + 0x1014);
											__eflags = _t271 - _v16;
											if(_t271 > _v16) {
												_v16 = _t271;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t271 - (_v36 == 3);
											if(_t271 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E73791AE6( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(4);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x7379405c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x1018) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x1028) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E73791AE6( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x101c)) = _v8;
												_t136 = _v16 + 0x81; // 0x81
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x1030)) = 0;
												 *((intOrPtr*)(__edi + 0x102c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x102c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x1030; // 0x1030
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t272 = _t269 - 1;
								__eflags = _t272;
								if(_t272 == 0) {
									_v16 = _t283;
									goto L80;
								}
								__eflags = _t272 != 1;
								if(_t272 != 1) {
									goto L162;
								}
								__eflags = _t286 - 0x6e;
								if(__eflags > 0) {
									_t309 = _t286 - 0x72;
									__eflags = _t309;
									if(_t309 == 0) {
										_push(4);
										L74:
										_pop(_t274);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t332 + 0x1010;
											 *_t96 =  *(_t332 + 0x1010) &  !_t274;
											__eflags =  *_t96;
										} else {
											 *(_t332 + 0x1010) =  *(_t332 + 0x1010) | _t274;
										}
										_v8 = 1;
										goto L57;
									}
									_t312 = _t309 - 1;
									__eflags = _t312;
									if(_t312 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t312 != 0;
									if(_t312 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t315 = _t286 - 0x21;
								__eflags = _t315;
								if(_t315 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t316 = _t315 - 0x11;
								__eflags = _t316;
								if(_t316 == 0) {
									_t274 = 0x100;
									goto L75;
								}
								_t317 = _t316 - 0x31;
								__eflags = _t317;
								if(_t317 == 0) {
									_t274 = 1;
									goto L75;
								}
								__eflags = _t317 != 0;
								if(_t317 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t283;
								_v36 = _t283;
								goto L20;
							}
						}
						__eflags =  *((short*)(_t321 - 2)) - 0x3a;
						if( *((short*)(_t321 - 2)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t283;
						if(_v32 == _t283) {
							goto L43;
						}
						goto L17;
					}
					_t277 = _t258 - 5;
					if(_t277 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t283;
							_v20 = _t283;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t283;
							goto L20;
						}
					}
					_t281 = _t277 - 1;
					if(_t281 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t283;
							_v20 = _t283;
							goto L20;
						}
					}
					if(_t281 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t332 == _t283 ||  *(_t332 + 0x100c) != _t283) {
					L182:
					return _t332;
				} else {
					_t225 =  *_t332 - 1;
					if(_t225 == 0) {
						_t187 = _t332 + 8; // 0x8
						_t324 = _t187;
						__eflags =  *_t324 - _t283;
						if( *_t324 != _t283) {
							_t226 = GetModuleHandleW(_t324);
							__eflags = _t226 - _t283;
							 *(_t332 + 0x1008) = _t226;
							if(_t226 != _t283) {
								L171:
								_t192 = _t332 + 0x808; // 0x808
								_t325 = _t192;
								_t227 = E7379161D( *(_t332 + 0x1008), _t325);
								__eflags = _t227 - _t283;
								 *(_t332 + 0x100c) = _t227;
								if(_t227 == _t283) {
									__eflags =  *_t325 - 0x23;
									if( *_t325 == 0x23) {
										_t195 = _t332 + 0x80a; // 0x80a
										_t231 = E73791311(_t195);
										__eflags = _t231 - _t283;
										if(_t231 != _t283) {
											__eflags = _t231 & 0xffff0000;
											if((_t231 & 0xffff0000) == 0) {
												 *(_t332 + 0x100c) = GetProcAddress( *(_t332 + 0x1008), _t231 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t283;
								if(_v52 != _t283) {
									L178:
									_t325[lstrlenW(_t325)] = 0x57;
									_t229 = E7379161D( *(_t332 + 0x1008), _t325);
									__eflags = _t229 - _t283;
									if(_t229 != _t283) {
										L166:
										 *(_t332 + 0x100c) = _t229;
										goto L182;
									}
									__eflags =  *(_t332 + 0x100c) - _t283;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t206 = _t332 + 4;
									 *_t206 =  *(_t332 + 4) | 0xffffffff;
									__eflags =  *_t206;
									goto L182;
								} else {
									__eflags =  *(_t332 + 0x100c) - _t283;
									if( *(_t332 + 0x100c) != _t283) {
										goto L182;
									}
									goto L178;
								}
							}
							_t234 = LoadLibraryW(_t324);
							__eflags = _t234 - _t283;
							 *(_t332 + 0x1008) = _t234;
							if(_t234 == _t283) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t332 + 0x808; // 0x808
						_t236 = E73791311(_t188);
						 *(_t332 + 0x100c) = _t236;
						__eflags = _t236 - _t283;
						goto L180;
					}
					_t237 = _t225 - 1;
					if(_t237 == 0) {
						_t185 = _t332 + 0x808; // 0x808
						_t238 = _t185;
						__eflags =  *_t238 - _t283;
						if( *_t238 == _t283) {
							goto L182;
						}
						_t229 = E73791311(_t238);
						L165:
						goto L166;
					}
					if(_t237 != 1) {
						goto L182;
					}
					_t81 = _t332 + 8; // 0x8
					_t284 = _t81;
					_t326 = E73791311(_t81);
					 *(_t332 + 0x1008) = _t326;
					if(_t326 == 0) {
						goto L181;
					}
					 *(_t332 + 0x104c) =  *(_t332 + 0x104c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1050)) = E7379122C(_t284);
					 *(_t332 + 0x103c) =  *(_t332 + 0x103c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1048)) = 1;
					 *((intOrPtr*)(_t332 + 0x1038)) = 1;
					_t90 = _t332 + 0x808; // 0x808
					_t229 =  *(_t326->i + E73791311(_t90) * 4);
					goto L165;
				}
			}

0x73791b67
0x73791b6a
0x73791b6d
0x73791b70
0x73791b73
0x73791b76
0x73791b79
0x73791b7b
0x73791b7e
0x73791b81
0x73791b86
0x73791b89
0x73791b91
0x73791b99
0x73791b9b
0x73791b9e
0x73791ba6
0x73791ba6
0x73791bab
0x73791bae
0x00000000
0x00000000
0x73791bbb
0x73791bc0
0x73791bc2
0x73791c54
0x73791c54
0x73791c54
0x73791c58
0x73791c5b
0x73791c5d
0x73791c7f
0x73791c81
0x73791c84
0x73791c8d
0x73791c93
0x73791c95
0x73791c9b
0x73791c9b
0x73791ca1
0x73791ca4
0x73791ca4
0x73791ca7
0x73791ca7
0x73791cad
0x73791caf
0x73791caf
0x73791cb1
0x73791cb4
0x73791cb7
0x73791cbd
0x73791cc3
0x73791cc6
0x73791cea
0x73791ced
0x00000000
0x00000000
0x73791cf0
0x73791cf2
0x73791d00
0x73791d03
0x73791d05
0x00000000
0x00000000
0x00000000
0x00000000
0x73791d07
0x73791d07
0x73791d07
0x73791d0d
0x73791d0f
0x00000000
0x00000000
0x73791d11
0x73791d13
0x73791d15
0x73791d17
0x00000000
0x00000000
0x00000000
0x73791d17
0x73791d19
0x73791d1b
0x73791d1d
0x73791d1d
0x73791d23
0x73791d29
0x73791d2b
0x73791d3f
0x73791d3f
0x73791d41
0x73791d2d
0x73791d33
0x73791d36
0x73791d36
0x00000000
0x73791cc8
0x73791cc8
0x73791cc8
0x73791cc9
0x73791cd1
0x73791cd5
0x73791cdb
0x73791cdf
0x00000000
0x73791cdf
0x73791ccb
0x73791ccb
0x73791ccc
0x00000000
0x00000000
0x73791cce
0x73791ccf
0x00000000
0x00000000
0x00000000
0x73791ccf
0x73791c5f
0x73791c60
0x73791c69
0x73791c6c
0x73791c79
0x73791c79
0x73791c6e
0x73791c6e
0x73791d47
0x73791d4a
0x73791d4e
0x73791dc1
0x73791dc5
0x73791ba3
0x00000000
0x73791ba3
0x00000000
0x73791dc5
0x73791c5d
0x73791bc8
0x73791bcb
0x73791c2e
0x73791c31
0x73791c43
0x73791c43
0x73791c46
0x73791d53
0x73791d56
0x73791d56
0x73791d58
0x7379210e
0x73792126
0x73792126
0x73792129
0x00000000
0x00000000
0x73792113
0x73792114
0x73792117
0x7379211a
0x737921a4
0x737921ab
0x737921b1
0x737921b5
0x73791dbc
0x73791dbd
0x73791dbd
0x73791dbe
0x00000000
0x73791dbe
0x73792120
0x73792123
0x73792123
0x7379212b
0x7379212e
0x73792198
0x73791db1
0x73791db4
0x73791db7
0x73791dba
0x73791dba
0x00000000
0x73791dba
0x73792130
0x73792133
0x7379213a
0x7379213a
0x7379213d
0x73792141
0x73792155
0x73792155
0x73792158
0x7379215c
0x00000000
0x00000000
0x7379215e
0x73792162
0x00000000
0x00000000
0x73792164
0x7379216b
0x7379216b
0x73792171
0x73792174
0x73792190
0x73792176
0x7379217f
0x73792182
0x73792182
0x00000000
0x73792174
0x73792143
0x73792146
0x7379214a
0x00000000
0x00000000
0x7379214c
0x00000000
0x7379214c
0x73792135
0x73792138
0x00000000
0x00000000
0x00000000
0x73792138
0x73791d5e
0x73791d5e
0x73791d5f
0x73791ea9
0x73791ea9
0x73791eb0
0x73791eb3
0x00000000
0x00000000
0x73791ec0
0x00000000
0x737920ab
0x737920ae
0x737920b1
0x737920b1
0x737920b2
0x737920b3
0x737920b6
0x737920b9
0x737920bc
0x00000000
0x00000000
0x737920be
0x737920be
0x737920c2
0x737920da
0x737920dd
0x737920e1
0x737920e7
0x00000000
0x737920e7
0x737920c4
0x737920c4
0x737920c7
0x00000000
0x00000000
0x737920c9
0x737920cc
0x737920ce
0x737920cf
0x737920cf
0x737920cf
0x737920d0
0x737920d3
0x737920d6
0x737920d7
0x737920b1
0x737920b2
0x737920b3
0x737920b6
0x737920b9
0x737920bc
0x00000000
0x00000000
0x00000000
0x737920bc
0x00000000
0x73791f07
0x00000000
0x00000000
0x73791f13
0x00000000
0x00000000
0x73791efa
0x73791efe
0x73791f02
0x00000000
0x00000000
0x7379207c
0x73792080
0x00000000
0x00000000
0x73792086
0x7379208f
0x73792096
0x7379209e
0x00000000
0x00000000
0x73791fe3
0x73791fe3
0x00000000
0x00000000
0x73791f1c
0x00000000
0x00000000
0x73792106
0x00000000
0x00000000
0x73791feb
0x73791fed
0x73791fed
0x00000000
0x00000000
0x737920f6
0x00000000
0x00000000
0x737920fa
0x00000000
0x00000000
0x73792102
0x00000000
0x00000000
0x73792033
0x73792035
0x73792035
0x00000000
0x00000000
0x73791ffd
0x73791fff
0x73791fff
0x00000000
0x00000000
0x7379200f
0x73792011
0x73792011
0x00000000
0x00000000
0x73792041
0x73792043
0x73792043
0x00000000
0x00000000
0x7379201a
0x7379201c
0x7379201c
0x00000000
0x00000000
0x73792021
0x00000000
0x00000000
0x737920fe
0x73792108
0x73792108
0x00000000
0x00000000
0x7379204c
0x73792050
0x73792055
0x73792058
0x73792059
0x7379205c
0x73792062
0x73792062
0x00000000
0x00000000
0x737920ee
0x00000000
0x00000000
0x73792025
0x73792027
0x73792027
0x00000000
0x00000000
0x73791f23
0x73791f23
0x00000000
0x00000000
0x7379203a
0x7379203c
0x7379203c
0x00000000
0x00000000
0x73791ec7
0x73791ecd
0x73791ed0
0x73791ed2
0x73791ed2
0x73791ed5
0x73791ed9
0x73791ee6
0x73791ee8
0x73791eee
0x73791eee
0x73791eee
0x00000000
0x00000000
0x73791fee
0x73791fee
0x73791ff0
0x73791ff7
0x00000000
0x00000000
0x73792036
0x73792036
0x00000000
0x00000000
0x73792000
0x73792000
0x73792002
0x73792009
0x00000000
0x00000000
0x73792012
0x73792012
0x73792014
0x00000000
0x00000000
0x73792044
0x73792044
0x00000000
0x00000000
0x7379201d
0x7379201d
0x00000000
0x00000000
0x7379206a
0x7379206e
0x73792073
0x73792076
0x00000000
0x00000000
0x73792028
0x73792028
0x7379202b
0x7379202d
0x00000000
0x00000000
0x7379203d
0x7379203d
0x73792046
0x73792046
0x73791f25
0x73791f25
0x73791f28
0x73791f2f
0x73791f31
0x73791f33
0x73791f3a
0x73791f3d
0x73791f42
0x73791f44
0x73791f46
0x73791f4a
0x73791f50
0x73791f56
0x73791f56
0x73791f58
0x73791f58
0x73791f59
0x73791f59
0x73791f5d
0x73791f63
0x73791f65
0x73791f69
0x73791f6e
0x73791f6e
0x73791f70
0x73791f70
0x73791f73
0x73791f76
0x73791f7f
0x73791f85
0x73791f88
0x73791f88
0x73791f8a
0x73791f8d
0x73791f93
0x73791f99
0x73791f99
0x73791f9b
0x00000000
0x00000000
0x73791fa1
0x73791fa1
0x73791fa5
0x73791fac
0x73791fd0
0x73791fd0
0x73791fd4
0x73791fd6
0x73791fd9
0x73791fd9
0x73791fdc
0x73791fdc
0x00000000
0x73791fd4
0x73791fb1
0x73791fb4
0x73791fb4
0x73791fbb
0x73791fbd
0x73791fc0
0x73791fc7
0x73791fc8
0x73791fce
0x73791fce
0x00000000
0x73791fce
0x73791fc2
0x73791fc5
0x00000000
0x00000000
0x00000000
0x73791fc5
0x73791f52
0x73791f54
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x73791ec0
0x73791d65
0x73791d65
0x73791d66
0x73791ea6
0x00000000
0x73791ea6
0x73791d6c
0x73791d6d
0x00000000
0x00000000
0x73791d73
0x73791d76
0x73791e6b
0x73791e6b
0x73791e6e
0x73791e83
0x73791e85
0x73791e85
0x73791e86
0x73791e89
0x73791e8c
0x73791e98
0x73791e98
0x73791e98
0x73791e8e
0x73791e8e
0x73791e8e
0x73791e9e
0x00000000
0x73791e9e
0x73791e70
0x73791e70
0x73791e71
0x73791e7f
0x00000000
0x73791e7f
0x73791e74
0x73791e75
0x00000000
0x00000000
0x73791e7b
0x00000000
0x73791e7b
0x73791d7c
0x73791e67
0x00000000
0x73791e67
0x73791d82
0x73791d82
0x73791d85
0x73791dae
0x00000000
0x73791dae
0x73791d87
0x73791d87
0x73791d8a
0x73791da4
0x00000000
0x73791da4
0x73791d8c
0x73791d8c
0x73791d8f
0x73791d9e
0x00000000
0x73791d9e
0x73791d92
0x73791d93
0x00000000
0x00000000
0x73791d95
0x00000000
0x73791c4c
0x73791c4c
0x73791c4f
0x00000000
0x73791c4f
0x73791c46
0x73791c33
0x73791c38
0x00000000
0x00000000
0x73791c3a
0x73791c3d
0x00000000
0x00000000
0x00000000
0x73791c3d
0x73791bcd
0x73791bd0
0x73791c06
0x73791c09
0x00000000
0x73791c0f
0x73791c11
0x73791c15
0x73791c1c
0x73791c23
0x73791c26
0x73791c29
0x00000000
0x73791c29
0x73791c09
0x73791bd2
0x73791bd3
0x73791bee
0x73791bf1
0x00000000
0x73791bf7
0x73791bf7
0x73791bfe
0x73791c01
0x00000000
0x73791c01
0x73791bf1
0x73791bd8
0x00000000
0x73791bde
0x73791bde
0x73791be5
0x00000000
0x73791be5
0x73791bd8
0x73791dd4
0x73791dd9
0x73791dde
0x73791de2
0x737922b5
0x737922bb
0x73791df4
0x73791df6
0x73791df7
0x737921de
0x737921de
0x737921e1
0x737921e4
0x73792201
0x73792207
0x73792209
0x7379220f
0x73792226
0x73792226
0x73792226
0x73792233
0x73792239
0x7379223c
0x73792242
0x73792244
0x73792248
0x7379224a
0x73792251
0x73792256
0x73792259
0x7379225b
0x73792260
0x73792272
0x73792272
0x73792260
0x73792259
0x73792248
0x73792278
0x7379227b
0x73792285
0x7379228d
0x7379229a
0x737922a0
0x737922a3
0x737921d3
0x737921d3
0x00000000
0x737921d3
0x737922a9
0x737922af
0x737922af
0x00000000
0x00000000
0x737922b1
0x737922b1
0x737922b1
0x737922b1
0x00000000
0x7379227d
0x7379227d
0x73792283
0x00000000
0x00000000
0x00000000
0x73792283
0x7379227b
0x73792212
0x73792218
0x7379221a
0x73792220
0x00000000
0x00000000
0x00000000
0x73792220
0x737921e6
0x737921ed
0x737921f3
0x737921f9
0x00000000
0x737921f9
0x73791dfd
0x73791dfe
0x737921bd
0x737921bd
0x737921c3
0x737921c6
0x00000000
0x00000000
0x737921cd
0x737921d2
0x00000000
0x737921d2
0x73791e05
0x00000000
0x00000000
0x73791e0b
0x73791e0b
0x73791e14
0x73791e19
0x73791e1f
0x00000000
0x00000000
0x73791e25
0x73791e32
0x73791e38
0x73791e42
0x73791e48
0x73791e50
0x73791e60
0x00000000
0x73791e60

APIs

Part of subcall function 7379121B: GlobalAlloc.KERNELBASE(00000040,?,7379123B,?,737912DF,00000019,737911BE,-000000A0), ref: 73791225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 73791C8D
lstrcpyW.KERNEL32 ref: 73791CD5
lstrcpyW.KERNEL32 ref: 73791CDF
GlobalFree.KERNEL32 ref: 73791CF2
GlobalFree.KERNEL32 ref: 73791DD4
GlobalFree.KERNEL32 ref: 73791DD9
GlobalFree.KERNEL32 ref: 73791DDE
GlobalFree.KERNEL32 ref: 73791FC8
lstrcpyW.KERNEL32 ref: 73792182
GetModuleHandleW.KERNEL32(00000008), ref: 73792201
LoadLibraryW.KERNEL32(00000008), ref: 73792212
GetProcAddress.KERNEL32(?,?), ref: 7379226C
lstrlenW.KERNEL32(00000808), ref: 73792286

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 710dfa2a2fc18798187b1418493b2409fc5e6d1fb740dd281be764461c82215a
Instruction ID: df26b7de61fab0e6cc94a550b246c03fdddc924c8071305559adb54dce677713
Opcode Fuzzy Hash: 710dfa2a2fc18798187b1418493b2409fc5e6d1fb740dd281be764461c82215a
Instruction Fuzzy Hash: 6522BA71D0020EDEEB11DFA4E5843EEB7B5FB08305F12472AD1A7A7280D77496A1CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00405B6C Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405B6C(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405E37(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x42a2e8 =  *0x42a2e8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040645A(0x425730, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405D7B(_t68);
					} else {
						lstrcatW(0x425730, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x425730,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040645A(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405B24(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004054C2(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x42a2e8 =  *0x42a2e8 + 1;
										} else {
											E004054C2(0xfffffff1, _t68);
											E00406220(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405B6C(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x425730 - 0x5c;
					if( *0x425730 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040679D(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405D2F(_t68);
							_t38 = E00405B24(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004054C2(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004054C2(0xfffffff1, _t68);
							return E00406220(_t67, _t68, 0);
						}
						L30:
						 *0x42a2e8 =  *0x42a2e8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405b76
0x00405b7b
0x00405b84
0x00405b87
0x00405b8f
0x00405b92
0x00405b95
0x00405b9d
0x00405b9f
0x00405ba0
0x00000000
0x00405ba0
0x00405bab
0x00405bae
0x00405bae
0x00405bae
0x00405bb2
0x00405bc5
0x00405bcc
0x00405bd1
0x00405bd5
0x00405be5
0x00405bd7
0x00405bdd
0x00405bdd
0x00405bea
0x00405bee
0x00405bfa
0x00405c00
0x00405c05
0x00405c0b
0x00405c16
0x00405c1c
0x00405c1e
0x00405c21
0x00405ccb
0x00405ccb
0x00405ccf
0x00405cd1
0x00405cd1
0x00405cd1
0x00405cd1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c27
0x00405c27
0x00405c27
0x00405c2f
0x00405c4f
0x00405c57
0x00405c5c
0x00405c63
0x00405c7e
0x00405c83
0x00405c85
0x00405ca9
0x00405c87
0x00405c87
0x00405c8a
0x00405c9e
0x00405c8c
0x00405c8f
0x00405c97
0x00405c97
0x00405c8a
0x00405c65
0x00405c6b
0x00405c6d
0x00405c73
0x00405c73
0x00405c6d
0x00000000
0x00405c63
0x00405c31
0x00405c39
0x00000000
0x00000000
0x00405c3b
0x00405c43
0x00000000
0x00000000
0x00405c45
0x00405c4d
0x00000000
0x00000000
0x00000000
0x00405cae
0x00405cb6
0x00405cbc
0x00405cbc
0x00405cc5
0x00000000
0x00405cc5
0x00405bf0
0x00405bf8
0x00000000
0x00000000
0x00000000
0x00405bb4
0x00405bb4
0x00405bb6
0x00405cd6
0x00405cd8
0x00405cdb
0x00405d2c
0x00405d2c
0x00405d2c
0x00405cdd
0x00405ce0
0x00405ceb
0x00405cf0
0x00405cf2
0x00000000
0x00000000
0x00405cf5
0x00405d01
0x00405d06
0x00405d08
0x00000000
0x00405d23
0x00405d0a
0x00405d0d
0x00000000
0x00000000
0x00405d12
0x00000000
0x00405d19
0x00405ce2
0x00405ce2
0x00000000
0x00405ce2
0x00405bbc
0x00405bbf
0x00000000
0x00000000
0x00000000
0x00405bbf

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74D0F560,00000000), ref: 00405B95
lstrcatW.KERNEL32(00425730,\*.*), ref: 00405BDD
lstrcatW.KERNEL32(?,0040A014), ref: 00405C00
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74D0F560,00000000), ref: 00405C06
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,74D0F560,00000000), ref: 00405C16
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405CB6
FindClose.KERNEL32(00000000), ref: 00405CC5

Strings

0WB, xrefs: 00405BC5
\*.*, xrefs: 00405BD7
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B7A
"C:\Users\user\Desktop\XShSI2OXaC.exe", xrefs: 00405B6C

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\XShSI2OXaC.exe"$0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3760886949
Opcode ID: fa8afcd1dee97478ac362939f3da5dc0c7ddce259f9d3963700326c1659e6253
Instruction ID: 234fcbc834c8aed77482227321fda96d9cc50c1e257e6c71739be09b3fb042c5
Opcode Fuzzy Hash: fa8afcd1dee97478ac362939f3da5dc0c7ddce259f9d3963700326c1659e6253
Instruction Fuzzy Hash: EA41E530804B18AAEB216B619D49EAF7AB8EF51319F10813FF801B11D1D77C5982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406B64 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406B64() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00407407))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406b64
0x00406b64
0x00406b69
0x00406be0
0x00406be7
0x00406bf1
0x004071d0
0x004071d0
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00407246
0x00407246
0x0040724c
0x0040724c
0x00000000
0x00407221
0x00407221
0x00407225
0x004073d4
0x00000000
0x004073d4
0x00407231
0x00407238
0x00407240
0x00407243
0x00000000
0x00407243
0x00406b6b
0x00406b6b
0x00406b6f
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b90
0x00406b97
0x00406b9a
0x00406ba5
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb4
0x00406bd2
0x00406bd4
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df9
0x00406dfc
0x00406d9f
0x00406da5
0x00000000
0x00000000
0x00000000
0x00406dfe
0x00406d7a
0x00406d7e
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d9c
0x00000000
0x00406d9c
0x00406bb6
0x00406bb6
0x00406bb9
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca8
0x00406cab
0x00406c22
0x00406c22
0x00406c28
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d35
0x00406d38
0x00406cb6
0x00406cba
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cd8
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d43
0x00406d43
0x00406d46
0x00406d49
0x00406d4d
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00406f0f
0x00406f0f
0x00406f12
0x00406f12
0x00000000
0x00406f12
0x00406c34
0x00000000
0x00000000
0x00000000
0x00406cb1
0x00406bfd
0x00406c01
0x0040736e
0x004073ea
0x004073f2
0x004073f9
0x004073fb
0x00407402
0x00407406
0x00407406
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1f
0x00000000
0x00406c1f
0x00406cab
0x00406bb4
0x004069e8
0x004069e8
0x004069f1
0x004073ff
0x004073ff
0x00000000
0x004073ff
0x004069f7
0x00000000
0x00406a02
0x00000000
0x00000000
0x00406a0b
0x00406a0e
0x00406a11
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a61
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00000000
0x00407353
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00000000
0x00407362
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e03
0x00406e07
0x00406e25
0x00406e28
0x00406e2f
0x00406e32
0x00406e35
0x00406e38
0x00406e3b
0x00406e3e
0x00406e40
0x00406e47
0x00406e48
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e53
0x00406e58
0x00000000
0x00406e58
0x00406e09
0x00406e0c
0x00406e0f
0x00406e19
0x00000000
0x00000000
0x00406e6d
0x00406e71
0x00406e94
0x00406e97
0x00406e9a
0x00406ea4
0x00406e73
0x00406e73
0x00406e76
0x00406e79
0x00406e7c
0x00406e89
0x00406e8c
0x00406e8c
0x00000000
0x00000000
0x00406eb0
0x00406eb4
0x00000000
0x00000000
0x00406eba
0x00406ebe
0x00000000
0x00000000
0x00406ec4
0x00406ec6
0x00406eca
0x00406eca
0x00406ecd
0x00406ed1
0x00000000
0x00000000
0x00406f21
0x00406f25
0x00406f2c
0x00406f2f
0x00406f32
0x00406f3c
0x00000000
0x00406f3c
0x00406f27
0x00000000
0x00000000
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00406f62
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00406f75
0x00406f7a
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00406e5b
0x00406e5b
0x00406e5e
0x00000000
0x00000000
0x0040719a
0x0040719e
0x004071c0
0x004071c3
0x004071cd
0x00000000
0x004071cd
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071aa
0x004071ad
0x00000000
0x00000000
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x0040728e
0x0040728e
0x00000000
0x0040728e
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x004071b1
0x004071b1
0x004071b4
0x00000000
0x00000000
0x00407348
0x0040734b
0x00000000
0x00000000
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00406f99
0x00406f9c
0x00406f9f
0x00406fa1
0x00406fa3
0x00406fa3
0x00406fa4
0x00406fa7
0x00406fae
0x00406fb1
0x00406fbf
0x00000000
0x00000000
0x00407295
0x00407295
0x00407298
0x0040729f
0x00000000
0x00000000
0x004072a4
0x004072a4
0x004072a8
0x004073e0
0x00000000
0x004073e0
0x004072ae
0x004072b1
0x004072b4
0x004072b8
0x004072bb
0x004072c1
0x004072c3
0x004072c3
0x004072c3
0x004072c6
0x004072c9
0x004072c9
0x004072c9
0x004072c9
0x004072cc
0x004072cc
0x004072d0
0x00407330
0x00407333
0x00407338
0x00407339
0x0040733b
0x0040733d
0x00407340
0x00000000
0x00407340
0x004072d2
0x004072d8
0x004072db
0x004072de
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f0
0x004072f3
0x0040730c
0x0040730f
0x00407312
0x00407315
0x00407319
0x0040731b
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x004072fd
0x00407302
0x00407304
0x00407307
0x00407307
0x00407322
0x00407329
0x00000000
0x0040732b
0x00000000
0x0040732b
0x00000000
0x00406fc7
0x00406fca
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ed4
0x00406ed4
0x00406ed8
0x0040739e
0x00000000
0x0040739e
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0a
0x00406f0d
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00000000
0x00407195
0x00407193
0x004073c8
0x00000000
0x00000000
0x004069f7

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f89fa2b82c3582630e48f8d962894969dc053b2917616608cfb7cb79f0eae0
Instruction ID: a8863fe78996f843359de7c5bfd379a1eea36fcd983753e4914cca1de1ad4522
Opcode Fuzzy Hash: 28f89fa2b82c3582630e48f8d962894969dc053b2917616608cfb7cb79f0eae0
Instruction Fuzzy Hash: 64F19970D04229CBDF28CFA8C8946ADBBB1FF44305F15806ED856BB281D7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040679D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040679D(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x426778); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x426778;
			}

0x004067a8
0x004067b1
0x00000000
0x004067be
0x004067b4
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E80,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74D0F560,00405B8C,?,C:\Users\user\AppData\Local\Temp\,74D0F560), ref: 004067A8
FindClose.KERNEL32(00000000), ref: 004067B4

Strings

xgB, xrefs: 0040679E

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: ea65b8238a6c4212f87a99da3429cad3cfd7d6c607fa996c5b3538c5afd51a61
Instruction ID: 1b27dcd2975eeee945313d13394252a5c83f97c95c946a5b4728614f5986e50d
Opcode Fuzzy Hash: ea65b8238a6c4212f87a99da3429cad3cfd7d6c607fa996c5b3538c5afd51a61
Instruction Fuzzy Hash: 9CD012315150209BC3411738BF4C89B7A999F553797228B37B466F22E0C7348C2286DC

Uniqueness

Uniqueness Score: -1.00%

Function 00402171 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00402171(void* __eflags) {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0xc)) = E00402CAE(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402CAE(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402CAE(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402CAE(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0x14)) = E00402CAE(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405DA6( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402CAE(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56); // executed
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren\\Parfaits\\Produktoversigts\\Newcomers\\Igennen");
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0x14)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0xc)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x0040217a
0x00402184
0x0040218e
0x00402198
0x004021a3
0x004021a6
0x004021c0
0x004021c3
0x004021c9
0x004021cc
0x004021d6
0x004021da
0x004021da
0x004021df
0x004021f0
0x004021f8
0x004022af
0x004022af
0x004022b6
0x004021fe
0x004021fe
0x0040220d
0x00402211
0x00402214
0x0040221a
0x00402228
0x0040222b
0x0040222d
0x00402238
0x00402238
0x0040223d
0x0040223f
0x00402246
0x00402246
0x00402249
0x00402252
0x00402255
0x0040225b
0x0040225d
0x00402267
0x00402267
0x0040226a
0x00402273
0x00402276
0x0040227f
0x00402285
0x00402287
0x00402295
0x00402295
0x00402298
0x0040229e
0x0040229e
0x004022a1
0x004022a7
0x004022ad
0x004022c2
0x00000000
0x00000000
0x00000000
0x004022ad
0x004022b8
0x00402b35
0x00402b41

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F0

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen, xrefs: 00402230

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen
API String ID: 542301482-1234864624
Opcode ID: 87cdffaae998c2cbb37936ecef318a27d85b0bd5fe86a4e4ce858b425df4b42c
Instruction ID: 7a8e222b8c0b46a003d3e6ab03d863762680ffb25dec22d023d8596d5ab8148d
Opcode Fuzzy Hash: 87cdffaae998c2cbb37936ecef318a27d85b0bd5fe86a4e4ce858b425df4b42c
Instruction Fuzzy Hash: E2411771A00209AFCB00DFE5CA89A9D7BB6AF48308B20457AF505FB2D1DB799981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004028D5 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E004028D5(short __ebx, short* __esi) {
				void* _t8;
				void* _t21;

				_t8 = FindFirstFileW(E00402CAE(2), _t21 - 0x2dc); // executed
				if(_t8 != 0xffffffff) {
					E004063A1( *((intOrPtr*)(_t21 - 0x14)), _t8);
					_push(_t21 - 0x2b0);
					_push(__esi);
					E0040645A();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0x14)))) = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x004028e4
0x004028ed
0x00402908
0x00402913
0x00402914
0x00402a4e
0x004028ef
0x004028f2
0x004028f5
0x004028f8
0x004028f8
0x00402b35
0x00402b41

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 004028E4

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f368171da683faba62e1df1ab4cf17d77e7d691826b8bbf8bba297ea2ec50a0f
Instruction ID: 22a2f77bf4eaf9903f222567b6f58d188116acb0ddf63ad09a6bd0288c314294
Opcode Fuzzy Hash: f368171da683faba62e1df1ab4cf17d77e7d691826b8bbf8bba297ea2ec50a0f
Instruction Fuzzy Hash: E6F05871600104EFDB00DFA4DE499AEB378EF10318F60417AE541F21E1D6B89E42DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00404E34 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 487
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00404E34(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t281;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x42a288;
				_v28 =  *0x42a254 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x42a25d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c)); // executed
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404D82(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x42a25c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x42370c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x423720;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x42370c = 0;
								 *0x423720 = 0;
								 *0x42a2c0 = 0;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x42a25d & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L91;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00404E02();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x423720;
									_t201 =  *0x42a288;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42a28c <= 0) {
										L86:
										InvalidateRect(_v8, 0, 1);
										if( *((intOrPtr*)( *0x42921c + 0x10)) != 0) {
											E00404D3D(0x3ff, 0xfffffffb, E00404D55(5));
										}
										goto L88;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x42a28c);
									goto L86;
								} else {
									_t293 = E004012E2( *0x423720);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L91;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x42a2c0 = _t291;
					 *0x423720 = GlobalAlloc(0x40,  *0x42a28c << 2);
					_t258 = LoadImageW( *0x42a240, 0x6e, 0, 0, 0, 0);
					 *0x423714 =  *0x423714 | 0xffffffff;
					_t297 = _t258;
					 *0x42371c = SetWindowLongW(_v8, 0xfffffffc, E00405436);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42370c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x42370c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E0040647C(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E004043C7(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E004043C7(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x42a28c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										_t281 = SendMessageW(_v8, 0x1132, 0,  &_v88); // executed
										 *( *0x423720 + _t300 * 4) = _t281;
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x423720 + _t300 * 4) = _t284;
									_v16 =  *( *0x423720 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x42a28c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004043FC(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004043FC(_v12);
								L91:
								return E0040442E(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404e3b
0x00404e54
0x00404e59
0x00404e61
0x00404e67
0x00404e7d
0x00404e80
0x004050ab
0x004050b2
0x004050c6
0x004050b4
0x004050b6
0x004050b9
0x004050ba
0x004050c1
0x004050c1
0x004050d2
0x004050e0
0x004050e3
0x004050f9
0x0040516e
0x00405171
0x00405173
0x0040517d
0x0040518b
0x0040518b
0x0040518d
0x00405197
0x0040519d
0x004051a0
0x004051a3
0x004051be
0x004051a5
0x004051af
0x004051af
0x004051a3
0x00405197
0x00000000
0x00405171
0x004050fe
0x00405109
0x0040510e
0x00405115
0x0040511a
0x0040511e
0x00405129
0x00405129
0x0040512d
0x00405131
0x00405135
0x00405148
0x00405137
0x00405137
0x0040513e
0x00405144
0x00405140
0x00405140
0x00405140
0x0040513e
0x0040514c
0x0040514e
0x00405161
0x00405164
0x00405167
0x00405167
0x00405131
0x00000000
0x0040511e
0x00405100
0x00405107
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004051c1
0x004051c1
0x004051c8
0x00405239
0x00405241
0x00405249
0x00405249
0x00405252
0x00405254
0x0040525b
0x0040525e
0x0040525e
0x00405264
0x0040526b
0x0040526e
0x0040526e
0x00405274
0x0040527a
0x00405280
0x00405280
0x0040528d
0x004053e3
0x004053ea
0x00405407
0x0040540d
0x0040541f
0x0040541f
0x00000000
0x00405293
0x00405295
0x0040529a
0x0040529f
0x004052a4
0x004052a6
0x004052a6
0x004052a7
0x004052a8
0x004052aa
0x004052aa
0x004052b2
0x004052f3
0x004052f5
0x00405305
0x00405308
0x0040530d
0x00405314
0x00405317
0x004053b9
0x004053bf
0x004053cd
0x004053de
0x004053de
0x00000000
0x004053cd
0x0040531d
0x00405320
0x00405326
0x0040532b
0x0040532d
0x0040532f
0x00405335
0x0040533c
0x00405341
0x00405348
0x0040534b
0x0040534b
0x00405352
0x0040535e
0x00405362
0x00405364
0x00405364
0x00405354
0x00405356
0x00405356
0x00405384
0x00405390
0x0040539f
0x0040539f
0x004053a1
0x004053a4
0x004053ad
0x00000000
0x004052b4
0x004052bf
0x004052c2
0x004052c7
0x004052c9
0x004052cd
0x004052dd
0x004052e7
0x004052e9
0x004052ec
0x00000000
0x00000000
0x00000000
0x00000000
0x004052cf
0x004052cf
0x004052d5
0x004052d7
0x004052d7
0x004052d8
0x004052d9
0x00000000
0x004052cf
0x004052b2
0x0040528d
0x004051d0
0x00000000
0x004051e6
0x004051f0
0x004051f5
0x00000000
0x00000000
0x00405207
0x0040520c
0x00405218
0x00405218
0x0040521a
0x00405229
0x0040522b
0x0040522f
0x00405232
0x00000000
0x00405232
0x004051d0
0x00404e86
0x00404e8b
0x00404e94
0x00404e9b
0x00404ead
0x00404eb8
0x00404ebe
0x00404ecc
0x00404ee0
0x00404ee5
0x00404ef2
0x00404ef7
0x00404f0d
0x00404f1e
0x00404f2b
0x00404f2b
0x00404f2e
0x00404f34
0x00404f36
0x00404f39
0x00404f3e
0x00404f43
0x00404f45
0x00404f45
0x00404f65
0x00404f65
0x00404f67
0x00404f68
0x00404f6d
0x00404f73
0x00404f77
0x00404f7c
0x00404f84
0x00404f88
0x00404f8d
0x00404f92
0x00404f9a
0x00404f9d
0x0040506d
0x00405080
0x00000000
0x00404fa3
0x00404fa6
0x00404fa9
0x00404fac
0x00404fac
0x00404fb2
0x00404fbb
0x00404fbe
0x00404fc2
0x00404fc5
0x00404fc8
0x00404fd1
0x00404fda
0x00404fdd
0x00404fe0
0x00404fe3
0x00405021
0x00405044
0x0040504c
0x00405023
0x00405032
0x00405032
0x00404fe5
0x00404fe8
0x00404ff6
0x00405000
0x00405008
0x0040500f
0x0040501a
0x0040501a
0x00404fe3
0x00405052
0x00405053
0x0040505f
0x0040505f
0x0040506b
0x00405086
0x00405089
0x004050a6
0x00000000
0x0040508b
0x00405090
0x00405099
0x00405421
0x00405433
0x00405433
0x00405089
0x00000000
0x0040506b
0x00404f9d

APIs

GetDlgItem.USER32 ref: 00404E4C
GetDlgItem.USER32 ref: 00404E57
GlobalAlloc.KERNEL32(00000040,?), ref: 00404EA1
LoadImageW.USER32 ref: 00404EB8
SetWindowLongW.USER32 ref: 00404ED1
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EE5
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404EF7
SendMessageW.USER32(?,00001109,00000002), ref: 00404F0D
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404F19
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404F2B
DeleteObject.GDI32(00000000), ref: 00404F2E
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404F59
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404F65
SendMessageW.USER32(?,00001132,00000000,?), ref: 00405000
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405030

Part of subcall function 004043FC: SendMessageW.USER32(00000028,?,00000001,00404227), ref: 0040440A

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405044
GetWindowLongW.USER32(?,000000F0), ref: 00405072
SetWindowLongW.USER32 ref: 00405080
ShowWindow.USER32(?,00000005), ref: 00405090
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040518B
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004051F0
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405205
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405229
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405249
ImageList_Destroy.COMCTL32(?), ref: 0040525E
GlobalFree.KERNEL32 ref: 0040526E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004052E7
SendMessageW.USER32(?,00001102,?,?), ref: 00405390
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040539F
InvalidateRect.USER32(?,00000000,00000001), ref: 004053BF
ShowWindow.USER32(?,00000000), ref: 0040540D
GetDlgItem.USER32 ref: 00405418
ShowWindow.USER32(00000000), ref: 0040541F

Strings

M, xrefs: 00404FE8
, xrefs: 004053F7
N, xrefs: 004050C9

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 269197e9aafe69347dbca55aa18a0eef7e9a3f9f8d14cf54ee08097b8033c629
Instruction ID: 0919d21b94e475871465aa305c5e968e986ab69bdf73f6461ca1124b4931f57f
Opcode Fuzzy Hash: 269197e9aafe69347dbca55aa18a0eef7e9a3f9f8d14cf54ee08097b8033c629
Instruction Fuzzy Hash: 7D026DB0A00609AFDF20DF95CD45AAF7BB5FB84314F10817AE510BA2E1D7798A52CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403EEE Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00403EEE(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				struct HWND__* _t51;
				signed int _t70;
				struct HWND__* _t76;
				signed int _t89;
				struct HWND__* _t94;
				signed int _t102;
				int _t106;
				signed int _t118;
				signed int _t119;
				int _t120;
				signed int _t125;
				struct HWND__* _t128;
				struct HWND__* _t129;
				int _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t118 = _a8;
				if(_t118 == 0x110 || _t118 == 0x408) {
					_t37 = _a12;
					_t128 = _a4;
					__eflags = _t118 - 0x110;
					 *0x423710 = _t37;
					if(_t118 == 0x110) {
						 *0x42a248 = _t128;
						 *0x423724 = GetDlgItem(_t128, 1);
						_t94 = GetDlgItem(_t128, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x4216f0 = _t94;
						E004043C7(_t128);
						SetClassLongW(_t128, 0xfffffff2,  *0x429228); // executed
						 *0x42920c = E0040140B(4);
						_t37 = 1;
						__eflags = 1;
						 *0x423710 = 1;
					}
					_t125 =  *0x40a39c; // 0x0
					_t136 = 0;
					_t133 = (_t125 << 6) +  *0x42a280;
					__eflags = _t125;
					if(_t125 < 0) {
						L34:
						E00404413(0x40b);
						while(1) {
							_t39 =  *0x423710;
							 *0x40a39c =  *0x40a39c + _t39;
							_t133 = _t133 + (_t39 << 6);
							_t41 =  *0x40a39c; // 0x0
							__eflags = _t41 -  *0x42a284;
							if(_t41 ==  *0x42a284) {
								E0040140B(1);
							}
							__eflags =  *0x42920c - _t136;
							if( *0x42920c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x42a284; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t119 =  *(_t133 + 0x14);
							E0040647C(_t119, _t128, _t133, 0x43a000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004043C7(_t128);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004043C7(_t128);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004043C7(_t128);
							_t51 = GetDlgItem(_t128, 3);
							__eflags =  *0x42a2ec - _t136;
							_v32 = _t51;
							if( *0x42a2ec != _t136) {
								_t119 = _t119 & 0x0000fefd | 0x00000004;
								__eflags = _t119;
							}
							ShowWindow(_t51, _t119 & 0x00000008); // executed
							EnableWindow( *(_t137 + 0x30), _t119 & 0x00000100); // executed
							E004043E9(_t119 & 0x00000002);
							_t120 = _t119 & 0x00000004;
							EnableWindow( *0x4216f0, _t120);
							__eflags = _t120 - _t136;
							if(_t120 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t128, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x38), 0xf4, _t136, 1);
							__eflags =  *0x42a2ec - _t136;
							if( *0x42a2ec == _t136) {
								_push( *0x423724);
							} else {
								SendMessageW(_t128, 0x401, 2, _t136);
								_push( *0x4216f0);
							}
							E004043FC();
							E0040645A(0x423728, E00403ECF());
							E0040647C(0x423728, _t128, _t133,  &(0x423728[lstrlenW(0x423728)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t128, 0x423728); // executed
							_push(_t136);
							_t70 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t70;
							if(_t70 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x429218); // executed
									 *0x422700 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L58;
									}
									_t76 = CreateDialogParamW( *0x42a240,  *_t133 +  *0x429220 & 0x0000ffff, _t128,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133); // executed
									__eflags = _t76 - _t136;
									 *0x429218 = _t76;
									if(_t76 == _t136) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004043C7(_t76);
									GetWindowRect(GetDlgItem(_t128, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t128, _t137 + 0x10);
									SetWindowPos( *0x429218, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x42920c - _t136;
									if( *0x42920c != _t136) {
										goto L61;
									}
									ShowWindow( *0x429218, 8);
									E00404413(0x405);
									goto L58;
								}
								__eflags =  *0x42a2ec - _t136;
								if( *0x42a2ec != _t136) {
									goto L61;
								}
								__eflags =  *0x42a2e0 - _t136;
								if( *0x42a2e0 != _t136) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x429218);
						 *0x42a248 = _t136;
						EndDialog(_t128,  *0x421ef8);
						goto L58;
					} else {
						__eflags = _t37 - 1;
						if(_t37 != 1) {
							L33:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t89 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t89;
						if(_t89 == 0) {
							goto L33;
						}
						SendMessageW( *0x429218, 0x40f, 0, 1);
						__eflags =  *0x42920c;
						return 0 |  *0x42920c == 0x00000000;
					}
				} else {
					_t128 = _a4;
					_t136 = 0;
					if(_t118 == 0x47) {
						SetWindowPos( *0x423708, _t128, 0, 0, 0, 0, 0x13);
					}
					if(_t118 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x423708,  ~(_a12 - 1) & _t118);
					}
					if(_t118 != 0x40d) {
						__eflags = _t118 - 0x11;
						if(_t118 != 0x11) {
							__eflags = _t118 - 0x111;
							if(_t118 != 0x111) {
								L26:
								return E0040442E(_t118, _a12, _a16);
							}
							_t135 = _a12 & 0x0000ffff;
							_t129 = GetDlgItem(_t128, _t135);
							__eflags = _t129 - _t136;
							if(_t129 == _t136) {
								L13:
								__eflags = _t135 - 1;
								if(_t135 != 1) {
									__eflags = _t135 - 3;
									if(_t135 != 3) {
										_t130 = 2;
										__eflags = _t135 - _t130;
										if(_t135 != _t130) {
											L25:
											SendMessageW( *0x429218, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42a2ec - _t136;
										if( *0x42a2ec == _t136) {
											_t102 = E0040140B(3);
											__eflags = _t102;
											if(_t102 != 0) {
												goto L26;
											}
											 *0x421ef8 = 1;
											L21:
											_push(0x78);
											L22:
											E004043A0();
											goto L26;
										}
										E0040140B(_t130);
										 *0x421ef8 = _t130;
										goto L21;
									}
									__eflags =  *0x40a39c - _t136; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t135);
								goto L22;
							}
							SendMessageW(_t129, 0xf3, _t136, _t136);
							_t106 = IsWindowEnabled(_t129);
							__eflags = _t106;
							if(_t106 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongW(_t128, _t136, _t136);
						return 1;
					} else {
						DestroyWindow( *0x429218);
						 *0x429218 = _a12;
						L58:
						if( *0x425728 == _t136 &&  *0x429218 != _t136) {
							ShowWindow(_t128, 0xa);
							 *0x425728 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x00403ef7
0x00403f00
0x00404041
0x00404045
0x00404049
0x0040404b
0x00404050
0x0040405b
0x00404066
0x0040406b
0x0040406d
0x0040406f
0x00404072
0x00404077
0x00404085
0x00404092
0x00404099
0x00404099
0x0040409a
0x0040409a
0x0040409f
0x004040a5
0x004040ac
0x004040b2
0x004040b4
0x004040f4
0x004040f9
0x004040fe
0x004040fe
0x00404103
0x0040410c
0x0040410e
0x00404113
0x00404119
0x0040411d
0x0040411d
0x00404122
0x00404128
0x00000000
0x00000000
0x00404133
0x00404139
0x00000000
0x00000000
0x00404142
0x0040414a
0x0040414f
0x00404152
0x00404158
0x0040415d
0x00404160
0x00404166
0x0040416b
0x0040416e
0x00404174
0x0040417c
0x00404182
0x00404188
0x0040418c
0x00404193
0x00404193
0x00404193
0x0040419d
0x004041af
0x004041bb
0x004041c0
0x004041ca
0x004041d0
0x004041d2
0x004041d7
0x004041d4
0x004041d4
0x004041d4
0x004041e7
0x004041ff
0x00404201
0x00404207
0x0040421c
0x00404209
0x00404212
0x00404214
0x00404214
0x00404222
0x00404233
0x00404249
0x00404250
0x00404256
0x0040425a
0x0040425f
0x00404261
0x00000000
0x00404267
0x00404267
0x00404269
0x00000000
0x00000000
0x0040426f
0x00404273
0x00404298
0x0040429e
0x004042a4
0x004042a6
0x00000000
0x00000000
0x004042cc
0x004042d2
0x004042d4
0x004042d9
0x00000000
0x00000000
0x004042df
0x004042e2
0x004042e5
0x004042fc
0x00404308
0x00404321
0x00404327
0x0040432b
0x00404330
0x00404336
0x00000000
0x00000000
0x00404340
0x0040434b
0x00000000
0x0040434b
0x00404275
0x0040427b
0x00000000
0x00000000
0x00404281
0x00404287
0x00000000
0x00000000
0x00000000
0x0040428d
0x00404261
0x00404358
0x00404364
0x0040436b
0x00000000
0x004040b6
0x004040b6
0x004040b9
0x004040ec
0x004040ec
0x004040ee
0x00000000
0x00000000
0x00000000
0x004040ee
0x004040bb
0x004040bf
0x004040c4
0x004040c6
0x00000000
0x00000000
0x004040d6
0x004040de
0x00000000
0x004040e4
0x00403f12
0x00403f12
0x00403f16
0x00403f1b
0x00403f2a
0x00403f2a
0x00403f33
0x00403f3c
0x00403f47
0x00403f47
0x00403f53
0x00403f6f
0x00403f72
0x00403f85
0x00403f8b
0x0040402e
0x00000000
0x00404037
0x00403f91
0x00403f9e
0x00403fa0
0x00403fa2
0x00403fc1
0x00403fc1
0x00403fc4
0x00403fc9
0x00403fcc
0x00403fdc
0x00403fdd
0x00403fdf
0x00404015
0x00404028
0x00000000
0x00404028
0x00403fe1
0x00403fe7
0x00404000
0x00404005
0x00404007
0x00000000
0x00000000
0x00404009
0x00403ff5
0x00403ff5
0x00403ff7
0x00403ff7
0x00000000
0x00403ff7
0x00403fea
0x00403fef
0x00000000
0x00403fef
0x00403fce
0x00403fd4
0x00000000
0x00000000
0x00403fd6
0x00000000
0x00403fd6
0x00403fc6
0x00000000
0x00403fc6
0x00403fac
0x00403fb3
0x00403fb9
0x00403fbb
0x00000000
0x00000000
0x00000000
0x00403fbb
0x00403f77
0x00000000
0x00403f55
0x00403f5b
0x00403f65
0x00404371
0x00404377
0x00404384
0x0040438a
0x0040438a
0x00404394
0x00000000
0x00404394
0x00403f53

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F2A
ShowWindow.USER32(?), ref: 00403F47
DestroyWindow.USER32 ref: 00403F5B
SetWindowLongW.USER32 ref: 00403F77
GetDlgItem.USER32 ref: 00403F98
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403FAC
IsWindowEnabled.USER32(00000000), ref: 00403FB3
GetDlgItem.USER32 ref: 00404061
GetDlgItem.USER32 ref: 0040406B
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00404085
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004040D6
GetDlgItem.USER32 ref: 0040417C
ShowWindow.USER32(00000000,?), ref: 0040419D
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004041AF
EnableWindow.USER32(?,?), ref: 004041CA
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004041E0
EnableMenuItem.USER32 ref: 004041E7
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004041FF
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404212
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 0040423C
SetWindowTextW.USER32(?,00423728), ref: 00404250
ShowWindow.USER32(?,0000000A), ref: 00404384

Strings

(7B, xrefs: 0040422C

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID: (7B
API String ID: 3906175533-3251261122
Opcode ID: 748fc88fb3f14a30e84c1bf92dbb7bc40e144e14d4b9c1ef990af66266f71708
Instruction ID: 8758dc3f4ce2e409f5306f0a3bb5605f810733e493ac8f1e0f1051ffb6e87de4
Opcode Fuzzy Hash: 748fc88fb3f14a30e84c1bf92dbb7bc40e144e14d4b9c1ef990af66266f71708
Instruction Fuzzy Hash: 10C1B1B1640200FBDB216FA1EE85D2A3BB8EB94305F40453EFB41B11F1CB7998529B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403B40 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403B40(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x42a254;
				_t22 = E00406834(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x423728;
					L"1033" = 0x30;
					 *0x437002 = 0x78;
					 *0x437004 = 0;
					E00406328(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x423728, 0);
					__eflags =  *0x423728;
					if(__eflags == 0) {
						E00406328(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x423728, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004063A1(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403E16(_t78, _t90);
				_t86 = L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren";
				 *0x42a2e0 =  *0x42a25c & 0x00000020;
				 *0x42a2fc = 0x10000;
				if(E00405E37(_t90, L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren") != 0) {
					L16:
					if(E00405E37(_t98, _t86) == 0) {
						E0040647C(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118))); // executed
					}
					_t30 = LoadImageW( *0x42a240, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x429228 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403E16(_t78, __eflags);
							__eflags =  *0x42a300;
							if( *0x42a300 != 0) {
								_t33 = E00405595(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42920c;
								if( *0x42920c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x423708, 5); // executed
							_t39 = E004067C4("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004067C4("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x4291e0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x4291e0);
								 *0x429204 = _t87;
								RegisterClassW(0x4291e0);
							}
							_t44 = DialogBoxParamW( *0x42a240,  *0x429220 + 0x00000069 & 0x0000ffff, 0, E00403EEE, 0); // executed
							E00403A90(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x42a240;
						 *0x4291e4 = E00401000;
						 *0x4291f0 =  *0x42a240;
						 *0x4291f4 = _t30;
						 *0x429204 = 0x40a3b4;
						if(RegisterClassW(0x4291e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x423708 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42a240, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x4281e0;
					E00406328(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x42a298 + _t78 * 2,  *0x42a298 +  *(_t82 + 0x4c) * 2, 0x4281e0, 0);
					_t63 =  *0x4281e0; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x4281e2;
						 *((short*)(E00405D5C(0x4281e2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040645A(_t86, E00405D2F(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405D7B(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403b46
0x00403b4f
0x00403b56
0x00403b58
0x00403b6c
0x00403b7e
0x00403b87
0x00403b90
0x00403b97
0x00403b9c
0x00403ba3
0x00403bb6
0x00403bb6
0x00403bc1
0x00403b5a
0x00403b65
0x00403b65
0x00403bc6
0x00403bd0
0x00403bd9
0x00403bde
0x00403bef
0x00403c81
0x00403c89
0x00403c92
0x00403c92
0x00403ca8
0x00403cae
0x00403cbc
0x00403d3d
0x00403d45
0x00403d4f
0x00403d54
0x00403d5a
0x00403de4
0x00403de9
0x00403deb
0x00403e07
0x00000000
0x00403e07
0x00403ded
0x00403df3
0x00403dfb
0x00403dfb
0x00000000
0x00403df3
0x00403d68
0x00403d73
0x00403d78
0x00403d7a
0x00403d81
0x00403d81
0x00403d8c
0x00403d94
0x00403d96
0x00403d98
0x00403da1
0x00403da4
0x00403daa
0x00403daa
0x00403dc9
0x00403dda
0x00000000
0x00403ddf
0x00403d47
0x00403d49
0x00000000
0x00403cbe
0x00403cbe
0x00403cca
0x00403cd4
0x00403cda
0x00403cdf
0x00403cee
0x00403e0c
0x00403e0c
0x00000000
0x00403e0c
0x00403cfd
0x00403d38
0x00000000
0x00403d38
0x00403bf5
0x00403bf5
0x00403bf8
0x00403bfa
0x00000000
0x00000000
0x00403c08
0x00403c1a
0x00403c1f
0x00403c28
0x00000000
0x00000000
0x00403c2e
0x00403c30
0x00403c3d
0x00403c3d
0x00403c46
0x00403c4c
0x00403c74
0x00403c7c
0x00000000
0x00403c5e
0x00403c5f
0x00403c68
0x00403c6e
0x00403c6f
0x00000000
0x00403c6f
0x00403c6a
0x00403c6c
0x00000000
0x00000000
0x00000000
0x00403c6c
0x00403c4c

APIs

Part of subcall function 00406834: GetModuleHandleA.KERNEL32(?,00000020,?,0040357F,0000000A), ref: 00406846
Part of subcall function 00406834: GetProcAddress.KERNEL32(00000000,?), ref: 00406861

lstrcatW.KERNEL32(1033,00423728), ref: 00403BC1
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403C41
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403C54
GetFileAttributesW.KERNEL32(Call), ref: 00403C5F
LoadImageW.USER32 ref: 00403CA8

Part of subcall function 004063A1: wsprintfW.USER32 ref: 004063AE

RegisterClassW.USER32 ref: 00403CE5
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403CFD
CreateWindowExW.USER32 ref: 00403D32
ShowWindow.USER32(00000005,00000000), ref: 00403D68
GetClassInfoW.USER32 ref: 00403D94
GetClassInfoW.USER32 ref: 00403DA1
RegisterClassW.USER32 ref: 00403DAA
DialogBoxParamW.USER32 ref: 00403DC9

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren, xrefs: 00403BD0, 00403BD8, 00403C7B, 00403C81, 00403C91
.DEFAULT\Control Panel\International, xrefs: 00403BAC
RichEd32, xrefs: 00403D7C
RichEdit, xrefs: 00403D9B
.exe, xrefs: 00403C4E
"C:\Users\user\Desktop\XShSI2OXaC.exe", xrefs: 00403B44
1033, xrefs: 00403B60, 00403BBC
RichEd20, xrefs: 00403D6E
_Nb, xrefs: 00403CC4, 00403D2C
(7B, xrefs: 00403B6C
Control Panel\Desktop\ResourceLocale, xrefs: 00403B74
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B4C
Call, xrefs: 00403C08, 00403C11, 00403C1F, 00403C6E, 00403C74
RichEdit20W, xrefs: 00403D8C, 00403D92

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\XShSI2OXaC.exe"$(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3441984764
Opcode ID: f20b6dd65917373f49c3406884b29d543e6b533d98b579d40e811d90a00bcde6
Instruction ID: a31e57450847abf653d8df5fb9e77a255221014dac31c9a84b0a5ceb505493a6
Opcode Fuzzy Hash: f20b6dd65917373f49c3406884b29d543e6b533d98b579d40e811d90a00bcde6
Instruction Fuzzy Hash: B761D770240200BBD320AF669D45E2B3ABCEB84B49F40457FFD85B22E1DB7D5912C66D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F9D Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00402F9D(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				signed int _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				long _t94;
				signed int _t102;
				signed int _t104;
				void* _t106;
				signed int _t107;
				signed int _t110;
				void* _t111;

				_t94 = 0;
				_v8 = 0;
				_v12 = 0;
				 *0x42a250 = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\hardz\\Desktop\\XShSI2OXaC.exe", 0x400);
				_t106 = E00405F50(L"C:\\Users\\hardz\\Desktop\\XShSI2OXaC.exe", 0x80000000, 3);
				 *0x40a018 = _t106;
				if(_t106 == 0xffffffff) {
					return L"Error launching installer";
				}
				E0040645A(L"C:\\Users\\hardz\\Desktop", L"C:\\Users\\hardz\\Desktop\\XShSI2OXaC.exe");
				E0040645A(0x439000, E00405D7B(L"C:\\Users\\hardz\\Desktop"));
				_t54 = GetFileSize(_t106, 0);
				__eflags = _t54;
				 *0x420ee0 = _t54;
				_t110 = _t54;
				if(_t54 <= 0) {
					L24:
					E00402EFB(1);
					__eflags =  *0x42a258 - _t94;
					if( *0x42a258 == _t94) {
						goto L32;
					}
					__eflags = _v12 - _t94;
					if(_v12 == _t94) {
						L28:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t111 = _t57;
						E00406995(0x40ce48);
						E00405F7F(0x40ce48,  &_v560, L"C:\\Users\\hardz\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileW( &_v560, 0xc0000000, _t94, _t94, 2, 0x4000100, _t94); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E004034C5( *0x42a258 + 0x1c);
							 *0x420ee4 = _t65;
							 *0x420ed8 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E0040323E(_v16, 0xffffffff, _t94, _t111, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x42a254 = _t111;
								 *0x42a25c =  *_t111;
								if((_v40 & 0x00000001) != 0) {
									 *0x42a260 =  *0x42a260 + 1;
									__eflags =  *0x42a260;
								}
								_t45 = _t111 + 0x44; // 0x44
								_t70 = _t45;
								_t102 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t111;
									_t102 = _t102 - 1;
									__eflags = _t102;
								} while (_t102 != 0);
								_t71 =  *0x420ed4; // 0x35f74
								 *((intOrPtr*)(_t111 + 0x3c)) = _t71;
								E00405F0B(0x42a280, _t111 + 4, 0x40);
								__eflags = 0;
								return 0;
							}
							goto L32;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004034C5( *0x420ed0);
					_t77 = E004034AF( &_a4, 4);
					__eflags = _t77;
					if(_t77 == 0) {
						goto L32;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L32;
					}
					goto L28;
				} else {
					do {
						_t107 = _t110;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x42a258) & 0x00007e00) + 0x200;
						__eflags = _t110 - _t82;
						if(_t110 >= _t82) {
							_t107 = _t82;
						}
						_t83 = E004034AF(0x418ed0, _t107);
						__eflags = _t83;
						if(_t83 == 0) {
							E00402EFB(1);
							L32:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42a258;
						if( *0x42a258 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402EFB(0);
							}
							goto L20;
						}
						E00405F0B( &_v40, 0x418ed0, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t89;
						_t104 =  *0x420ed0; // 0x0
						 *0x42a300 =  *0x42a300 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t110;
						 *0x42a258 = _t104;
						if(_t92 > _t110) {
							goto L32;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v12 = _v12 + 1;
							_t110 = _t92 - 4;
							__eflags = _t107 - _t110;
							if(_t107 > _t110) {
								_t107 = _t110;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t110 -  *0x420ee0; // 0x28c8
						if(__eflags < 0) {
							_v8 = E00406927(_v8, 0x418ed0, _t107);
						}
						 *0x420ed0 =  *0x420ed0 + _t107;
						_t110 = _t110 - _t107;
						__eflags = _t110;
					} while (_t110 != 0);
					_t94 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402fa8
0x00402fab
0x00402fae
0x00402fc8
0x00402fcd
0x00402fe0
0x00402fe5
0x00402feb
0x00000000
0x00402fed
0x00402ffe
0x0040300f
0x00403016
0x0040301c
0x0040301e
0x00403023
0x00403025
0x00403110
0x00403112
0x00403117
0x0040311e
0x00000000
0x00000000
0x00403124
0x00403127
0x00403153
0x00403158
0x00403163
0x00403165
0x00403176
0x00403191
0x00403197
0x0040319a
0x0040319f
0x004031be
0x004031ce
0x004031e0
0x004031e5
0x004031ea
0x004031ed
0x004031f6
0x004031fa
0x00403202
0x00403207
0x00403209
0x00403209
0x00403209
0x00403211
0x00403211
0x00403214
0x00403215
0x00403215
0x00403218
0x0040321a
0x0040321a
0x0040321a
0x0040321d
0x00403224
0x00403230
0x00403235
0x00000000
0x00403235
0x00000000
0x004031ed
0x00000000
0x004031a1
0x0040312f
0x0040313a
0x0040313f
0x00403141
0x00000000
0x00000000
0x0040314a
0x0040314d
0x00000000
0x00000000
0x00000000
0x0040302b
0x00403030
0x00403035
0x00403039
0x00403040
0x00403045
0x00403047
0x00403049
0x00403049
0x0040304d
0x00403052
0x00403054
0x004031ad
0x004031ef
0x00000000
0x004031ef
0x0040305a
0x00403061
0x004030dd
0x004030e1
0x004030e5
0x004030ea
0x00000000
0x004030e1
0x0040306a
0x0040306f
0x00403072
0x00403077
0x00000000
0x00000000
0x00403079
0x00403080
0x00000000
0x00000000
0x00403082
0x00403089
0x00000000
0x00000000
0x0040308b
0x00403092
0x00000000
0x00000000
0x00403094
0x0040309b
0x00000000
0x00000000
0x0040309d
0x004030a3
0x004030ac
0x004030b2
0x004030b5
0x004030b7
0x004030bd
0x00000000
0x00000000
0x004030c3
0x004030c7
0x004030cf
0x004030cf
0x004030d2
0x004030d5
0x004030d7
0x004030d9
0x004030d9
0x00000000
0x004030d7
0x004030c9
0x004030cd
0x00000000
0x00000000
0x00000000
0x004030eb
0x004030eb
0x004030f1
0x004030fd
0x004030fd
0x00403100
0x00403106
0x00403106
0x00403106
0x0040310e
0x0040310e
0x00000000
0x0040310e

APIs

GetTickCount.KERNEL32 ref: 00402FB1
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\XShSI2OXaC.exe,00000400), ref: 00402FCD

Part of subcall function 00405F50: GetFileAttributesW.KERNELBASE(00000003,00402FE0,C:\Users\user\Desktop\XShSI2OXaC.exe,80000000,00000003), ref: 00405F54
Part of subcall function 00405F50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F76

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\XShSI2OXaC.exe,C:\Users\user\Desktop\XShSI2OXaC.exe,80000000,00000003), ref: 00403016
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403158

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004031A1
Error launching installer, xrefs: 00402FED
Inst, xrefs: 00403082
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004031EF
C:\Users\user\Desktop\XShSI2OXaC.exe, xrefs: 00402FB7, 00402FC6, 00402FDA, 00402FF7
Null, xrefs: 00403094
soft, xrefs: 0040308B
C:\Users\user\Desktop, xrefs: 00402FF8, 00402FFD, 00403003
C:\Users\user\AppData\Local\Temp\, xrefs: 00402FAA, 00403170
"C:\Users\user\Desktop\XShSI2OXaC.exe", xrefs: 00402F9D

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\XShSI2OXaC.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\XShSI2OXaC.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-233753173
Opcode ID: 56d0b3c2a8a642a1a883805eefd819edc0f13446ab80b6d758718c2f9717a04b
Instruction ID: 778e762d81c441a4a21b2f4a8f0120ad9afd8f6e8e678e11a12a517b101426d9
Opcode Fuzzy Hash: 56d0b3c2a8a642a1a883805eefd819edc0f13446ab80b6d758718c2f9717a04b
Instruction Fuzzy Hash: 1371D471A00208ABDB209F64DD45B9E7BACEB04359F20417BF904B72D1D77D9E418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040647C Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E0040647C(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t43;
				WCHAR* _t44;
				signed char _t46;
				signed int _t47;
				signed int _t48;
				short _t58;
				short _t60;
				short _t62;
				void* _t70;
				signed int _t76;
				void* _t82;
				signed char _t83;
				short _t86;
				signed int _t96;
				void* _t102;
				short _t103;
				signed int _t106;
				signed int _t108;
				void* _t109;
				WCHAR* _t110;
				void* _t112;

				_t109 = __esi;
				_t102 = __edi;
				_t70 = __ebx;
				_t43 = _a8;
				if(_t43 < 0) {
					_t43 =  *( *0x42921c - 4 + _t43 * 4);
				}
				_push(_t70);
				_push(_t109);
				_push(_t102);
				_t96 =  *0x42a298 + _t43 * 2;
				_t44 = 0x4281e0;
				_t110 = 0x4281e0;
				if(_a4 >= 0x4281e0 && _a4 - 0x4281e0 >> 1 < 0x800) {
					_t110 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t103 =  *_t96;
					if(_t103 == 0) {
						break;
					}
					__eflags = (_t110 - _t44 & 0xfffffffe) - 0x800;
					if((_t110 - _t44 & 0xfffffffe) >= 0x800) {
						break;
					}
					_t82 = 2;
					_t96 = _t96 + _t82;
					__eflags = _t103 - 4;
					_a8 = _t96;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t110 = _t103;
							_t110 = _t110 + _t82;
							__eflags = _t110;
						} else {
							 *_t110 =  *_t96;
							_t110 = _t110 + _t82;
							_t96 = _t96 + _t82;
						}
						continue;
					}
					_t83 =  *((intOrPtr*)(_t96 + 1));
					_t46 =  *_t96;
					_t47 = _t46 & 0x000000ff;
					_v8 = (_t83 & 0x0000007f) << 0x00000007 | _t46 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t47 | 0x00008000;
					_v24 = _t47;
					_t76 = _t83 & 0x000000ff;
					_v16 = _t76;
					__eflags = _t103 - 2;
					_v20 = _t76 | 0x00008000;
					if(_t103 != 2) {
						__eflags = _t103 - 3;
						if(_t103 != 3) {
							__eflags = _t103 - 1;
							if(_t103 == 1) {
								__eflags = (_t47 | 0xffffffff) - _v8;
								E0040647C(_t76, _t103, _t110, _t110, (_t47 | 0xffffffff) - _v8);
							}
							L43:
							_t48 = lstrlenW(_t110);
							_t96 = _a8;
							_t110 =  &(_t110[_t48]);
							_t44 = 0x4281e0;
							continue;
						}
						_t106 = _v8;
						__eflags = _t106 - 0x1d;
						if(_t106 != 0x1d) {
							__eflags = (_t106 << 0xb) + 0x42b000;
							E0040645A(_t110, (_t106 << 0xb) + 0x42b000);
						} else {
							E004063A1(_t110,  *0x42a248);
						}
						__eflags = _t106 + 0xffffffeb - 7;
						if(_t106 + 0xffffffeb < 7) {
							L34:
							E004066EE(_t110);
						}
						goto L43;
					}
					_t86 =  *0x42a24c;
					__eflags = _t86;
					_t108 = 2;
					if(_t86 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x42a2e4;
						if( *0x42a2e4 != 0) {
							_t108 = 4;
						}
						__eflags = _t47;
						if(__eflags >= 0) {
							__eflags = _t47 - 0x25;
							if(_t47 != 0x25) {
								__eflags = _t47 - 0x24;
								if(_t47 == 0x24) {
									GetWindowsDirectoryW(_t110, 0x400);
									_t108 = 0;
								}
								while(1) {
									__eflags = _t108;
									if(_t108 == 0) {
										goto L30;
									}
									_t58 =  *0x42a244;
									_t108 = _t108 - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										L26:
										_t60 = SHGetSpecialFolderLocation( *0x42a248,  *(_t112 + _t108 * 4 - 0x18),  &_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											L28:
											 *_t110 =  *_t110 & 0x00000000;
											__eflags =  *_t110;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v12, _t110);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t62 =  *_t58( *0x42a248,  *(_t112 + _t108 * 4 - 0x18), 0, 0, _t110); // executed
									__eflags = _t62;
									if(_t62 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryW(_t110, 0x400);
							goto L30;
						} else {
							E00406328( *0x42a298, __eflags, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x42a298 + (_t47 & 0x0000003f) * 2, _t110, _t47 & 0x00000040); // executed
							__eflags =  *_t110;
							if( *_t110 != 0) {
								L32:
								__eflags = _t76 - 0x1a;
								if(_t76 == 0x1a) {
									lstrcatW(_t110, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L34;
							}
							E0040647C(_t76, _t108, _t110, _t110, _t76);
							L30:
							__eflags =  *_t110;
							if( *_t110 == 0) {
								goto L34;
							}
							_t76 = _v16;
							goto L32;
						}
					}
					__eflags = _t86 - 0x5a04;
					if(_t86 == 0x5a04) {
						goto L13;
					}
					__eflags = _t76 - 0x23;
					if(_t76 == 0x23) {
						goto L13;
					}
					__eflags = _t76 - 0x2e;
					if(_t76 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t110 =  *_t110 & 0x00000000;
				if(_a4 == 0) {
					return _t44;
				}
				return E0040645A(_a4, _t44);
			}

0x0040647c
0x0040647c
0x0040647c
0x00406482
0x00406487
0x00406498
0x00406498
0x004064a0
0x004064a1
0x004064a2
0x004064a3
0x004064a6
0x004064ae
0x004064b0
0x004064c9
0x004064cc
0x004064cc
0x004066c8
0x004066c8
0x004066ce
0x00000000
0x00000000
0x004064dc
0x004064e2
0x00000000
0x00000000
0x004064ea
0x004064eb
0x004064ed
0x004064f1
0x004064f4
0x004066b5
0x004066c3
0x004066c6
0x004066c6
0x004066b7
0x004066ba
0x004066bd
0x004066bf
0x004066bf
0x00000000
0x004066b5
0x004064fa
0x004064fd
0x0040650c
0x00406513
0x0040651d
0x00406521
0x00406524
0x00406527
0x0040652c
0x00406531
0x00406535
0x00406538
0x00406658
0x0040665c
0x0040668f
0x00406693
0x00406698
0x0040669d
0x0040669d
0x004066a2
0x004066a3
0x004066a8
0x004066ab
0x004066ae
0x00000000
0x004066ae
0x0040665e
0x00406661
0x00406664
0x00406679
0x00406680
0x00406666
0x0040666d
0x0040666d
0x00406688
0x0040668b
0x00406650
0x00406651
0x00406651
0x00000000
0x0040668b
0x0040653e
0x00406546
0x00406548
0x00406549
0x00406562
0x00406562
0x00406569
0x00406569
0x00406570
0x00406574
0x00406574
0x00406575
0x00406577
0x004065b2
0x004065b5
0x004065c5
0x004065c8
0x004065d0
0x004065d6
0x004065d6
0x00406633
0x00406633
0x00406635
0x00000000
0x00000000
0x004065da
0x004065e1
0x004065e2
0x004065e4
0x004065fe
0x0040660c
0x00406612
0x00406614
0x0040662f
0x0040662f
0x0040662f
0x00000000
0x0040662f
0x0040661a
0x00406625
0x0040662b
0x0040662d
0x00000000
0x00000000
0x00000000
0x0040662d
0x004065e6
0x004065e9
0x00000000
0x00000000
0x004065f8
0x004065fa
0x004065fc
0x00000000
0x00000000
0x00000000
0x004065fc
0x00000000
0x00406633
0x004065bd
0x00000000
0x00406579
0x00406597
0x0040659c
0x004065a0
0x00406640
0x00406640
0x00406643
0x0040664b
0x0040664b
0x00000000
0x00406643
0x004065a8
0x00406637
0x00406637
0x0040663b
0x00000000
0x00000000
0x0040663d
0x00000000
0x0040663d
0x00406577
0x0040654b
0x00406550
0x00000000
0x00000000
0x00406552
0x00406555
0x00000000
0x00000000
0x00406557
0x0040655a
0x00000000
0x0040655c
0x0040655c
0x00000000
0x0040655c
0x0040655a
0x004066d4
0x004066df
0x004066eb
0x004066eb
0x00000000

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004065BD
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,004054F9,00422708,00000000), ref: 004065D0
SHGetSpecialFolderLocation.SHELL32(004054F9,00000000,00000000,00422708,?,004054F9,00422708,00000000), ref: 0040660C
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 0040661A
CoTaskMemFree.OLE32(00000000), ref: 00406625
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040664B
lstrlenW.KERNEL32(Call,00000000,00422708,?,004054F9,00422708,00000000), ref: 004066A3

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040658D
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406645
Call, xrefs: 004064A6, 00406581, 00406588, 0040658C, 004065A6, 004065A7, 004065BC, 004065CF, 004065EB, 00406616, 0040664A, 00406650, 0040666C, 0040667F, 0040669C, 004066A2, 004066AE, 004066E1

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: cbdd498c65661b0e118fa16660a55dd8691ba15cb1fdb69ff60592734e1791e0
Instruction ID: 7bc488d8ce21fc924d044dbd96808e6302ee31df7c124cc529fec127df96d4d9
Opcode Fuzzy Hash: cbdd498c65661b0e118fa16660a55dd8691ba15cb1fdb69ff60592734e1791e0
Instruction Fuzzy Hash: 62610171A01115ABDB209F24DC40ABE37A5AB11314F62853FE943B72D0DA3E5AA2CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __edi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				void* _t81;
				void* _t82;
				WCHAR* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402CAE(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405DA6( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t84 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405D2F(E0040645A(_t84, L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren\\Parfaits\\Produktoversigts\\Newcomers\\Igennen")), ??);
				} else {
					E0040645A();
				}
				E004066EE(_t84);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040679D(_t84);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00405F2B(_t84);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00405F50(_t84, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004054C2(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x42a2e8;
						goto L32;
					} else {
						E0040645A("C:\Users\hardz\AppData\Local\Temp\nszA331.tmp", _t81);
						E0040645A(_t81, _t84);
						E0040647C(_t77, _t81, _t84, "C:\Users\hardz\AppData\Local\Temp\nszA331.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x1c)));
						E0040645A(_t81, "C:\Users\hardz\AppData\Local\Temp\nszA331.tmp");
						_t64 = E00405AC0("C:\Users\hardz\AppData\Local\Temp\nszA331.tmp\System.dll",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x42a2e8 =  &( *0x42a2e8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t84);
								_push(0xfffffffa);
								E004054C2();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004054C2(0xffffffea,  *(_t86 - 8));
				 *0x42a314 =  *0x42a314 + 1;
				_t45 = E0040323E(_t79,  *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x42a314 =  *0x42a314 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t82 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 0x38)); // executed
				__eflags = _t82 - _t77;
				if(_t82 >= _t77) {
					goto L31;
				} else {
					__eflags = _t82 - 0xfffffffe;
					if(_t82 != 0xfffffffe) {
						E0040647C(_t77, _t82, _t84, _t84, 0xffffffee);
					} else {
						E0040647C(_t77, _t82, _t84, _t84, 0xffffffe9);
						lstrcatW(_t84,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t84);
					E00405AC0();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x004028f8
0x004028f8
0x00402b32
0x00402b35
0x00402b35
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402b3b
0x00402b3b
0x00402b3b
0x00401867
0x00401867
0x00401868
0x00401493
0x00402364
0x00402364
0x00402364
0x00401865
0x0040185e
0x00402b3d
0x00402b41
0x00402b41
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x0040235f
0x00000000
0x0040235f
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen,?,?,00000031), ref: 004017D5

Part of subcall function 0040645A: lstrcpynW.KERNEL32(?,?,00000400,004035DE,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00406467

Part of subcall function 004054C2: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000,?), ref: 004054FA
Part of subcall function 004054C2: lstrlenW.KERNEL32(00402F75,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000), ref: 0040550A
Part of subcall function 004054C2: lstrcatW.KERNEL32(00422708,00402F75), ref: 0040551D
Part of subcall function 004054C2: SetWindowTextW.USER32(00422708,00422708), ref: 0040552F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405555
Part of subcall function 004054C2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040556F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040557D

Strings

C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 00401796, 004017A3, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nszA331.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen, xrefs: 0040179E

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nszA331.tmp$C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen$Call
API String ID: 1941528284-2838258272
Opcode ID: 3bb3f279306cb22ac19bd2f71b5c3bb254d1399a618fb2e445a0c35035f9bca4
Instruction ID: 088e12f10c3cb373d8408577146b49c59907c82832dbc4e7572f66c2a45f43bc
Opcode Fuzzy Hash: 3bb3f279306cb22ac19bd2f71b5c3bb254d1399a618fb2e445a0c35035f9bca4
Instruction Fuzzy Hash: AF41A371500514BACF11BFB5CD85DAF3A79EF45329B20833BF412B10E2CA3C8A519A6E

Uniqueness

Uniqueness Score: -1.00%

Function 004067C4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004067C4(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004067db
0x004067e4
0x004067e6
0x004067e6
0x004067ea
0x004067fd
0x004067f7
0x004067f7
0x004067f7
0x00406816
0x0040682a
0x00406831

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067DB
wsprintfW.USER32 ref: 00406816
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040682A

Strings

UXTHEME, xrefs: 004067CD
%s%S.dll, xrefs: 00406810
\, xrefs: 004067EC

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 2246286b17e446ac71eff5691fc61922658998926feb549f5fad11386bdf7f8a
Instruction ID: 6d7fcad042a976f9a3f3876a7abc718542b87dfe0e8a573ab7ae7e6c2a05a1c8
Opcode Fuzzy Hash: 2246286b17e446ac71eff5691fc61922658998926feb549f5fad11386bdf7f8a
Instruction Fuzzy Hash: ABF02B30510219ABCB14AB68DD0DF9B366CAB00708F50407EA546F20E1EB7CDB79CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00405991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405991(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x0040599c
0x004059a0
0x004059a3
0x004059a9
0x004059ad
0x004059b1
0x004059b9
0x004059c0
0x004059c6
0x004059cd
0x004059d4
0x004059dc
0x004059de
0x00000000
0x004059de
0x004059e8
0x004059ef
0x00405a05
0x00000000
0x00000000
0x00000000
0x00405a07
0x00405a0b

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004059D4
GetLastError.KERNEL32 ref: 004059E8
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004059FD
GetLastError.KERNEL32 ref: 00405A07

Strings

C:\Users\user\Desktop, xrefs: 00405991

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-1669384263
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: 0468d62e4b87f4570f17c4cd3b42bc76721d6f48e2d5b934744452ac4f6659f1
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 670108B1D10219EADF00DFA1C9447EFBBB8EB14354F10413AD544B6281E7789608CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405F7F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405F7F(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a58c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00405f85
0x00405f8b
0x00405f8c
0x00405f8c
0x00405f91
0x00405f92
0x00405f95
0x00405f9a
0x00405f9d
0x00405fa7
0x00405fb4
0x00405fb8
0x00405fc0
0x00000000
0x00000000
0x00405fc4
0x00000000
0x00405fc6
0x00405fc6
0x00405fc6
0x00405fc9
0x00405fcc
0x00405fcc
0x00405fcf
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405F9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\XShSI2OXaC.exe",0040350B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757), ref: 00405FB8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F84, 00405F88
nsa, xrefs: 00405F8C
"C:\Users\user\Desktop\XShSI2OXaC.exe", xrefs: 00405F7F

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\XShSI2OXaC.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1149976824
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 03b87ce23cd6a6552514e4f1bc146aa9ebe3897547b6c55ce0c2271991856126
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 70F06D76600304BBEB008F59DE05E9BBBB8EB95710F10803AED00B7240E6B4A9548B64

Uniqueness

Uniqueness Score: -1.00%

Function 73791777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E73791777(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v136;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x7379506c = _a8;
				 *0x73795070 = _a16;
				 *0x73795074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x73795048, E737915B1);
				_push(1); // executed
				_t37 = E73791B5F(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E7379239E(_t54);
					}
					_push(_t54);
					E737923E0(_t67);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x1010) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_push(_t54);
								_t37 = E737925B5();
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x1018; // 0x1018
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E737915C6(_t54,  &_v136);
								 *(_t54 + 0x1034) =  *(_t54 + 0x1034) & 0x00000000;
								_t18 = _t54 + 0x1018; // 0x1018
								_t72 = _t18;
								_push(_t54);
								 *((intOrPtr*)(_t54 + 0x1020)) = _t42;
								 *_t72 = 4;
								E737925B5();
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							_push(_t54);
							E737925B5();
							_t37 = GlobalFree(E73791272(E737915B4(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E73792578(_t54);
							if(( *(_t54 + 0x1010) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x1008);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x1010) & 0x00000020) != 0) {
								_t37 = E7379153D( *0x73795068);
							}
						}
						if(( *(_t54 + 0x1010) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E73792D83(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E73792AF8(_t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E73792770(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x73791777
0x73791777
0x73791777
0x73791784
0x7379178c
0x73791799
0x737917a7
0x737917aa
0x737917ac
0x737917b1
0x737917b6
0x737918d8
0x737918d8
0x737917bc
0x737917c0
0x737917c3
0x737917c8
0x737917c9
0x737917ca
0x737917d0
0x737917d6
0x73791806
0x7379180d
0x73791831
0x7379187e
0x7379187f
0x73791833
0x73791833
0x73791834
0x7379183d
0x7379183e
0x73791848
0x7379184b
0x73791850
0x73791857
0x73791857
0x7379185d
0x7379185e
0x73791864
0x7379186a
0x73791877
0x73791878
0x7379187b
0x7379180f
0x7379180f
0x73791810
0x73791825
0x73791825
0x73791889
0x7379188c
0x73791899
0x737918a0
0x737918a8
0x737918ab
0x737918ab
0x737918a8
0x737918b8
0x737918c0
0x737918c5
0x737918b8
0x737918cd
0x00000000
0x737918cf
0x00000000
0x737918d0
0x737918cd
0x737917da
0x737917dd
0x737917fb
0x00000000
0x00000000
0x737917fe
0x73791803
0x73791803
0x73791805
0x00000000
0x73791805
0x737917df
0x737917e0
0x737917e8
0x737917e9
0x00000000
0x737917e9
0x737917e2
0x737917e3
0x737917f1
0x00000000
0x737917f1
0x737917e6
0x00000000
0x00000000
0x00000000
0x737917e6

APIs

Part of subcall function 73791B5F: GlobalFree.KERNEL32 ref: 73791DD4
Part of subcall function 73791B5F: GlobalFree.KERNEL32 ref: 73791DD9
Part of subcall function 73791B5F: GlobalFree.KERNEL32 ref: 73791DDE

GlobalFree.KERNEL32 ref: 73791825
FreeLibrary.KERNEL32(?), ref: 737918AB
GlobalFree.KERNEL32 ref: 737918D0

Part of subcall function 7379239E: GlobalAlloc.KERNEL32(00000040,?), ref: 737923CF

Part of subcall function 73792770: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,737917F6,00000000), ref: 73792840

Part of subcall function 737915C6: wsprintfW.USER32 ref: 737915F4

Strings

, xrefs: 737918B1

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 194ae4fe3ec1407f6ecedafb4ecf1141a339948bd9ba424b370ad56bc8541479
Instruction ID: 1bb03e830dd1cd872c41f4bb6cb842bd798b531e899bad470f29d62f0263cd1b
Opcode Fuzzy Hash: 194ae4fe3ec1407f6ecedafb4ecf1141a339948bd9ba424b370ad56bc8541479
Instruction Fuzzy Hash: 984194B15003099FFB11AF74B988B9537BCBB04320F5943A5E90BAB1C5DB788055E768

Uniqueness

Uniqueness Score: -1.00%

Function 00402451 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00402451(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
				void* _t20;
				void* _t21;
				int _t24;
				long _t25;
				char _t27;
				int _t30;
				void* _t32;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t42 = __eflags;
				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x20));
				_t34 = __eax;
				 *(_t39 - 0xc) =  *(_t39 - 0x1c);
				 *(_t39 - 0x44) = E00402CAE(2);
				_t20 = E00402CAE(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402D3E(_t42, _t34, _t20, 2); // executed
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402CAE(0x23);
						_t24 = lstrlenW(0x40b5d8) + _t29 + 2;
					}
					if(_t37 == 4) {
						_t27 = E00402C8C(3);
						_pop(_t32);
						 *0x40b5d8 = _t27;
						 *((intOrPtr*)(_t39 - 0x38)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E0040323E(_t32,  *((intOrPtr*)(_t39 - 0x24)), _t30, 0x40b5d8, 0x1800); // executed
					}
					_t25 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x44), _t30,  *(_t39 - 0xc), 0x40b5d8, _t24); // executed
					if(_t25 == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey(); // executed
				}
				 *0x42a2e8 =  *0x42a2e8 +  *(_t39 - 4);
				return 0;
			}

0x00402451
0x00402451
0x00402451
0x00402451
0x00402454
0x0040245b
0x00402465
0x00402468
0x00402471
0x00402478
0x0040247f
0x00402482
0x00402488
0x00402492
0x00402496
0x004024a1
0x004024a1
0x004024a8
0x004024ac
0x004024b1
0x004024b2
0x004024b8
0x004024bb
0x004024bb
0x004024bf
0x004024cb
0x004024cb
0x004024dc
0x004024e4
0x004024e6
0x004024e6
0x004024e9
0x004025c4
0x004025c4
0x00402b35
0x00402b41

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nszA331.tmp,00000023,00000011,00000002), ref: 0040249C
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nszA331.tmp,00000000,00000011,00000002), ref: 004024DC
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nszA331.tmp,00000000,00000011,00000002), ref: 004025C4

Strings

C:\Users\user\AppData\Local\Temp\nszA331.tmp, xrefs: 0040248D, 0040249B, 004024B2, 004024C6, 004024D1

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszA331.tmp
API String ID: 2655323295-3291111590
Opcode ID: 6bee69b95db978d3851d2fe75a0e6ee6fec4aef819bceba135d0bebbb85a6eb2
Instruction ID: 088c479aae8dfe5a7a97ac498c39c4dfd66ebb0fe962a6a90ad52b8ee8420bed
Opcode Fuzzy Hash: 6bee69b95db978d3851d2fe75a0e6ee6fec4aef819bceba135d0bebbb85a6eb2
Instruction Fuzzy Hash: C9118171D00108BFEB10AFA5CF89E9EBBB4EB04318F11803BF504B71D1D6B85E419A68

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402CAE(0xfffffff0);
				_t17 = E00405DDA(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405D5C(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405A0E( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405A2B(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405991( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040645A(L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren\\Parfaits\\Produktoversigts\\Newcomers\\Igennen",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022b8
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402b35
0x00402b41

APIs

Part of subcall function 00405DDA: CharNextW.USER32(?,?,00425F30,?,00405E4E,00425F30,00425F30,?,?,74D0F560,00405B8C,?,C:\Users\user\AppData\Local\Temp\,74D0F560,00000000), ref: 00405DE8
Part of subcall function 00405DDA: CharNextW.USER32(00000000), ref: 00405DED
Part of subcall function 00405DDA: CharNextW.USER32(00000000), ref: 00405E05

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405991: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004059D4

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen
API String ID: 1892508949-1234864624
Opcode ID: 793dd7b3b19857af4a0e0fefb96a96c2fe23c1e285611cac52a4787c957f86ca
Instruction ID: 2016d30a3330e4b6f1ba34d0909441968a8e96b478f2141d07c886e520013afc
Opcode Fuzzy Hash: 793dd7b3b19857af4a0e0fefb96a96c2fe23c1e285611cac52a4787c957f86ca
Instruction Fuzzy Hash: ED11E631504105EBCF206FA5CD4159F36B0EF15329B25863BEA45B22F1D63E8D829B5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405E37 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405E37(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040645A(0x425f30, _a4);
				_t21 = E00405DDA(0x425f30);
				if(_t21 != 0) {
					E004066EE(_t21);
					if(( *0x42a25c & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x425f30 >> 1;
						while(1) {
							_t11 = lstrlenW(0x425f30);
							_push(0x425f30);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040679D();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405D7B(0x425f30);
								continue;
							} else {
								goto L1;
							}
						}
						E00405D2F();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405e43
0x00405e4e
0x00405e52
0x00405e59
0x00405e65
0x00405e75
0x00405e77
0x00405e8f
0x00405e90
0x00405e97
0x00405e98
0x00000000
0x00000000
0x00405e7b
0x00405e82
0x00405e8a
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e82
0x00405e9a
0x00405ea0
0x00000000
0x00405eae
0x00405e67
0x00405e6d
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e6d
0x00405e54
0x00000000

APIs

Part of subcall function 0040645A: lstrcpynW.KERNEL32(?,?,00000400,004035DE,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00406467

Part of subcall function 00405DDA: CharNextW.USER32(?,?,00425F30,?,00405E4E,00425F30,00425F30,?,?,74D0F560,00405B8C,?,C:\Users\user\AppData\Local\Temp\,74D0F560,00000000), ref: 00405DE8
Part of subcall function 00405DDA: CharNextW.USER32(00000000), ref: 00405DED
Part of subcall function 00405DDA: CharNextW.USER32(00000000), ref: 00405E05

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,74D0F560,00405B8C,?,C:\Users\user\AppData\Local\Temp\,74D0F560,00000000), ref: 00405E90
GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74D0F560,00405B8C,?,C:\Users\user\AppData\Local\Temp\,74D0F560), ref: 00405EA0

Strings

0_B, xrefs: 00405E3D

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: 491221ec7326074acdff1dece0323ce80f0c3982553ff7528897c676bf08b823
Instruction ID: e6031a14b14941d42d1cb20f3e35c1b242d34d4e1ec9dabe8368cf47277bf097
Opcode Fuzzy Hash: 491221ec7326074acdff1dece0323ce80f0c3982553ff7528897c676bf08b823
Instruction Fuzzy Hash: 37F0D135105DA115E622333A8C09BBF2644CF9275875A453BFCD2B12D1DB3C8A5388BE

Uniqueness

Uniqueness Score: -1.00%

Function 00405436 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405436(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t9;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x423714 != _t16) {
							_push(_t16);
							_push(6);
							 *0x423714 = _t16;
							E00404E02();
						}
						L11:
						_t9 = CallWindowProcW( *0x42371c, _a4, _t15, _a12, _t16); // executed
						return _t9;
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404D82(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404413(0x413);
				return 0;
			}

0x0040543a
0x00405444
0x00405460
0x00405482
0x00405485
0x0040548b
0x00405495
0x00405496
0x00405498
0x0040549e
0x0040549e
0x004054a8
0x004054b6
0x00000000
0x004054b6
0x0040546d
0x004054a5
0x004054a5
0x00000000
0x004054a5
0x00405479
0x0040547b
0x00000000
0x0040547b
0x0040544a
0x00000000
0x00000000
0x00405451
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405465
CallWindowProcW.USER32(?,?,?,?), ref: 004054B6

Part of subcall function 00404413: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404425

Strings

, xrefs: 00405446

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ba716424e89f7f649620ec3ee79230d51b1885f0f7131c6702fb800af6777035
Instruction ID: 943258d488ff89cce01bfc53072d28cab2a854201efd430f58087e3cd3bd142b
Opcode Fuzzy Hash: ba716424e89f7f649620ec3ee79230d51b1885f0f7131c6702fb800af6777035
Instruction Fuzzy Hash: 09018471200609AFEF205F11DD84BEB3726EB84366F508037FA00B61D1C77E8DD29A69

Uniqueness

Uniqueness Score: -1.00%

Function 00406328 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406328(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004062C7(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20); // executed
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00406336
0x00406338
0x00406350
0x00406355
0x0040635a
0x00406398
0x00406398
0x0040635c
0x0040636e
0x00406379
0x0040637f
0x0040638a
0x00000000
0x00000000
0x0040638a
0x0040639e

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040659C,80000002), ref: 0040636E
RegCloseKey.KERNELBASE(?,?,0040659C,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406379

Strings

Call, xrefs: 0040632F

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: 7e3ce39a040f51104dfe9269829ffab2c4423c4c057b4bbcd4c2e1a0e9819f34
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: D7017C72500209EADF218F51CD09EDB3BA8EB55364F01843AFD16A6190D779E968CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A43(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x426730->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x426730,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405a4c
0x00405a6c
0x00405a74
0x00405a79
0x00000000
0x00405a7f
0x00405a83

APIs

CreateProcessW.KERNELBASE ref: 00405A6C
CloseHandle.KERNEL32(?), ref: 00405A79

Strings

Error launching installer, xrefs: 00405A56

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 9e1ad0bc479b82ef78ec904826176fb2618adfd8e1efed676ce36e4e1c44c044
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: A3E04FB4A002097FEB009B64ED45F7B76ACFB04308F408531BD00F2150D77498108A78

Uniqueness

Uniqueness Score: -1.00%

Function 00406F99 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406F99() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00407407))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406f99
0x00406f99
0x00406f99
0x00406f99
0x00406f9f
0x00406fa3
0x00406fa7
0x00406fb1
0x00406fbf
0x00407295
0x00407295
0x00407298
0x0040729f
0x004072cc
0x004072cc
0x004072d0
0x00000000
0x00000000
0x004072d2
0x004072db
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f3
0x0040730c
0x0040730f
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x00407304
0x00407307
0x00407307
0x00407329
0x004072c9
0x004072c9
0x004072c9
0x004072cc
0x004072d0
0x00000000
0x00000000
0x00000000
0x0040732b
0x0040732b
0x004072a4
0x004072a8
0x004073e0
0x004073e0
0x004073ea
0x004073f2
0x004073f9
0x004073fb
0x00407402
0x00407406
0x00407406
0x004072ae
0x004072b4
0x004072bb
0x004072c3
0x004072c3
0x004072c6
0x00000000
0x004072c6
0x00407330
0x0040733d
0x00407340
0x0040724c
0x0040724c
0x0040724c
0x004069e8
0x004069e8
0x004069e8
0x004069f1
0x00000000
0x00000000
0x004069f7
0x004069f7
0x00000000
0x004069fe
0x00406a02
0x00000000
0x00000000
0x00406a08
0x00406a0b
0x00406a0e
0x00406a11
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a61
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a63
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00407353
0x00000000
0x00407353
0x00406aad
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406acf
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406ad7
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00407362
0x00000000
0x00407362
0x00406b1d
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407221
0x00407225
0x004073d4
0x004073d4
0x00000000
0x004073d4
0x0040722b
0x00407231
0x00407238
0x00407240
0x00407243
0x00407246
0x00407246
0x0040724c
0x0040724c
0x00000000
0x00000000
0x00406b64
0x00406b64
0x00406b66
0x00406b69
0x00406bda
0x00406bda
0x00406bdd
0x00406be0
0x00406be7
0x00406bf1
0x00000000
0x00406bf1
0x00406b6b
0x00406b6b
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b8c
0x00406b90
0x00406b97
0x00406b9a
0x00406ba1
0x00406ba5
0x00406bad
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb1
0x00406bb4
0x00406bd2
0x00406bd2
0x00406bd4
0x00000000
0x00406bb6
0x00406bb6
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00000000
0x00406bcd
0x00000000
0x00406e03
0x00406e03
0x00406e07
0x00406e25
0x00406e25
0x00406e28
0x00406e2f
0x00406e32
0x00406e35
0x00406e38
0x00406e3b
0x00406e3e
0x00406e40
0x00406e47
0x00406e48
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e53
0x00406e58
0x00000000
0x00406e58
0x00406e09
0x00406e09
0x00406e0c
0x00406e0f
0x00406e19
0x00000000
0x00000000
0x00406e6d
0x00406e6d
0x00406e71
0x00406e94
0x00406e97
0x00406e9a
0x00406ea4
0x00406e73
0x00406e73
0x00406e76
0x00406e79
0x00406e7c
0x00406e89
0x00406e8c
0x00406e8c
0x00000000
0x00000000
0x00406eb0
0x00406eb0
0x00406eb4
0x00000000
0x00000000
0x00406eba
0x00406eba
0x00406ebe
0x00000000
0x00000000
0x00406ec4
0x00406ec4
0x00406ec6
0x00406eca
0x00406eca
0x00406ecd
0x00406ed1
0x00000000
0x00000000
0x00406f21
0x00406f21
0x00406f25
0x00406f2c
0x00406f2c
0x00406f2f
0x00406f32
0x00406f3c
0x00000000
0x00406f3c
0x00406f27
0x00406f27
0x00000000
0x00000000
0x00406f48
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00406f62
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00406f75
0x00406f7a
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406bfd
0x00406bfd
0x00406c01
0x0040736e
0x0040736e
0x00000000
0x0040736e
0x00406c07
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1c
0x00406c1f
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00000000
0x00000000
0x00406c2e
0x00406c2e
0x00406c34
0x00000000
0x00000000
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c98
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca1
0x00406ca8
0x00406cab
0x00000000
0x00406cb1
0x00406cb1
0x00000000
0x00406cb1
0x00000000
0x00406cb6
0x00406cb6
0x00406cba
0x0040737a
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cdb
0x00406cdb
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d29
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d2e
0x00406d35
0x00406d38
0x00000000
0x00406d3a
0x00406d3a
0x00000000
0x00406d3a
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d3f
0x00000000
0x00000000
0x00406d7a
0x00406d7a
0x00406d7e
0x00407386
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d99
0x00406d9c
0x00406d9f
0x00406d9f
0x00406da5
0x00406d43
0x00406d43
0x00406d46
0x00000000
0x00406d46
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406ded
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df2
0x00406df9
0x00406dfc
0x00000000
0x00406dfe
0x00406dfe
0x00000000
0x00406dfe
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00406e5b
0x00406e5b
0x00406e5e
0x00000000
0x00000000
0x0040719a
0x0040719a
0x0040719e
0x004071c0
0x004071c0
0x004071c3
0x004071cd
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071a0
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071aa
0x004071ad
0x00000000
0x00000000
0x00407257
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x0040728e
0x0040728e
0x00407295
0x00407298
0x0040729f
0x00000000
0x004072a2
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x004071b1
0x004071b1
0x004071b4
0x00000000
0x00000000
0x00407348
0x00407348
0x0040734b
0x0040724c
0x0040724c
0x0040724c
0x00000000
0x00407252
0x00000000
0x00406f82
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00000000
0x00000000
0x00407295
0x00407295
0x00407298
0x0040729f
0x00000000
0x004072a2
0x00000000
0x00000000
0x00000000
0x00406fc7
0x00406fc7
0x00406fca
0x00407000
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407060
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00406d49
0x00406d49
0x00406d4d
0x00407392
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00000000
0x00000000
0x00406ed4
0x00406ed4
0x00406ed8
0x0040739e
0x0040739e
0x00000000
0x0040739e
0x00406ede
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0a
0x00406f0d
0x00406f0f
0x00406f0f
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00407195
0x00406f12
0x00406f12
0x00000000
0x00406f12
0x00407193
0x004073c8
0x004073c8
0x00000000
0x00000000
0x004069f7
0x004073ff
0x004073ff
0x00000000
0x004073ff
0x0040724c
0x004072cc
0x00407295

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb824aa3d6bfae4ea77618790af0ce8a9e99a26b41ca780ec9b1e8eb3763fbb
Instruction ID: 787052346475902db0e50da7fadcef915d0c619ac143c44cd2a916fdd4444317
Opcode Fuzzy Hash: bcb824aa3d6bfae4ea77618790af0ce8a9e99a26b41ca780ec9b1e8eb3763fbb
Instruction Fuzzy Hash: 99A14171E04229CBDF28CFA8C8546ADBBB1FF44305F14816ED856BB281C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040719A Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040719A() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407407))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x0040719a
0x0040719a
0x0040719e
0x004071c3
0x004071cd
0x00000000
0x004071a0
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071ad
0x004071b1
0x004071b1
0x004071b4
0x0040728e
0x0040728e
0x00407295
0x00407295
0x00407298
0x0040729f
0x004072cc
0x004072d0
0x00407330
0x00407333
0x00407338
0x00407339
0x0040733b
0x0040733d
0x00407340
0x0040724c
0x0040724c
0x0040724c
0x004069e8
0x004069e8
0x004069e8
0x004069f1
0x00000000
0x00000000
0x004069f7
0x00000000
0x00406a02
0x00000000
0x00000000
0x00406a0b
0x00406a0e
0x00406a11
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a61
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00000000
0x00407353
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00000000
0x00407362
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407221
0x00407225
0x004073d4
0x00000000
0x004073d4
0x00407231
0x00407238
0x00407240
0x00407243
0x00407246
0x00407246
0x00000000
0x00000000
0x00406b64
0x00406b66
0x00406b69
0x00406bda
0x00406bdd
0x00406be0
0x00406be7
0x00406bf1
0x00000000
0x00406bf1
0x00406b6b
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b8c
0x00406b90
0x00406b97
0x00406b9a
0x00406ba1
0x00406ba5
0x00406bad
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb1
0x00406bb4
0x00406bd2
0x00406bd4
0x00000000
0x00406bb6
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00000000
0x00406bcd
0x00000000
0x00406e03
0x00406e07
0x00406e25
0x00406e28
0x00406e2f
0x00406e32
0x00406e35
0x00406e38
0x00406e3b
0x00406e3e
0x00406e40
0x00406e47
0x00406e48
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e53
0x00406e58
0x00000000
0x00406e58
0x00406e09
0x00406e0c
0x00406e0f
0x00406e19
0x00000000
0x00000000
0x00406e6d
0x00406e71
0x00406e94
0x00406e97
0x00406e9a
0x00406ea4
0x00406e73
0x00406e73
0x00406e76
0x00406e79
0x00406e7c
0x00406e89
0x00406e8c
0x00406e8c
0x00000000
0x00000000
0x00406eb0
0x00406eb4
0x00000000
0x00000000
0x00406eba
0x00406ebe
0x00000000
0x00000000
0x00406ec4
0x00406ec6
0x00406eca
0x00406eca
0x00406ecd
0x00406ed1
0x00000000
0x00000000
0x00406f21
0x00406f25
0x00406f2c
0x00406f2f
0x00406f32
0x00406f3c
0x00000000
0x00406f3c
0x00406f27
0x00000000
0x00000000
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00406f62
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00406f75
0x00406f7a
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406bfd
0x00406bfd
0x00406c01
0x0040736e
0x00000000
0x0040736e
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1c
0x00406c1f
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00000000
0x00000000
0x00406c2e
0x00406c34
0x00000000
0x00000000
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c98
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca1
0x00406ca8
0x00406cab
0x00000000
0x00406cb1
0x00000000
0x00406cb1
0x00000000
0x00406cb6
0x00406cb6
0x00406cba
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cdb
0x00406cdb
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d29
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d2e
0x00406d35
0x00406d38
0x00000000
0x00406d3a
0x00000000
0x00406d3a
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d3f
0x00000000
0x00000000
0x00406d7a
0x00406d7a
0x00406d7e
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d99
0x00406d9c
0x00406d9f
0x00406d9f
0x00406da5
0x00406d43
0x00406d43
0x00406d46
0x00000000
0x00406d46
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406ded
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df2
0x00406df9
0x00406dfc
0x00000000
0x00406dfe
0x00000000
0x00406dfe
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00406e5b
0x00406e5b
0x00406e5e
0x004071d0
0x004071d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x00000000
0x00407287
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x00000000
0x00000000
0x00407348
0x0040734b
0x0040724c
0x0040724c
0x00000000
0x00000000
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00406f99
0x00406f9c
0x00406f9f
0x00406fa1
0x00406fa3
0x00406fa3
0x00406fa4
0x00406fa7
0x00406fae
0x00406fb1
0x00406fbf
0x00000000
0x00000000
0x00000000
0x00000000
0x004072a4
0x004072a4
0x004072a8
0x004073e0
0x00000000
0x004073e0
0x004072ae
0x004072b1
0x004072b4
0x004072b8
0x004072bb
0x004072c1
0x004072c3
0x004072c3
0x004072c3
0x004072c6
0x004072c9
0x004072c9
0x004072c9
0x004072c9
0x00000000
0x00000000
0x00406fc7
0x00406fca
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00406d49
0x00406d49
0x00406d4d
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00000000
0x00000000
0x00406ed4
0x00406ed4
0x00406ed8
0x0040739e
0x00000000
0x0040739e
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0a
0x00406f0d
0x00406f0f
0x00406f0f
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00406f12
0x00406f12
0x00000000
0x00406f12
0x00407193
0x004073c8
0x004073ea
0x004073f0
0x004073f2
0x004073f9
0x004073fb
0x00407402
0x00407406
0x00000000
0x004069f7
0x004073ff
0x004073ff
0x00000000
0x004073ff
0x0040724c
0x004072d2
0x004072d8
0x004072db
0x004072de
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f3
0x0040730c
0x0040730f
0x00407312
0x00407315
0x00407319
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x004072fd
0x00407302
0x00407304
0x00407307
0x00407307
0x00407329
0x00000000
0x0040732b
0x00000000
0x0040732b
0x00407329
0x00000000
0x0040719e

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a178063e2ca668e273fcb8a443769117e6cfd6f12765fddb700c66be367be036
Instruction ID: 3f6777c3859c482fa21d62fe0a5f76598eeb60cc927c34454840c503d2dbd6b6
Opcode Fuzzy Hash: a178063e2ca668e273fcb8a443769117e6cfd6f12765fddb700c66be367be036
Instruction Fuzzy Hash: B2912070E04229CBEF28CF98C8547ADBBB1FB44305F14816ED856BB281C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406EB0 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406EB0() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00407407))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406eb0
0x00406eb0
0x00406eb4
0x00406f6b
0x00406f6e
0x00406f7a
0x00406e5b
0x00406e5b
0x00406e5e
0x004071d0
0x004071d0
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00407246
0x00407246
0x0040724c
0x0040724c
0x00000000
0x00407221
0x00407221
0x00407225
0x004073d4
0x00000000
0x004073d4
0x00407231
0x00407238
0x00407240
0x00407243
0x00000000
0x00407243
0x00406eba
0x00406ebe
0x004073ff
0x004073ff
0x00407402
0x00407406
0x00407406
0x00406ec4
0x00406eca
0x00406ecd
0x00406ed1
0x00406ed4
0x00406ed8
0x0040739e
0x004073ea
0x004073f2
0x004073f9
0x004073fb
0x00000000
0x004073fb
0x00406ede
0x00406ee1
0x00406ee7
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f12
0x00406f12
0x00406f12
0x004069e8
0x004069e8
0x004069f1
0x00000000
0x00000000
0x004069f7
0x00000000
0x00406a02
0x00000000
0x00000000
0x00406a0b
0x00406a0e
0x00406a11
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a61
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00000000
0x00407353
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00000000
0x00407362
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b64
0x00406b66
0x00406b69
0x00406bda
0x00406bdd
0x00406be0
0x00406be7
0x00406bf1
0x00000000
0x00406bf1
0x00406b6b
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b8c
0x00406b90
0x00406b97
0x00406b9a
0x00406ba1
0x00406ba5
0x00406bad
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb1
0x00406bb4
0x00406bd2
0x00406bd4
0x00000000
0x00406bb6
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00000000
0x00406bcd
0x00000000
0x00406e03
0x00406e07
0x00406e25
0x00406e28
0x00406e2f
0x00406e32
0x00406e35
0x00406e38
0x00406e3b
0x00406e3e
0x00406e40
0x00406e47
0x00406e48
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e53
0x00406e58
0x00000000
0x00406e58
0x00406e09
0x00406e0c
0x00406e0f
0x00406e19
0x00000000
0x00000000
0x00406e6d
0x00406e71
0x00406e94
0x00406e97
0x00406e9a
0x00406ea4
0x00406e73
0x00406e73
0x00406e76
0x00406e79
0x00406e7c
0x00406e89
0x00406e8c
0x00406e8c
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f21
0x00406f25
0x00406f2c
0x00406f2f
0x00406f32
0x00406f3c
0x00000000
0x00406f3c
0x00406f27
0x00000000
0x00000000
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00406f62
0x00406f62
0x00406f65
0x00406f68
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406bfd
0x00406bfd
0x00406c01
0x0040736e
0x00000000
0x0040736e
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1c
0x00406c1f
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00000000
0x00000000
0x00406c2e
0x00406c34
0x00000000
0x00000000
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c98
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca1
0x00406ca8
0x00406cab
0x00000000
0x00406cb1
0x00000000
0x00406cb1
0x00000000
0x00406cb6
0x00406cb6
0x00406cba
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cdb
0x00406cdb
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d29
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d2e
0x00406d35
0x00406d38
0x00000000
0x00406d3a
0x00000000
0x00406d3a
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d3f
0x00000000
0x00000000
0x00406d7a
0x00406d7a
0x00406d7e
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d99
0x00406d9c
0x00406d9f
0x00406d9f
0x00406da5
0x00406d43
0x00406d43
0x00406d46
0x00000000
0x00406d46
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406ded
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df2
0x00406df9
0x00406dfc
0x00000000
0x00406dfe
0x00000000
0x00406dfe
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00000000
0x00000000
0x0040719a
0x0040719e
0x004071c0
0x004071c3
0x004071cd
0x00000000
0x004071cd
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071aa
0x004071ad
0x00000000
0x00000000
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x0040728e
0x0040728e
0x00000000
0x0040728e
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x004071b1
0x004071b1
0x004071b4
0x00000000
0x00000000
0x00407348
0x0040734b
0x00000000
0x00000000
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00406f99
0x00406f9c
0x00406f9f
0x00406fa1
0x00406fa3
0x00406fa3
0x00406fa4
0x00406fa7
0x00406fae
0x00406fb1
0x00406fbf
0x00000000
0x00000000
0x00407295
0x00407295
0x00407298
0x0040729f
0x00000000
0x00000000
0x004072a4
0x004072a4
0x004072a8
0x004073e0
0x00000000
0x004073e0
0x004072ae
0x004072b1
0x004072b4
0x004072b8
0x004072bb
0x004072c1
0x004072c3
0x004072c3
0x004072c3
0x004072c6
0x004072c9
0x004072c9
0x004072c9
0x004072c9
0x004072cc
0x004072cc
0x004072d0
0x00407330
0x00407333
0x00407338
0x00407339
0x0040733b
0x0040733d
0x00407340
0x00000000
0x00407340
0x004072d2
0x004072d8
0x004072db
0x004072de
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f0
0x004072f3
0x0040730c
0x0040730f
0x00407312
0x00407315
0x00407319
0x0040731b
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x004072fd
0x00407302
0x00407304
0x00407307
0x00407307
0x00407322
0x00407329
0x00000000
0x0040732b
0x00000000
0x0040732b
0x00000000
0x00406fc7
0x00406fca
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00406d49
0x00406d49
0x00406d4d
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00000000
0x00000000
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00000000
0x00407195
0x00407193
0x004073c8
0x00000000
0x00000000
0x004069f7

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346bd4f3c27d7dde9b72e14a6b0068c2668dba954f918e3fef8b29573b0bbf66
Instruction ID: 04ec7917a297b0a8186c352c846544deb4f48db61cad2b6cfa21376e3d6f7739
Opcode Fuzzy Hash: 346bd4f3c27d7dde9b72e14a6b0068c2668dba954f918e3fef8b29573b0bbf66
Instruction Fuzzy Hash: F4815771E04228CFDF24CFA8C8847ADBBB1FB45301F25816AD856BB281C7789986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004069B5 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004069B5(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00407407))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x004069c5
0x004069cc
0x004069d2
0x004069d8
0x00000000
0x004069dc
0x004069e8
0x004069e8
0x004069e8
0x004069f1
0x00000000
0x00000000
0x004069f7
0x00000000
0x004069fe
0x00406a02
0x00000000
0x00000000
0x00406a0b
0x00406a0e
0x00406a11
0x00406a13
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a5e
0x00406a61
0x00406a89
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a63
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7b
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00000000
0x00407353
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406ad2
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406ad7
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af4
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00000000
0x00407362
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3a
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e2
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x00407218
0x0040721f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407221
0x00407221
0x00407225
0x004073d4
0x00000000
0x004073d4
0x00407231
0x00407238
0x00407240
0x00407240
0x00407240
0x00407243
0x00407246
0x00407246
0x00000000
0x00000000
0x00406b64
0x00406b66
0x00406b69
0x00406bda
0x00406bdd
0x00406be0
0x00406be7
0x00406bf1
0x00000000
0x00406bf1
0x00406b6b
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b8c
0x00406b90
0x00406b97
0x00406b9a
0x00406ba1
0x00406ba5
0x00406bad
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb1
0x00406bb4
0x00406bd2
0x00406bd4
0x00000000
0x00406bd4
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00000000
0x00000000
0x00406e03
0x00406e07
0x00406e25
0x00406e28
0x00406e2f
0x00406e32
0x00406e35
0x00406e38
0x00406e3b
0x00406e3e
0x00406e40
0x00406e47
0x00406e48
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e53
0x00406e58
0x00000000
0x00406e58
0x00406e09
0x00406e0c
0x00406e0f
0x00406e19
0x00000000
0x00000000
0x00406e6d
0x00406e71
0x00406e94
0x00406e97
0x00406e9a
0x00406ea4
0x00406e73
0x00406e73
0x00406e76
0x00406e79
0x00406e7c
0x00406e89
0x00406e8c
0x00406e8c
0x00000000
0x00000000
0x00406eb0
0x00406eb4
0x00000000
0x00000000
0x00406eba
0x00406ebe
0x00000000
0x00000000
0x00406ec4
0x00406ec6
0x00406eca
0x00406eca
0x00406ecd
0x00406ed1
0x00000000
0x00000000
0x00406f21
0x00406f25
0x00406f2c
0x00406f2f
0x00406f32
0x00406f3c
0x00000000
0x00406f3c
0x00406f27
0x00000000
0x00000000
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00406f62
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00406f75
0x00406f7a
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406bfd
0x00406bfd
0x00406c01
0x0040736e
0x00000000
0x0040736e
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1c
0x00406c1f
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00000000
0x00000000
0x00406c2e
0x00406c34
0x00000000
0x00000000
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c98
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca1
0x00406ca8
0x00406cab
0x00000000
0x00406cb1
0x00000000
0x00406cb1
0x00000000
0x00406cb6
0x00406cb6
0x00406cba
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cdb
0x00406cdb
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d29
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d2e
0x00406d35
0x00406d38
0x00000000
0x00406d3a
0x00000000
0x00406d3a
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d3f
0x00000000
0x00000000
0x00406d7a
0x00406d7a
0x00406d7e
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d99
0x00406d9c
0x00406d9f
0x00406d9f
0x00406da5
0x00406d43
0x00406d43
0x00406d46
0x00000000
0x00406d46
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406ded
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df2
0x00406df9
0x00406dfc
0x00000000
0x00406dfe
0x00000000
0x00406dfe
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00406e5b
0x00406e5b
0x00406e5e
0x00000000
0x00000000
0x0040719a
0x0040719e
0x004071c0
0x004071c3
0x004071cd
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071aa
0x004071ad
0x00000000
0x00000000
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x0040728e
0x0040728e
0x00000000
0x0040728e
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x004071b1
0x004071b1
0x004071b4
0x00000000
0x00000000
0x00407348
0x0040734b
0x00000000
0x00000000
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00406f99
0x00406f9c
0x00406f9f
0x00406fa1
0x00406fa3
0x00406fa3
0x00406fa4
0x00406fa7
0x00406fae
0x00406fb1
0x00406fbf
0x00000000
0x00000000
0x00407295
0x00407295
0x00407298
0x0040729f
0x00000000
0x00000000
0x004072a4
0x004072a4
0x004072a8
0x004073e0
0x00000000
0x004073e0
0x004072ae
0x004072b1
0x004072b4
0x004072b8
0x004072bb
0x004072c1
0x004072c3
0x004072c3
0x004072c3
0x004072c6
0x004072c9
0x004072c9
0x004072c9
0x004072c9
0x004072cc
0x004072cc
0x004072d0
0x00407330
0x00407333
0x00407338
0x00407339
0x0040733b
0x0040733d
0x00407340
0x0040724c
0x0040724c
0x00000000
0x0040724c
0x004072d2
0x004072d8
0x004072db
0x004072de
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f0
0x004072f3
0x0040730c
0x0040730f
0x00407312
0x00407315
0x00407319
0x0040731b
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x004072fd
0x00407302
0x00407304
0x00407307
0x00407307
0x00407322
0x00407329
0x00000000
0x0040732b
0x00000000
0x0040732b
0x00000000
0x00406fc7
0x00406fca
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00406d49
0x00406d49
0x00406d4d
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00000000
0x00000000
0x00406ed4
0x00406ed4
0x00406ed8
0x0040739e
0x00000000
0x0040739e
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0a
0x00406f0d
0x00406f0f
0x00406f0f
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00406f12
0x00406f12
0x00000000
0x00406f12
0x00407193
0x004073c8
0x004073ea
0x004073f0
0x004073f2
0x004073f9
0x00000000
0x00000000
0x004069f7
0x004073ff
0x004073ff
0x00000000

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b0327e3984c47fd7fb5acc0ee3a8fd44233b13dddfd54c5d1d349d043c04e97
Instruction ID: 2053932e36a873dbcc99d7887d17cfa2785100b746cea0f6d6be33c120aa0153
Opcode Fuzzy Hash: 0b0327e3984c47fd7fb5acc0ee3a8fd44233b13dddfd54c5d1d349d043c04e97
Instruction Fuzzy Hash: 0D816771E04228DBDF24CFA8C8447AEBBB1FB44305F14816AD856BB2C1D7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406E03 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406E03() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00407407))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406e03
0x00406e03
0x00406e07
0x00406e28
0x00406e2f
0x00406e35
0x00406e3b
0x00406e4d
0x00406e53
0x00406e58
0x00000000
0x00406e09
0x00406e0f
0x004071d0
0x004071d0
0x004071d0
0x004071d3
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00407221
0x00407225
0x004073d4
0x004073ea
0x004073f2
0x004073f9
0x004073fb
0x00407402
0x00407406
0x00407406
0x00407231
0x00407238
0x00407240
0x00407243
0x00407246
0x00407246
0x0040724c
0x0040724c
0x004069e8
0x004069e8
0x004069e8
0x004069f1
0x00000000
0x00000000
0x004069f7
0x00000000
0x00406a02
0x00000000
0x00000000
0x00406a0b
0x00406a0e
0x00406a11
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a61
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00000000
0x00407353
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00000000
0x00407362
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b64
0x00406b66
0x00406b69
0x00406bda
0x00406bdd
0x00406be0
0x00406be7
0x00406bf1
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x00406b6b
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b8c
0x00406b90
0x00406b97
0x00406b9a
0x00406ba1
0x00406ba5
0x00406bad
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb1
0x00406bb4
0x00406bd2
0x00406bd4
0x00000000
0x00406bb6
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00000000
0x00406bcd
0x00000000
0x00000000
0x00000000
0x00406e6d
0x00406e71
0x00406e94
0x00406e97
0x00406e9a
0x00406ea4
0x00406e73
0x00406e73
0x00406e76
0x00406e79
0x00406e7c
0x00406e89
0x00406e8c
0x00406e8c
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x00000000
0x00406eb0
0x00406eb4
0x00000000
0x00000000
0x00406eba
0x00406ebe
0x00000000
0x00000000
0x00406ec4
0x00406ec6
0x00406eca
0x00406eca
0x00406ecd
0x00406ed1
0x00000000
0x00000000
0x00406f21
0x00406f25
0x00406f2c
0x00406f2f
0x00406f32
0x00406f3c
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071d0
0x00406f27
0x00000000
0x00000000
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00406f62
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00406f75
0x00406f7a
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406bfd
0x00406bfd
0x00406c01
0x0040736e
0x00000000
0x0040736e
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1c
0x00406c1f
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00000000
0x00000000
0x00406c2e
0x00406c34
0x00000000
0x00000000
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c98
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca1
0x00406ca8
0x00406cab
0x00000000
0x00406cb1
0x00000000
0x00406cb1
0x00000000
0x00406cb6
0x00406cb6
0x00406cba
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cdb
0x00406cdb
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d29
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d2e
0x00406d35
0x00406d38
0x00000000
0x00406d3a
0x00000000
0x00406d3a
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d3f
0x00000000
0x00000000
0x00406d7a
0x00406d7a
0x00406d7e
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d99
0x00406d9c
0x00406d9f
0x00406d9f
0x00406da5
0x00406d43
0x00406d43
0x00406d46
0x00000000
0x00406d46
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406ded
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df2
0x00406df9
0x00406dfc
0x00000000
0x00406dfe
0x00000000
0x00406dfe
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00406e5b
0x00406e5b
0x00406e5e
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x00000000
0x0040719a
0x0040719e
0x004071c0
0x004071c3
0x004071cd
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071d0
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071aa
0x004071ad
0x00000000
0x00000000
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x0040728e
0x0040728e
0x00000000
0x0040728e
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x004071b1
0x004071b1
0x004071b4
0x00000000
0x00000000
0x00407348
0x0040734b
0x0040724c
0x00000000
0x00000000
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00406f99
0x00406f9c
0x00406f9f
0x00406fa1
0x00406fa3
0x00406fa3
0x00406fa4
0x00406fa7
0x00406fae
0x00406fb1
0x00406fbf
0x00000000
0x00000000
0x00407295
0x00407295
0x00407298
0x0040729f
0x00000000
0x00000000
0x004072a4
0x004072a4
0x004072a8
0x004073e0
0x00000000
0x004073e0
0x004072ae
0x004072b1
0x004072b4
0x004072b8
0x004072bb
0x004072c1
0x004072c3
0x004072c3
0x004072c3
0x004072c6
0x004072c9
0x004072c9
0x004072c9
0x004072c9
0x004072cc
0x004072cc
0x004072d0
0x00407330
0x00407333
0x00407338
0x00407339
0x0040733b
0x0040733d
0x00407340
0x0040724c
0x0040724c
0x00000000
0x00407252
0x0040724c
0x004072d2
0x004072d8
0x004072db
0x004072de
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f0
0x004072f3
0x0040730c
0x0040730f
0x00407312
0x00407315
0x00407319
0x0040731b
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x004072fd
0x00407302
0x00407304
0x00407307
0x00407307
0x00407322
0x00407329
0x00000000
0x0040732b
0x00000000
0x0040732b
0x00000000
0x00406fc7
0x00406fca
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00406d49
0x00406d49
0x00406d4d
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00000000
0x00000000
0x00406ed4
0x00406ed4
0x00406ed8
0x0040739e
0x00000000
0x0040739e
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0a
0x00406f0d
0x00406f0f
0x00406f0f
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00406f12
0x00406f12
0x00000000
0x00406f12
0x00407193
0x004073c8
0x00000000
0x00000000
0x004069f7
0x004073ff
0x004073ff
0x00000000
0x004073ff
0x0040724c
0x004071d3
0x004071d0
0x00000000
0x00406e07

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c8e6eecf59a637b12dfe9b2a9e91f710100e1dea45647e5de96052d18de1a1
Instruction ID: 2d520f7aea931b220d89dc869740df1b2e06c90b92d4caeab5ce8195022b622e
Opcode Fuzzy Hash: f9c8e6eecf59a637b12dfe9b2a9e91f710100e1dea45647e5de96052d18de1a1
Instruction Fuzzy Hash: FD711371E04229DFDF28CF98C8447ADBBB1FB48305F15806AD846BB281D7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406F21 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406F21() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00407407))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406f21
0x00406f21
0x00406f25
0x00406f32
0x00406f3c
0x00000000
0x00406f27
0x00406f27
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00406f75
0x00406f7a
0x00406e5b
0x00406e5e
0x004071d0
0x004071d0
0x004071d0
0x004071d3
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00407221
0x00407225
0x004073d4
0x004073ea
0x004073f2
0x004073f9
0x004073fb
0x00407402
0x00407406
0x00407406
0x00407231
0x00407238
0x00407240
0x00407243
0x00407246
0x00407246
0x0040724c
0x0040724c
0x004069e8
0x004069e8
0x004069e8
0x004069f1
0x00000000
0x00000000
0x004069f7
0x00000000
0x00406a02
0x00000000
0x00000000
0x00406a0b
0x00406a0e
0x00406a11
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a61
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00000000
0x00407353
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x004071d0
0x004071d0
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00000000
0x00407362
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b64
0x00406b66
0x00406b69
0x00406bda
0x00406bdd
0x00406be0
0x00406be7
0x00406bf1
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071d0
0x00406b6b
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b8c
0x00406b90
0x00406b97
0x00406b9a
0x00406ba1
0x00406ba5
0x00406bad
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb1
0x00406bb4
0x00406bd2
0x00406bd4
0x00000000
0x00406bb6
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00000000
0x00406bcd
0x00000000
0x00406e03
0x00406e07
0x00406e25
0x00406e28
0x00406e2f
0x00406e32
0x00406e35
0x00406e38
0x00406e3b
0x00406e3e
0x00406e40
0x00406e47
0x00406e48
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e53
0x00406e58
0x00000000
0x00406e58
0x00406e09
0x00406e0c
0x00406e0f
0x00406e19
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x00000000
0x00406e6d
0x00406e71
0x00406e94
0x00406e97
0x00406e9a
0x00406ea4
0x00406e73
0x00406e73
0x00406e76
0x00406e79
0x00406e7c
0x00406e89
0x00406e8c
0x00406e8c
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x00000000
0x00406eb0
0x00406eb4
0x00000000
0x00000000
0x00406eba
0x00406ebe
0x00000000
0x00000000
0x00406ec4
0x00406ec6
0x00406eca
0x00406eca
0x00406ecd
0x00406ed1
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406bfd
0x00406bfd
0x00406c01
0x0040736e
0x00000000
0x0040736e
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1c
0x00406c1f
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00000000
0x00000000
0x00406c2e
0x00406c34
0x00000000
0x00000000
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c98
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca1
0x00406ca8
0x00406cab
0x00000000
0x00406cb1
0x00000000
0x00406cb1
0x00000000
0x00406cb6
0x00406cb6
0x00406cba
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cdb
0x00406cdb
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d29
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d2e
0x00406d35
0x00406d38
0x00000000
0x00406d3a
0x00000000
0x00406d3a
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d3f
0x00000000
0x00000000
0x00406d7a
0x00406d7a
0x00406d7e
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d99
0x00406d9c
0x00406d9f
0x00406d9f
0x00406da5
0x00406d43
0x00406d43
0x00406d46
0x00000000
0x00406d46
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406ded
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df2
0x00406df9
0x00406dfc
0x00000000
0x00406dfe
0x00000000
0x00406dfe
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00000000
0x00000000
0x0040719a
0x0040719e
0x004071c0
0x004071c3
0x004071cd
0x004071d0
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071d0
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071aa
0x004071ad
0x00000000
0x00000000
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x0040728e
0x0040728e
0x00000000
0x0040728e
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x004071b1
0x004071b1
0x004071b4
0x00000000
0x00000000
0x00407348
0x0040734b
0x0040724c
0x00000000
0x00000000
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00406f99
0x00406f9c
0x00406f9f
0x00406fa1
0x00406fa3
0x00406fa3
0x00406fa4
0x00406fa7
0x00406fae
0x00406fb1
0x00406fbf
0x00000000
0x00000000
0x00407295
0x00407295
0x00407298
0x0040729f
0x00000000
0x00000000
0x004072a4
0x004072a4
0x004072a8
0x004073e0
0x00000000
0x004073e0
0x004072ae
0x004072b1
0x004072b4
0x004072b8
0x004072bb
0x004072c1
0x004072c3
0x004072c3
0x004072c3
0x004072c6
0x004072c9
0x004072c9
0x004072c9
0x004072c9
0x004072cc
0x004072cc
0x004072d0
0x00407330
0x00407333
0x00407338
0x00407339
0x0040733b
0x0040733d
0x00407340
0x0040724c
0x0040724c
0x00000000
0x00407252
0x0040724c
0x004072d2
0x004072d8
0x004072db
0x004072de
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f0
0x004072f3
0x0040730c
0x0040730f
0x00407312
0x00407315
0x00407319
0x0040731b
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x004072fd
0x00407302
0x00407304
0x00407307
0x00407307
0x00407322
0x00407329
0x00000000
0x0040732b
0x00000000
0x0040732b
0x00000000
0x00406fc7
0x00406fca
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00406d49
0x00406d49
0x00406d4d
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00000000
0x00000000
0x00406ed4
0x00406ed4
0x00406ed8
0x0040739e
0x00000000
0x0040739e
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0a
0x00406f0d
0x00406f0f
0x00406f0f
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00406f12
0x00406f12
0x00000000
0x00406f12
0x00407193
0x004073c8
0x00000000
0x00000000
0x004069f7
0x004073ff
0x004073ff
0x00000000
0x004073ff
0x0040724c
0x004071d3
0x004071d0
0x00000000
0x00406f25

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26e0a9d6be364555c84562d4333e3a7b0e340f3052f620dcbe7fe05a5bd6cfa
Instruction ID: 3f0bf77315cb51cd72cd217666d3d777815ea5392258dc63ccea23ada46d0a6c
Opcode Fuzzy Hash: e26e0a9d6be364555c84562d4333e3a7b0e340f3052f620dcbe7fe05a5bd6cfa
Instruction Fuzzy Hash: 5C712371E04229CBEF28CFA8C8447ADBBB1FB45305F15806AD856BB281C7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406E6D Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406E6D() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407407))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406e6d
0x00406e6d
0x00406e71
0x00406e9a
0x00406ea4
0x00406e73
0x00406e7c
0x00406e89
0x00406e8c
0x004071d0
0x004071d0
0x004071d3
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00407221
0x00407225
0x004073d4
0x004073ea
0x004073f2
0x004073f9
0x004073fb
0x00407402
0x00407406
0x00407406
0x00407231
0x00407238
0x00407240
0x00407243
0x00407246
0x00407246
0x0040724c
0x0040724c
0x004069e8
0x004069e8
0x004069e8
0x004069f1
0x00000000
0x00000000
0x004069f7
0x00000000
0x00406a02
0x00000000
0x00000000
0x00406a0b
0x00406a0e
0x00406a11
0x00406a15
0x00000000
0x00000000
0x00406a1b
0x00406a1e
0x00406a20
0x00406a21
0x00406a24
0x00406a26
0x00406a27
0x00406a29
0x00406a2c
0x00406a31
0x00406a36
0x00406a3f
0x00406a52
0x00406a55
0x00406a61
0x00406a89
0x00406a8b
0x00406a99
0x00406a99
0x00406a9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a8d
0x00406a8d
0x00406a90
0x00406a91
0x00406a91
0x00000000
0x00406a8d
0x00406a67
0x00406a6c
0x00406a6c
0x00406a75
0x00406a7d
0x00406a80
0x00000000
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406aa3
0x00406aa3
0x00406aa7
0x00407353
0x00000000
0x00407353
0x00406ab0
0x00406ac0
0x00406ac3
0x00406ac6
0x00406ac6
0x00406ac6
0x00406ac9
0x00406acd
0x00000000
0x00000000
0x00406acf
0x00406ad5
0x00406aff
0x00406b05
0x00406b0c
0x00000000
0x00406b0c
0x00406adb
0x00406ade
0x00406ae3
0x00406ae3
0x00406aee
0x00406af6
0x00406af9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b3e
0x00406b44
0x00406b47
0x00406b54
0x00406b5c
0x004071d0
0x00000000
0x00000000
0x00406b13
0x00406b13
0x00406b17
0x00407362
0x00000000
0x00407362
0x00406b23
0x00406b2e
0x00406b2e
0x00406b2e
0x00406b31
0x00406b34
0x00406b37
0x00406b3c
0x00000000
0x00000000
0x00000000
0x00000000
0x004071d3
0x004071d3
0x004071d9
0x004071df
0x004071e5
0x004071ff
0x00407202
0x00407208
0x00407213
0x00407215
0x004071e7
0x004071e7
0x004071f6
0x004071fa
0x004071fa
0x0040721f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b64
0x00406b66
0x00406b69
0x00406bda
0x00406bdd
0x00406be0
0x00406be7
0x00406bf1
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071d0
0x00406b6b
0x00406b6f
0x00406b72
0x00406b74
0x00406b77
0x00406b7a
0x00406b7c
0x00406b7f
0x00406b81
0x00406b86
0x00406b89
0x00406b8c
0x00406b90
0x00406b97
0x00406b9a
0x00406ba1
0x00406ba5
0x00406bad
0x00406bad
0x00406bad
0x00406ba7
0x00406ba7
0x00406ba7
0x00406b9c
0x00406b9c
0x00406b9c
0x00406bb1
0x00406bb4
0x00406bd2
0x00406bd4
0x00000000
0x00406bb6
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc1
0x00406bc4
0x00406bc7
0x00406bc9
0x00406bca
0x00406bcd
0x00000000
0x00406bcd
0x00000000
0x00406e03
0x00406e07
0x00406e25
0x00406e28
0x00406e2f
0x00406e32
0x00406e35
0x00406e38
0x00406e3b
0x00406e3e
0x00406e40
0x00406e47
0x00406e48
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e53
0x00406e58
0x00000000
0x00406e58
0x00406e09
0x00406e0c
0x00406e0f
0x00406e19
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x00000000
0x00000000
0x00000000
0x00406eb0
0x00406eb4
0x00000000
0x00000000
0x00406eba
0x00406ebe
0x00000000
0x00000000
0x00406ec4
0x00406ec6
0x00406eca
0x00406eca
0x00406ecd
0x00406ed1
0x00000000
0x00000000
0x00406f21
0x00406f25
0x00406f2c
0x00406f2f
0x00406f32
0x00406f3c
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071d0
0x00406f27
0x00000000
0x00000000
0x00406f48
0x00406f4c
0x00406f53
0x00406f56
0x00406f59
0x00406f4e
0x00406f4e
0x00406f4e
0x00406f5c
0x00406f5f
0x00406f62
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6b
0x00406f6e
0x00406f75
0x00406f7a
0x00000000
0x00000000
0x00407008
0x00407008
0x0040700c
0x004073aa
0x00000000
0x004073aa
0x00407012
0x00407015
0x00407018
0x0040701c
0x0040701f
0x00407025
0x00407027
0x00407027
0x00407027
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406bfd
0x00406bfd
0x00406c01
0x0040736e
0x00000000
0x0040736e
0x00406c07
0x00406c0a
0x00406c0d
0x00406c11
0x00406c14
0x00406c1a
0x00406c1c
0x00406c1c
0x00406c1c
0x00406c1f
0x00406c22
0x00406c22
0x00406c25
0x00406c28
0x00000000
0x00000000
0x00406c2e
0x00406c34
0x00000000
0x00000000
0x00406c3a
0x00406c3a
0x00406c3e
0x00406c41
0x00406c44
0x00406c47
0x00406c4a
0x00406c4b
0x00406c4e
0x00406c50
0x00406c56
0x00406c59
0x00406c5c
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00406c94
0x00406c98
0x00406c9a
0x00406c9e
0x00406c6a
0x00406c6a
0x00406c6e
0x00406c76
0x00406c7b
0x00406c7d
0x00406c7f
0x00406c7f
0x00406ca1
0x00406ca8
0x00406cab
0x00000000
0x00406cb1
0x00000000
0x00406cb1
0x00000000
0x00406cb6
0x00406cb6
0x00406cba
0x0040737a
0x00000000
0x0040737a
0x00406cc0
0x00406cc3
0x00406cc6
0x00406cca
0x00406ccd
0x00406cd3
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cd8
0x00406cdb
0x00406cdb
0x00406cdb
0x00406ce1
0x00000000
0x00000000
0x00406ce3
0x00406ce6
0x00406ce9
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d01
0x00406d19
0x00406d1c
0x00406d1f
0x00406d22
0x00406d22
0x00406d25
0x00406d29
0x00406d2b
0x00406d03
0x00406d03
0x00406d0b
0x00406d10
0x00406d12
0x00406d14
0x00406d14
0x00406d2e
0x00406d35
0x00406d38
0x00000000
0x00406d3a
0x00000000
0x00406d3a
0x00406d38
0x00406d3f
0x00406d3f
0x00406d3f
0x00406d3f
0x00000000
0x00000000
0x00406d7a
0x00406d7a
0x00406d7e
0x00407386
0x00000000
0x00407386
0x00406d84
0x00406d87
0x00406d8a
0x00406d8e
0x00406d91
0x00406d97
0x00406d99
0x00406d99
0x00406d99
0x00406d9c
0x00406d9f
0x00406d9f
0x00406da5
0x00406d43
0x00406d43
0x00406d46
0x00000000
0x00406d46
0x00406da7
0x00406da7
0x00406daa
0x00406dad
0x00406db0
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc5
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de6
0x00406de9
0x00406ded
0x00406def
0x00406dc7
0x00406dc7
0x00406dcf
0x00406dd4
0x00406dd6
0x00406dd8
0x00406dd8
0x00406df2
0x00406df9
0x00406dfc
0x00000000
0x00406dfe
0x00000000
0x00406dfe
0x00000000
0x0040708b
0x0040708b
0x0040708f
0x004073b6
0x00000000
0x004073b6
0x00407095
0x00407098
0x0040709b
0x0040709f
0x004070a2
0x004070a8
0x004070aa
0x004070aa
0x004070aa
0x004070ad
0x00000000
0x00000000
0x00406e5b
0x00406e5b
0x00406e5e
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x00000000
0x0040719a
0x0040719e
0x004071c0
0x004071c3
0x004071cd
0x004071d0
0x004071d0
0x00000000
0x004071d0
0x004071d0
0x004071a0
0x004071a3
0x004071a7
0x004071aa
0x004071aa
0x004071ad
0x00000000
0x00000000
0x00407257
0x0040725b
0x00407279
0x00407279
0x00407279
0x00407280
0x00407287
0x0040728e
0x0040728e
0x00000000
0x0040728e
0x0040725d
0x00407260
0x00407263
0x00407266
0x0040726d
0x004071b1
0x004071b1
0x004071b4
0x00000000
0x00000000
0x00407348
0x0040734b
0x0040724c
0x00000000
0x00000000
0x00406f82
0x00406f84
0x00406f8b
0x00406f8c
0x00406f8e
0x00406f91
0x00000000
0x00000000
0x00406f99
0x00406f9c
0x00406f9f
0x00406fa1
0x00406fa3
0x00406fa3
0x00406fa4
0x00406fa7
0x00406fae
0x00406fb1
0x00406fbf
0x00000000
0x00000000
0x00407295
0x00407295
0x00407298
0x0040729f
0x00000000
0x00000000
0x004072a4
0x004072a4
0x004072a8
0x004073e0
0x00000000
0x004073e0
0x004072ae
0x004072b1
0x004072b4
0x004072b8
0x004072bb
0x004072c1
0x004072c3
0x004072c3
0x004072c3
0x004072c6
0x004072c9
0x004072c9
0x004072c9
0x004072c9
0x004072cc
0x004072cc
0x004072d0
0x00407330
0x00407333
0x00407338
0x00407339
0x0040733b
0x0040733d
0x00407340
0x0040724c
0x0040724c
0x00000000
0x00407252
0x0040724c
0x004072d2
0x004072d8
0x004072db
0x004072de
0x004072e1
0x004072e4
0x004072e7
0x004072ea
0x004072ed
0x004072f0
0x004072f3
0x0040730c
0x0040730f
0x00407312
0x00407315
0x00407319
0x0040731b
0x0040731b
0x0040731c
0x0040731f
0x004072f5
0x004072f5
0x004072fd
0x00407302
0x00407304
0x00407307
0x00407307
0x00407322
0x00407329
0x00000000
0x0040732b
0x00000000
0x0040732b
0x00000000
0x00406fc7
0x00406fca
0x00407000
0x00407130
0x00407130
0x00407130
0x00407130
0x00407133
0x00407133
0x00407136
0x00407138
0x004073c2
0x00000000
0x004073c2
0x0040713e
0x00407141
0x00000000
0x00000000
0x00407147
0x0040714b
0x0040714e
0x0040714e
0x0040714e
0x00000000
0x0040714e
0x00406fcc
0x00406fce
0x00406fd0
0x00406fd2
0x00406fd5
0x00406fd6
0x00406fd8
0x00406fda
0x00406fdd
0x00406fe0
0x00406ff6
0x00406ffb
0x00407033
0x00407033
0x00407037
0x00407063
0x00407065
0x0040706c
0x0040706f
0x00407072
0x00407072
0x00407077
0x00407077
0x00407079
0x0040707c
0x00407083
0x00407086
0x004070b3
0x004070b3
0x004070b6
0x004070b9
0x0040712d
0x0040712d
0x0040712d
0x00000000
0x0040712d
0x004070bb
0x004070c1
0x004070c4
0x004070c7
0x004070ca
0x004070cd
0x004070d0
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070f5
0x004070f7
0x004070fa
0x004070fb
0x004070fe
0x00407100
0x00407103
0x00407105
0x00407107
0x0040710a
0x0040710c
0x0040710f
0x00407113
0x00407115
0x00407115
0x00407116
0x00407119
0x0040711c
0x004070de
0x004070de
0x004070e6
0x004070eb
0x004070ed
0x004070f0
0x004070f0
0x0040711f
0x00407126
0x004070b0
0x004070b0
0x004070b0
0x004070b0
0x00000000
0x00407128
0x00000000
0x00407128
0x00407126
0x00407039
0x0040703c
0x0040703e
0x00407041
0x00407044
0x00407047
0x00407049
0x0040704c
0x0040704f
0x0040704f
0x00407052
0x00407052
0x00407055
0x0040705c
0x00407030
0x00407030
0x00407030
0x00407030
0x00000000
0x0040705e
0x00000000
0x0040705e
0x0040705c
0x00406fe2
0x00406fe5
0x00406fe7
0x00406fea
0x00000000
0x00000000
0x00406d49
0x00406d49
0x00406d4d
0x00407392
0x00000000
0x00407392
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d62
0x00406d65
0x00406d67
0x00406d6a
0x00406d6d
0x00406d70
0x00406d72
0x00406d72
0x00406d72
0x00000000
0x00000000
0x00406ed4
0x00406ed4
0x00406ed8
0x0040739e
0x00000000
0x0040739e
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eef
0x00406ef2
0x00406ef5
0x00406ef8
0x00406efb
0x00406efc
0x00406efe
0x00406efe
0x00406efe
0x00406f01
0x00406f04
0x00406f07
0x00406f0a
0x00406f0a
0x00406f0a
0x00406f0d
0x00406f0f
0x00406f0f
0x00000000
0x00000000
0x00407151
0x00407151
0x00407151
0x00407155
0x00000000
0x00000000
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407166
0x00407166
0x00407166
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407175
0x00407178
0x00407179
0x0040717b
0x0040717b
0x0040717b
0x0040717e
0x00407181
0x00407184
0x00407187
0x0040718a
0x0040718e
0x00407190
0x00407193
0x00000000
0x00407195
0x00406f12
0x00406f12
0x00000000
0x00406f12
0x00407193
0x004073c8
0x00000000
0x00000000
0x004069f7
0x004073ff
0x004073ff
0x00000000
0x004073ff
0x0040724c
0x004071d3
0x004071d0

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a0612f6bd5dbaf165b9b179e09e8f27a867640c24d2a2d3a7daf04efb99707
Instruction ID: dac1f6d3c354f6882bdcf42bb2d5f7d25cf010b20a3da394791584d9d0f353b2
Opcode Fuzzy Hash: 52a0612f6bd5dbaf165b9b179e09e8f27a867640c24d2a2d3a7daf04efb99707
Instruction Fuzzy Hash: 1E713471E04229DBEF28CF98C8447ADBBB1FF44305F15806AD856BB281C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00403346 Relevance: 4.6, APIs: 3, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00403346(intOrPtr _a4) {
				intOrPtr _t10;
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t31;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t32 =  *0x420ed4; // 0x35f74
				_t34 = _t32 -  *0x40ce40 + _a4;
				 *0x42a250 = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E00402EFB(1);
					return 0;
				}
				E004034C5( *0x420ee4);
				SetFilePointer( *0x40a01c,  *0x40ce40, 0, 0); // executed
				 *0x420ee0 = _t34;
				 *0x420ed0 = 0;
				while(1) {
					_t10 =  *0x420ed8; // 0x2d275
					_t31 = 0x4000;
					_t11 = _t10 -  *0x420ee4;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E004034AF(0x414ed0, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x420ee4 =  *0x420ee4 + _t31;
					 *0x40ce60 = 0x414ed0;
					 *0x40ce64 = _t31;
					L6:
					L6:
					if( *0x42a254 != 0 &&  *0x42a300 == 0) {
						_t19 =  *0x420ee0; // 0x28c8
						 *0x420ed0 = _t19 -  *0x420ed4 - _a4 +  *0x40ce40;
						E00402EFB(0);
					}
					 *0x40ce68 = 0x40ced0;
					 *0x40ce6c = 0x8000; // executed
					_t14 = E004069B5(0x40ce48); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x40ce68; // 0x40f798
					_t37 = _t36 - 0x40ced0;
					if(_t37 == 0) {
						__eflags =  *0x40ce64; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x420ed4; // 0x35f74
						if(_t16 -  *0x40ce40 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
						goto L22;
					}
					_t18 = E00406002( *0x40a01c, 0x40ced0, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce40 =  *0x40ce40 + _t37;
					_t49 =  *0x40ce64; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x00403349
0x00403356
0x00403369
0x0040336e
0x0040349e
0x004034a0
0x00000000
0x004034a6
0x0040337a
0x0040338d
0x00403393
0x00403399
0x004033a4
0x004033a4
0x004033a9
0x004033ae
0x004033b6
0x004033b8
0x004033b8
0x004033c1
0x004033c8
0x00000000
0x00000000
0x004033ce
0x004033d4
0x004033da
0x00000000
0x004033e0
0x004033e6
0x004033f0
0x00403406
0x0040340b
0x00403410
0x00403416
0x0040341c
0x00403426
0x0040342d
0x00000000
0x00000000
0x0040342f
0x00403435
0x00403437
0x0040345a
0x00403460
0x00000000
0x00000000
0x00403462
0x00403464
0x00000000
0x00000000
0x00403466
0x00403466
0x00403479
0x00000000
0x00000000
0x00403488
0x00000000
0x00403488
0x00403441
0x00403448
0x00403495
0x0040349b
0x0040349b
0x00000000
0x0040349b
0x0040344a
0x00403450
0x00403456
0x00000000
0x00000000
0x00000000
0x00403499
0x00403499
0x00000000
0x00403499
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040335A

Part of subcall function 004034C5: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004031C3,?), ref: 004034D3

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403270,00000004,00000000,00000000,?,?,004031EA,000000FF,00000000,00000000,0040A230,?), ref: 0040338D
SetFilePointer.KERNELBASE(00035F74,00000000,00000000,00414ED0,00004000,?,00000000,00403270,00000004,00000000,00000000,?,?,004031EA,000000FF,00000000), ref: 00403488

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 7c0dea1007634399391d37eb34990301368c14b0464807368ee3362cdf468ad8
Instruction ID: 3f853fce231b6a74548de036e2e7bf7c1498ab88abb4c2656dfb5d58cc37a3c2
Opcode Fuzzy Hash: 7c0dea1007634399391d37eb34990301368c14b0464807368ee3362cdf468ad8
Instruction Fuzzy Hash: 3B31B0B2600204DBD721DF29FE8892A3BADFB4436A715063FE500B62E1C7B95D41CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040209F Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040209F(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				void* _t34;
				WCHAR* _t37;
				intOrPtr* _t38;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x42a318");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42a2e8 =  *0x42a2e8 +  *(_t39 - 4);
					return 0;
				}
				_t37 = E00402CAE(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x44)) = E00402CAE(1);
				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t37, _t32, 8); // executed
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t38 = E004068A3( *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
					if(_t38 == _t32) {
						E004054C2(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
							 *_t38( *((intOrPtr*)(_t39 - 8)), 0x400, _t34, 0x40ce38, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x28)));
							if( *_t38() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403AE0( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8));
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t37); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040209f
0x0040209f
0x004020a4
0x004020ab
0x0040216a
0x004022b8
0x004022b8
0x00402b32
0x00402b35
0x00402b41
0x00402b41
0x004020ba
0x004020c4
0x004020c7
0x004020d7
0x004020db
0x004020e3
0x004020e6
0x00402163
0x00000000
0x00402163
0x004020e8
0x004020f3
0x004020f7
0x00402137
0x004020f9
0x004020fc
0x004020ff
0x0040212b
0x00402101
0x00402104
0x0040210d
0x0040210f
0x0040210f
0x0040210d
0x004020ff
0x0040213f
0x00402158
0x00402158
0x00000000
0x0040213f
0x004020ca
0x004020d2
0x004020d5
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 004020CA

Part of subcall function 004054C2: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000,?), ref: 004054FA
Part of subcall function 004054C2: lstrlenW.KERNEL32(00402F75,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000), ref: 0040550A
Part of subcall function 004054C2: lstrcatW.KERNEL32(00422708,00402F75), ref: 0040551D
Part of subcall function 004054C2: SetWindowTextW.USER32(00422708,00422708), ref: 0040552F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405555
Part of subcall function 004054C2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040556F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040557D

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020DB
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402158

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 6970e74ea2b2180a9980bacbb677cdca8bab4b36d5b08b6b046b757aa8cf6a0f
Instruction ID: da09220e35af5601bb30f706a4599f6953cb664e7d4b76b36b565c94c3e40065
Opcode Fuzzy Hash: 6970e74ea2b2180a9980bacbb677cdca8bab4b36d5b08b6b046b757aa8cf6a0f
Instruction Fuzzy Hash: E821F631900204EBCF10AFA5CF48A9F7A70AF10358F60423BF541B51E0C7BD8E829A9E

Uniqueness

Uniqueness Score: -1.00%

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B77(void* __ebx) {
				intOrPtr _t8;
				void* _t9;
				void _t12;
				void* _t14;
				void* _t22;
				void* _t25;
				void* _t30;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t37;

				_t28 = __ebx;
				_t8 =  *((intOrPtr*)(_t37 - 0x28));
				_t30 =  *0x40ce38; // 0x0
				if(_t8 == __ebx) {
					if( *((intOrPtr*)(_t37 - 0x2c)) == __ebx) {
						_t9 = GlobalAlloc(0x40, 0x804); // executed
						_t34 = _t9;
						_t5 = _t34 + 4; // 0x4
						E0040647C(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x30)));
						_t12 =  *0x40ce38; // 0x0
						 *_t34 = _t12;
						 *0x40ce38 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t3 = _t30 + 4; // 0x4
							E0040645A(_t33, _t3);
							_push(_t30);
							 *0x40ce38 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t8 = _t8 - 1;
						if(_t30 == _t28) {
							break;
						}
						_t30 =  *_t30;
						if(_t8 != _t28) {
							continue;
						} else {
							if(_t30 == _t28) {
								break;
							} else {
								_t32 = _t30 + 4;
								_t36 = L"Call";
								E0040645A(_t36, _t30 + 4);
								_t22 =  *0x40ce38; // 0x0
								E0040645A(_t32, _t22 + 4);
								_t25 =  *0x40ce38; // 0x0
								_push(_t36);
								_push(_t25 + 4);
								E0040645A();
								L15:
								 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t37 - 4));
								_t14 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E0040647C(_t28, _t30, _t33, _t28, 0xffffffe8));
					E00405AC0();
					_t14 = 0x7fffffff;
				}
				L17:
				return _t14;
			}

0x00401b77
0x00401b77
0x00401b7a
0x00401b82
0x00401bcb
0x00401bf9
0x00401c02
0x00401c04
0x00401c08
0x00401c0d
0x00401c12
0x00401c14
0x00401bcd
0x00401bcf
0x004028f8
0x00401bd5
0x00401bd5
0x00401bda
0x00401be1
0x00401be2
0x00401be7
0x00401be7
0x00401bcf
0x00000000
0x00401b84
0x00401b84
0x00401b84
0x00401b87
0x00000000
0x00000000
0x00401b8d
0x00401b91
0x00000000
0x00401b93
0x00401b95
0x00000000
0x00401b9b
0x00401b9b
0x00401b9e
0x00401ba5
0x00401baa
0x00401bb4
0x00401bb9
0x00401bbe
0x00401bc2
0x00402a4e
0x00402b32
0x00402b35
0x00402b3b
0x00402b3b
0x00401b95
0x00000000
0x00401b91
0x00402351
0x0040235e
0x0040235f
0x00402364
0x00402364
0x00402b3d
0x00402b41

APIs

GlobalFree.KERNEL32 ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 342c8f0567b67843882342cd12f14a0817128d297e6aa4a46b8859909a9d3a36
Instruction ID: 185da0b20e78d5e5046defc68168d13beac9b3d4fa25e4a990696b308f5edda7
Opcode Fuzzy Hash: 342c8f0567b67843882342cd12f14a0817128d297e6aa4a46b8859909a9d3a36
Instruction Fuzzy Hash: E321C372600100EBC720EFA4CEC895E73B5EB45328725463BF556B32D1D7B8A8928B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00402565 Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402565(int* __ebx, intOrPtr __edx, short* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				short* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402CEE(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402C8C(3);
				 *((intOrPtr*)(_t26 - 0xc)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x20)) == __ebx) {
						_t13 = RegEnumValueW(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyW(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22); // executed
					RegCloseKey(); // executed
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x00402565
0x00402565
0x00402565
0x0040256a
0x00402571
0x00402573
0x0040257b
0x0040257e
0x00402581
0x004028f8
0x00402587
0x0040258f
0x00402592
0x004025ab
0x004025b1
0x004025b3
0x004025b5
0x004025b5
0x00402594
0x00402598
0x00402598
0x004025bc
0x004025c3
0x004025c4
0x004025c4
0x00402b35
0x00402b41

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402598
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025AB
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nszA331.tmp,00000000,00000011,00000002), ref: 004025C4

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: c9e9bd5917ada348c2120c799b4eee51f4d186557273c091cbaad60c70d760b8
Instruction ID: 4e3e33a1089440c7c815229c543cc69bf789a1e992a95d4390fa7aa0ddf3d348
Opcode Fuzzy Hash: c9e9bd5917ada348c2120c799b4eee51f4d186557273c091cbaad60c70d760b8
Instruction Fuzzy Hash: 86015A71904204AFEB149FA5DE88ABF77B8EF40354F10403EE405A62C0D6B85E41AA2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040323E Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040323E(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t29;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x42a2b8;
					 *0x420ed4 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E00403346(4);
				if(_t22 >= 0) {
					_t24 = E00405FD3( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x420ed4 =  *0x420ed4 + 4;
						_t36 = E00403346(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x420ed4 =  *0x420ed4 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										_t29 = E00405FD3( *0x40a01c, 0x414ed0, _t28); // executed
										if(_t29 == 0) {
											goto L18;
										}
										_t30 = E00406002(_a8, 0x414ed0, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x420ed4 =  *0x420ed4 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x00403242
0x0040324b
0x00403254
0x00403258
0x00403263
0x00403263
0x0040326b
0x00403272
0x00403284
0x0040328b
0x00403330
0x00403330
0x00000000
0x00403291
0x00403294
0x004032a0
0x004032a4
0x0040333e
0x0040333e
0x004032aa
0x004032ad
0x0040330c
0x00403312
0x00403314
0x00403314
0x00403326
0x0040332e
0x00403335
0x00403338
0x00000000
0x00000000
0x00000000
0x00000000
0x004032af
0x004032b2
0x00000000
0x004032b8
0x004032bd
0x004032c4
0x004032c7
0x004032c9
0x004032c9
0x004032d6
0x004032d9
0x004032e0
0x00000000
0x00000000
0x004032e9
0x004032f0
0x00403308
0x00403332
0x00403332
0x004032f2
0x004032f2
0x004032f5
0x004032f8
0x004032fe
0x00403304
0x00000000
0x00403306
0x00000000
0x00403306
0x00403304
0x00000000
0x004032f0
0x00000000
0x004032bd
0x004032b2
0x004032ad
0x004032a4
0x0040328b
0x00403340
0x00403343

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,004031EA,000000FF,00000000,00000000,0040A230,?), ref: 00403263

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1e59272a3295c60e3be600204592127ff8b86375210c1e1f16dfc8b5bce61f62
Instruction ID: 38e1c1b07549694c789282918a9bcad85daec71947e82f8402a6de8432c0a3c5
Opcode Fuzzy Hash: 1e59272a3295c60e3be600204592127ff8b86375210c1e1f16dfc8b5bce61f62
Instruction Fuzzy Hash: DC316D71200219EBDB108F95ED84A9E3EACEB00755F10843AFD05F6190DB78DE91DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004024F1 Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004024F1(int* __ebx, char* __esi) {
				void* _t17;
				short* _t18;
				long _t21;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402CEE(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402CAE(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0xc) = 0x800;
					_t21 = RegQueryValueExW(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0xc); // executed
					if(_t21 != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x20) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x20) == __ebx;
							E004063A1(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x20);
								_t35[0x7fe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33); // executed
					RegCloseKey(); // executed
				}
				 *0x42a2e8 =  *0x42a2e8 +  *(_t37 - 4);
				return 0;
			}

0x004024f1
0x004024f1
0x004024f6
0x004024fd
0x004024ff
0x00402506
0x00402509
0x004028f8
0x0040250f
0x00402512
0x00402522
0x0040252d
0x0040255d
0x0040255d
0x00402560
0x0040252f
0x00402533
0x0040254c
0x00402553
0x00402556
0x00402535
0x00402538
0x00402543
0x004025bc
0x00000000
0x00000000
0x00000000
0x00402538
0x00402533
0x004025c3
0x004025c4
0x004025c4
0x00402b35
0x00402b41

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000033), ref: 00402522
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nszA331.tmp,00000000,00000011,00000002), ref: 004025C4

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: b0362507e523189b1251ed2c7d3ccbbc3f317503a12cb84a3a9a46bb4b523bb3
Instruction ID: 79807a88045db9719a5c9fd5fa7ad3819c67a4931d3ff26395efcb68e5d97f33
Opcode Fuzzy Hash: b0362507e523189b1251ed2c7d3ccbbc3f317503a12cb84a3a9a46bb4b523bb3
Instruction Fuzzy Hash: 12118F71914209FBDF14DFA0CA589AEB7B4EF04344B60843FE442B62D0E6B88A41DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42a290;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42922c =  *0x42922c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x42922c, 0x7530,  *0x429214), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 67eb2ee60db4381f73a360d5c7f9c5f46929b17491f975c1f1029fe1d50c179f
Instruction ID: dd14f9b5e04ee3ed5807e2ca3a323232f8a722509de7bed7dbfc7a2eb2910212
Opcode Fuzzy Hash: 67eb2ee60db4381f73a360d5c7f9c5f46929b17491f975c1f1029fe1d50c179f
Instruction Fuzzy Hash: D4014431720210EBEB198B789D04B2A3298E710314F104A7FF845F22F1DA38CC028B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004023FB Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004023FB(void* __ebx) {
				void* _t10;
				void* _t14;
				long _t18;
				intOrPtr _t20;
				void* _t22;
				void* _t23;

				_t14 = __ebx;
				_t26 =  *(_t23 - 0x20) - __ebx;
				_t20 =  *((intOrPtr*)(_t23 - 0x2c));
				if( *(_t23 - 0x20) != __ebx) {
					_t18 = E00402D6C(_t20, E00402CAE(0x22),  *(_t23 - 0x20) >> 1);
					goto L4;
				} else {
					_t10 = E00402CEE(_t26, 2); // executed
					_t22 = _t10;
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t18 = RegDeleteValueW(_t22, E00402CAE(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t18 != _t14) {
							goto L6;
						}
					}
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}

0x004023fb
0x004023fb
0x004023fe
0x00402401
0x00402442
0x00000000
0x00402403
0x00402405
0x0040240a
0x0040240e
0x004028f8
0x004028f8
0x00402414
0x00402424
0x00402426
0x00402444
0x00402446
0x00000000
0x0040244c
0x00402446
0x0040240e
0x00402b35
0x00402b41

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040241D
RegCloseKey.ADVAPI32(00000000), ref: 00402426

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: b6563d0107f27e195cce995f2c8d86fc8ebf5aa2a9ea888175907e21cd39d444
Instruction ID: 2cb6f3a395b8cefba57e2531a40489e89468bce9e06ffb1f99048b80f3978ae9
Opcode Fuzzy Hash: b6563d0107f27e195cce995f2c8d86fc8ebf5aa2a9ea888175907e21cd39d444
Instruction Fuzzy Hash: 01F09632A04110ABEB10AFB99B4DAAE73A5EB44354F15413FE501B71C1CAFC5D01976D

Uniqueness

Uniqueness Score: -1.00%

Function 00401EAD Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401ECB
EnableWindow.USER32(00000000,00000000), ref: 00401ED6

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: f51269a2dd924127b9023de4c8c427af86de13d2d4068a468be739b9fc87797b
Instruction ID: 29f3bac75f9d42c6c58e1037aa9a05cccb91efacfbe9301a3dc3a34868252b41
Opcode Fuzzy Hash: f51269a2dd924127b9023de4c8c427af86de13d2d4068a468be739b9fc87797b
Instruction Fuzzy Hash: 35E0D832A48200DFE704EFA5AB4849E73B4EB50324B2084BFE841F21C1D6795D018F2D

Uniqueness

Uniqueness Score: -1.00%

Function 00406834 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406834(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004067C4(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x0040683c
0x0040683f
0x00406846
0x0040684e
0x0040685a
0x00000000
0x00406861
0x00406851
0x00406858
0x00000000
0x00406869
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040357F,0000000A), ref: 00406846
GetProcAddress.KERNEL32(00000000,?), ref: 00406861

Part of subcall function 004067C4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067DB
Part of subcall function 004067C4: wsprintfW.USER32 ref: 00406816
Part of subcall function 004067C4: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040682A

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 07bcd9f7c1bb34c043dcf5e1d9fd82fdf51fa46c8992409fda5611045c12fc59
Instruction ID: 319c73e69b0d8c246b150cb062a6f00a5fdf5cd7ba63cbeb88717ba4bd15e64b
Opcode Fuzzy Hash: 07bcd9f7c1bb34c043dcf5e1d9fd82fdf51fa46c8992409fda5611045c12fc59
Instruction Fuzzy Hash: 37E0863750461156D61067719E4883763AC9EC4714307C83EF557F2082D7389C35A6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405F50 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405F50(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405f54
0x00405f61
0x00405f76
0x00405f7c

APIs

GetFileAttributesW.KERNELBASE(00000003,00402FE0,C:\Users\user\Desktop\XShSI2OXaC.exe,80000000,00000003), ref: 00405F54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F76

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405F2B Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F2B(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00405f30
0x00405f36
0x00405f3b
0x00405f44
0x00405f44
0x00405f4d

APIs

GetFileAttributesW.KERNELBASE(?,?,00405B30,?,?,00000000,00405D06,?,?,?,?), ref: 00405F30
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405F44

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 1a3126d3354dcec6a0ef785dd7db255f636fa67ba3906e91fd9b2c9601c94d06
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 33D01272504421AFC3502738FF0C89BBF95DB543717024B35FAE9A22F0CB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405A0E Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A0E(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405a14
0x00405a1c
0x00000000
0x00405a22
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403500,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00405A14
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405A22

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: b97cdb7f8fd9dbf9b06a84b2522cdd4c36ecb485daa3e76472908bd57eea2c64
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: 30C04C30725602DAD7105F35EE49B177A50AB60741F118539A146E11A0DA388455DE2D

Uniqueness

Uniqueness Score: -1.00%

Function 73792AF8 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E73792AF8(intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t69;
				intOrPtr _t70;
				signed int _t75;
				intOrPtr _t77;
				intOrPtr _t78;
				void* _t79;
				void* _t85;
				void* _t86;
				void* _t87;
				void* _t88;
				intOrPtr _t91;
				intOrPtr _t92;

				if( *0x73795050 != 0 && E73792A3B(_a4) == 0) {
					 *0x73795054 = _t91;
					if( *0x7379504c != 0) {
						_t91 =  *0x7379504c;
					} else {
						E73792A35();
						L73793020();
						 *0x7379504c = _t91;
					}
				}
				_t28 = E73792A69(_a4);
				_t92 = _t91 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E73792A5D();
					_t70 = _a4;
					_t77 =  *0x73795058;
					 *((intOrPtr*)(_t29 + _t70)) = _t77;
					 *0x73795058 = _t70;
					E73792A57();
					_t33 = CreateFileA(??, ??, ??, ??, ??, ??, ??); // executed
					 *0x73795034 = _t33;
					 *0x73795038 = _t77;
					if( *0x73795050 != 0 && E73792A3B( *0x73795058) == 0) {
						 *0x7379504c = _t92;
						_t92 =  *0x73795054;
					}
					_t78 =  *0x73795058;
					_a4 = _t78;
					 *0x73795058 =  *((intOrPtr*)(E73792A5D() + _t78));
					_t37 = E73792A49(_t78);
					_pop(_t79);
					if(_t37 != 0) {
						_t40 = E73792A69(_t79);
						if(_t40 > 0) {
							_push(_t40);
							_push(E73792A74() + _a4 + _v8);
							_push(E73792A7E());
							if( *0x73795050 <= 0 || E73792A3B(_a4) != 0) {
								_pop(_t86);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t86 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t87);
								_pop(_t49);
								 *0x7379504c =  *0x7379504c +  *(_t87 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t105 =  *0x73795058;
					if( *0x73795058 == 0) {
						 *0x7379504c = 0;
					}
					E73792AA2(_t105, _a4,  *0x73795034,  *0x73795038);
					return _a4;
				}
				_push(E73792A74() + _a4);
				_t56 = E73792A7A();
				_v8 = _t56;
				_t75 = _t28;
				_push(_t67 + _t56 * _t75);
				_t69 = E73792A86();
				_t85 = E73792A82();
				_t88 = E73792A7E();
				_t61 = _t75;
				if( *((intOrPtr*)(_t88 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t69 + _t61)));
				}
				_push( *((intOrPtr*)(_t85 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x73792b08
0x73792b19
0x73792b26
0x73792b3a
0x73792b28
0x73792b28
0x73792b2d
0x73792b32
0x73792b32
0x73792b26
0x73792b43
0x73792b48
0x73792b4e
0x73792b92
0x73792b92
0x73792b97
0x73792b9c
0x73792ba2
0x73792ba4
0x73792baa
0x73792bb7
0x73792bb9
0x73792bbe
0x73792bcb
0x73792bde
0x73792be4
0x73792bea
0x73792beb
0x73792bf1
0x73792bfd
0x73792c03
0x73792c0b
0x73792c0c
0x73792c0f
0x73792c1a
0x73792c1c
0x73792c28
0x73792c2e
0x73792c36
0x73792c62
0x73792c63
0x73792c65
0x73792c69
0x73792c69
0x73792c70
0x73792c46
0x73792c46
0x73792c47
0x73792c55
0x73792c5e
0x73792c5e
0x73792c36
0x73792c1a
0x73792c72
0x73792c79
0x73792c7b
0x73792c7b
0x73792c94
0x73792ca2
0x73792ca2
0x73792b59
0x73792b5a
0x73792b5f
0x73792b63
0x73792b68
0x73792b7c
0x73792b7d
0x73792b7e
0x73792b80
0x73792b85
0x73792b87
0x73792b87
0x73792b8a
0x73792b90
0x00000000

APIs

CreateFileA.KERNELBASE(00000000), ref: 73792BB7

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0aac789a8d2dadf2ec48da45d0ab1e11d9f61ed6c61f0eca6aabc1ef23e486aa
Instruction ID: 7db6e88225853b8a7f80e0a377e9d0488daf46a52249fe1ed9020ca000ecbbd1
Opcode Fuzzy Hash: 0aac789a8d2dadf2ec48da45d0ab1e11d9f61ed6c61f0eca6aabc1ef23e486aa
Instruction Fuzzy Hash: C84184B380031DDFF720BF7AEA85B5D37B9EB05324F724715E80997250D63994428B99

Uniqueness

Uniqueness Score: -1.00%

Function 00402379 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402379(int __eax, WCHAR* __ebx) {
				WCHAR* _t11;
				WCHAR* _t13;
				void* _t17;
				int _t21;

				_t11 = __ebx;
				_t5 = __eax;
				_t13 = 0;
				if(__eax != __ebx) {
					__eax = E00402CAE(__ebx);
				}
				if( *((intOrPtr*)(_t17 - 0x2c)) != _t11) {
					_t13 = E00402CAE(0x11);
				}
				if( *((intOrPtr*)(_t17 - 0x20)) != _t11) {
					_t11 = E00402CAE(0x22);
				}
				_t5 = WritePrivateProfileStringW(0, _t13, _t11, E00402CAE(0xffffffcd)); // executed
				_t21 = _t5;
				if(_t21 == 0) {
					 *((intOrPtr*)(_t17 - 4)) = 1;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x00402379
0x00402379
0x0040237b
0x0040237f
0x00402382
0x00402387
0x0040238c
0x00402395
0x00402395
0x0040239a
0x004023a3
0x004023a3
0x004023b0
0x004015b4
0x004015b6
0x004028f8
0x004028f8
0x00402b35
0x00402b41

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023B0

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 9601c006d41a16f0afdecac95e1d419c249c3089e88b5417857d36a640550573
Instruction ID: 3fb2d04a1614f1a6bc23698adeb7223754221fe4427498fb00d70b88dfb5fea5
Opcode Fuzzy Hash: 9601c006d41a16f0afdecac95e1d419c249c3089e88b5417857d36a640550573
Instruction Fuzzy Hash: 44E08631904228BFFB2036F24F8D9BF10585B84308B05023FF911BA1C2D9FC0C0146AD

Uniqueness

Uniqueness Score: -1.00%

Function 00401735 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401735() {
				long _t5;
				WCHAR* _t8;
				WCHAR* _t12;
				void* _t14;
				long _t17;

				_t5 = SearchPathW(_t8, E00402CAE(0xffffffff), _t8, 0x400, _t12, _t14 + 8); // executed
				_t17 = _t5;
				if(_t17 == 0) {
					 *((intOrPtr*)(_t14 - 4)) = 1;
					 *_t12 = _t8;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t14 - 4));
				return 0;
			}

0x00401749
0x0040174f
0x00401751
0x004028c6
0x004028cd
0x004028cd
0x00402b35
0x00402b41

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401749

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: e7f88a0d22c9f110407def8aa129b6d26f32c3d072d6b4afce1cc69abb8e9d67
Instruction ID: 6e7ff5470ab2f12b053cd2503d26a25fa1c0f092c1bebc8e767124ea962facca
Opcode Fuzzy Hash: e7f88a0d22c9f110407def8aa129b6d26f32c3d072d6b4afce1cc69abb8e9d67
Instruction Fuzzy Hash: 3DE0D872200100ABD700CF64DE48AAB3368DF10368B20463AA511A50C0E2B45941872D

Uniqueness

Uniqueness Score: -1.00%

Function 004062F5 Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062F5(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E0040624C(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExW(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004062ff
0x00406308
0x0040631e
0x00000000
0x0040631e
0x0040630c
0x00000000

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402D5F,00000000,?,?), ref: 0040631E

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 1d27bdd3c8a422cc918e55e4a9669fd383ca8d239bfafc101a46dee2175e7680
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 48E0E672110109BEEF195F50DD1AD7B375DEB04304F01452EFE06D4051E6B5A9305675

Uniqueness

Uniqueness Score: -1.00%

Function 00406002 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406002(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00406006
0x00406016
0x0040601e
0x00000000
0x00406025
0x00000000
0x00406027

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040F798,0040CED0,00403446,0040CED0,0040F798,00414ED0,00004000,?,00000000,00403270,00000004), ref: 00406016

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 2997259de6e5d4005dd5f881aa819fa2749c3cd6e166e801e3b4d182d36d01ea
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: E3E08C3224021BEBDF109E618C00AEB3BACFF003A0F014432F912E3080EA71E82187A4

Uniqueness

Uniqueness Score: -1.00%

Function 00405FD3 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405FD3(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405fd7
0x00405fe7
0x00405fef
0x00000000
0x00405ff6
0x00000000
0x00405ff8

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,004034C2,0040A230,0040A230,004033C6,00414ED0,00004000,?,00000000,00403270), ref: 00405FE7

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: b0358b2c9be80bd8f0a0eaa99a097276cde4548a850c1ca62caac0562fdb88cc
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 2FE0EC3222025AABDF109F65DC00AEB7B6CEF05360F004436FD65E6550E635E921ABE4

Uniqueness

Uniqueness Score: -1.00%

Function 737929DF Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x73795048 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x7379505c, 4, 0x40, 0x7379504c); // executed
					 *0x7379505c = 0xc2;
					 *0x7379504c = 0;
					 *0x73795054 = 0;
					 *0x73795068 = 0;
					 *0x73795058 = 0;
					 *0x73795050 = 0;
					 *0x73795060 = 0;
					 *0x7379505e = 0;
				}
				return 1;
			}

0x737929e8
0x737929ed
0x737929fd
0x73792a05
0x73792a0c
0x73792a11
0x73792a16
0x73792a1b
0x73792a20
0x73792a25
0x73792a2a
0x73792a2a
0x73792a32

APIs

VirtualProtect.KERNELBASE(7379505C,00000004,00000040,7379504C), ref: 737929FD

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 249a83eedaea1859afd21e3fa214f4300e56d03f79f16e6b4d96f32a0fce819f
Instruction ID: 21a8adc6af73a083f62ac635738457b4444ab98e5b6dafba6480340bbf1450c2
Opcode Fuzzy Hash: 249a83eedaea1859afd21e3fa214f4300e56d03f79f16e6b4d96f32a0fce819f
Instruction Fuzzy Hash: 1AF092F26052AADED350EF3F84457093BE0B709324BA7476AE59CE6241E3384047DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004062C7 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062C7(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E0040624C(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004062d1
0x004062d8
0x004062eb
0x00000000
0x004062eb
0x004062dc
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,00406355,00422708,00000000,?,?,Call,?), ref: 004062EB

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 301d5bfd228a7b0f97f72eca07c901c818709d702d75485ac80095db88ac8d1a
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: DAD0123210020DBBDF116F909D05FAB371DAB04750F41443AFE16A4091DB76D530AB18

Uniqueness

Uniqueness Score: -1.00%

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015A3() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesW(E00402CAE(0xfffffff0),  *(_t11 - 0x2c)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015ae
0x004015b4
0x004015b6
0x004028f8
0x004028f8
0x00402b35
0x00402b41

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ec5a7945da8e4123722d2e20c9764dad1101e41e920816de930f4510e291aefe
Instruction ID: 0ec9aac6f264e37de16dfec1d07106f7ddcd63ed908df7f08b9f57ccdda1d4b4
Opcode Fuzzy Hash: ec5a7945da8e4123722d2e20c9764dad1101e41e920816de930f4510e291aefe
Instruction Fuzzy Hash: 47D01232B04104DBDB10DFA9AB0859E7374EB10368B204237D511F11D0D2B99951A71D

Uniqueness

Uniqueness Score: -1.00%

Function 004034C5 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004034C5(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x004034d3
0x004034d9

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004031C3,?), ref: 004034D3

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 004043FC Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004043FC(int _a4) {
				long _t2;

				_t2 = SendMessageW( *0x42a248, 0x28, _a4, 1); // executed
				return _t2;
			}

0x0040440a
0x00404410

APIs

SendMessageW.USER32(00000028,?,00000001,00404227), ref: 0040440A

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00405A86 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A86(struct _SHELLEXECUTEINFOW* _a4) {
				struct _SHELLEXECUTEINFOW* _t4;
				int _t5;

				_t4 = _a4;
				_t4->lpIDList = _t4->lpIDList & 0x00000000;
				_t4->cbSize = 0x3c; // executed
				_t5 = ShellExecuteExW(_t4); // executed
				return _t5;
			}

0x00405a86
0x00405a8b
0x00405a8f
0x00405a95
0x00405a9b

APIs

ShellExecuteExW.SHELL32(?), ref: 00405A95

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: fbdde1e211bf9c759df7b0f81bfbcb60f8cdccf4e78a0d8a998f91d13d5c86f6
Instruction ID: 923d99ad9cc7c2cd2e65252a1a37f78a8d30594c4c7a615bb4925eb6a4e84790
Opcode Fuzzy Hash: fbdde1e211bf9c759df7b0f81bfbcb60f8cdccf4e78a0d8a998f91d13d5c86f6
Instruction Fuzzy Hash: 27C092B2000200DFE301CF90CB08F067BF8AF54306F028068E184DA060C7788840CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00401F73 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401F73(void* __ecx) {
				void* _t9;
				intOrPtr _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t17 = __ecx;
				_t19 = E00402CAE(_t15);
				E004054C2(0xffffffeb, _t7);
				_t9 = E00405A43(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x28)) != _t15) {
						_t13 = E004068E5(_t17, _t20);
						if( *((intOrPtr*)(_t22 - 0x2c)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E004063A1( *((intOrPtr*)(_t22 - 0x14)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401f73
0x00401f79
0x00401f7e
0x00401f84
0x00401f89
0x00401f8d
0x004028f8
0x00401f93
0x00401f96
0x00401f99
0x00401fa1
0x00401fb0
0x00401fb2
0x00401fb2
0x00401fa3
0x00401fa7
0x00401fa7
0x00401fa1
0x00401fb9
0x00401fba
0x00401fba
0x00402b35
0x00402b41

APIs

Part of subcall function 004054C2: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000,?), ref: 004054FA
Part of subcall function 004054C2: lstrlenW.KERNEL32(00402F75,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000), ref: 0040550A
Part of subcall function 004054C2: lstrcatW.KERNEL32(00422708,00402F75), ref: 0040551D
Part of subcall function 004054C2: SetWindowTextW.USER32(00422708,00422708), ref: 0040552F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405555
Part of subcall function 004054C2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040556F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040557D

Part of subcall function 00405A43: CreateProcessW.KERNELBASE ref: 00405A6C
Part of subcall function 00405A43: CloseHandle.KERNEL32(?), ref: 00405A79

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FBA

Part of subcall function 004068E5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004068F6
Part of subcall function 004068E5: GetExitCodeProcess.KERNEL32 ref: 00406918

Part of subcall function 004063A1: wsprintfW.USER32 ref: 004063AE

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 9b4ff1c06b283f22caa25aa4ad723ba2de41089ec68a37c39f462cf81b32eb44
Instruction ID: 907f70165cb3966a452affbaf40be71d7913b7c5b0eff33aa528ec34af34de81
Opcode Fuzzy Hash: 9b4ff1c06b283f22caa25aa4ad723ba2de41089ec68a37c39f462cf81b32eb44
Instruction Fuzzy Hash: 9AF09672905111DBCB20AFA589849DEB674EF00319B21433BE601B21D1C7BC4D519AAE

Uniqueness

Uniqueness Score: -1.00%

Function 7379121B Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E7379121B() {
				void* _t3;

				_t3 = GlobalAlloc(0x40,  *0x7379506c +  *0x7379506c); // executed
				return _t3;
			}

0x73791225
0x7379122b

APIs

GlobalAlloc.KERNELBASE(00000040,?,7379123B,?,737912DF,00000019,737911BE,-000000A0), ref: 73791225

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 6b04a760b66a67f43eab5998b2106a665af9bab0ff95fb3f40ef382e53923790
Instruction ID: 0db5df656bdca4350933abdd54ca7bdb4d4382ceadcc9daff75f0bc7e44585d0
Opcode Fuzzy Hash: 6b04a760b66a67f43eab5998b2106a665af9bab0ff95fb3f40ef382e53923790
Instruction Fuzzy Hash: 44B012B2B00015DFEE00EB7DCC07F343254E700301F554340F608E0180C12848018534

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00405601 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405601(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x429224;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00405595, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E0040647C(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x423728;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x42920c == _t156) {
							ShowWindow( *0x42a248, 8);
							if( *0x42a2ec == _t156) {
								E004054C2( *((intOrPtr*)( *0x422700 + 0x34)), _t156);
							}
							E004043A0(_t171);
							goto L25;
						}
						 *0x421ef8 = 2;
						E004043A0(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E0040442E(_a8, _a12, _a16);
						}
						ShowWindow( *0x429210, _t156);
						ShowWindow(_t169, 8);
						E004043FC(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x42a254;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x429210 = GetDlgItem(_a4, 0x403);
				 *0x429208 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x429224 = _t134;
				_v8 = _t134;
				E004043FC( *0x429210);
				 *0x429214 = E00404D55(4);
				 *0x42922c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004043C7(_a4);
				if(( *0x42a25c & 0x00000003) != 0) {
					ShowWindow( *0x429210, _t156);
					if(( *0x42a25c & 0x00000002) != 0) {
						 *0x429210 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004043FC( *0x429208);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x42a25c & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405609
0x0040560f
0x00405619
0x0040561c
0x004057b2
0x004057d6
0x004057d6
0x004057e9
0x00405807
0x00405809
0x00405811
0x00405867
0x0040586b
0x00000000
0x00000000
0x0040586d
0x00405873
0x00000000
0x00000000
0x0040587d
0x00405885
0x00405888
0x0040598a
0x00000000
0x0040598a
0x00405897
0x004058a2
0x004058ab
0x004058b6
0x004058b9
0x004058c2
0x004058c8
0x004058cb
0x004058cb
0x004058e3
0x004058ec
0x004058ef
0x004058f6
0x004058fd
0x00405905
0x00405905
0x0040591c
0x0040591c
0x00405923
0x00405929
0x00405935
0x0040593c
0x00405945
0x00405947
0x0040594a
0x00405959
0x0040595c
0x00405962
0x00405963
0x00405969
0x0040596a
0x0040596b
0x00405973
0x0040597e
0x00405984
0x00405984
0x00000000
0x004058e3
0x00405819
0x00405849
0x00405851
0x0040585c
0x0040585c
0x00405862
0x00000000
0x00405862
0x0040581d
0x00405827
0x00000000
0x004057eb
0x004057f1
0x0040582c
0x00000000
0x00405835
0x004057fa
0x004057ff
0x00405802
0x00000000
0x00405802
0x004057e9
0x00405622
0x00405626
0x0040562e
0x00405632
0x00405635
0x00405638
0x0040563b
0x0040563e
0x0040563f
0x00405640
0x00405659
0x0040565c
0x00405666
0x00405675
0x0040567d
0x00405685
0x0040568a
0x0040568d
0x00405699
0x004056a2
0x004056ab
0x004056cd
0x004056d3
0x004056e4
0x004056e9
0x004056f7
0x00405705
0x00405705
0x0040570a
0x00405718
0x00405718
0x0040571d
0x00405720
0x00405725
0x00405731
0x0040573a
0x00405747
0x00405756
0x00405749
0x0040574e
0x0040574e
0x00405762
0x00405762
0x00405776
0x0040577f
0x00405788
0x00405798
0x004057a4
0x004057a4
0x00000000

APIs

GetDlgItem.USER32 ref: 0040565F
GetDlgItem.USER32 ref: 0040566E
GetClientRect.USER32 ref: 004056AB
GetSystemMetrics.USER32 ref: 004056B2
SendMessageW.USER32(?,00001061,00000000,?), ref: 004056D3
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004056E4
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004056F7
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405705
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405718
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040573A
ShowWindow.USER32(?,00000008), ref: 0040574E
GetDlgItem.USER32 ref: 0040576F
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040577F
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405798
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004057A4
GetDlgItem.USER32 ref: 0040567D

Part of subcall function 004043FC: SendMessageW.USER32(00000028,?,00000001,00404227), ref: 0040440A

GetDlgItem.USER32 ref: 004057C1
CreateThread.KERNEL32 ref: 004057CF
CloseHandle.KERNEL32(00000000), ref: 004057D6
ShowWindow.USER32(00000000), ref: 004057FA
ShowWindow.USER32(?,00000008), ref: 004057FF
ShowWindow.USER32(00000008), ref: 00405849
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040587D
CreatePopupMenu.USER32 ref: 0040588E
AppendMenuW.USER32 ref: 004058A2
GetWindowRect.USER32 ref: 004058C2
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058DB
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405913
OpenClipboard.USER32(00000000), ref: 00405923
EmptyClipboard.USER32 ref: 00405929
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405935
GlobalLock.KERNEL32 ref: 0040593F
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405953
GlobalUnlock.KERNEL32(00000000), ref: 00405973
SetClipboardData.USER32 ref: 0040597E
CloseClipboard.USER32 ref: 00405984

Strings

{, xrefs: 00405867
(7B, xrefs: 004058EF

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: d8c1e90b6afee1d2abfc811bf1f47acf4b068a87cda40882d81a3633811ed049
Instruction ID: 57b37923abf7c62d7f6dcc3c8969a445466a7af2e7eb69d9544375f2dbecd28f
Opcode Fuzzy Hash: d8c1e90b6afee1d2abfc811bf1f47acf4b068a87cda40882d81a3633811ed049
Instruction Fuzzy Hash: D0B15AB1900608FFDB11AFA0DD89AAE7B79FB44354F00807AFA45B61A0CB754E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 004048B8 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004048B8(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x422700;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x42b000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405AA4(0x3fb, _t146);
					E004066EE(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405AA4(0x3fb, _t146);
							if(E00405E37(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040645A(0x4216f8, _t146);
							_t87 = E00406834(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040645A(0x4216f8, _t146);
								_t89 = E00405DDA(0x4216f8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x4216f8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x4216f8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x4216f8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405D7B(0x4216f8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x4216f8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404D55(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42921c + 0x10)) != _t158) {
									E00404D3D(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x4216e8);
									} else {
										E00404C74(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42a304 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004043E9(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x423718 == _t158) {
									E00404811();
								}
								 *0x423718 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x423728;
							_v60 = E00404C0E;
							_v56 = _t146;
							_v68 = E0040647C(_t146, 0x423728, _t167, 0x421f00, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405D2F(_t146);
								_t125 =  *((intOrPtr*)( *0x42a254 + 0x11c));
								if( *((intOrPtr*)( *0x42a254 + 0x11c)) != 0 && _t146 == L"C:\\Users\\hardz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Tonefilmsgengiveren") {
									E0040647C(_t146, 0x423728, _t167, 0, _t125);
									if(lstrcmpiW(0x4281e0, 0x423728) != 0) {
										lstrcatW(_t146, 0x4281e0);
									}
								}
								 *0x423718 =  *0x423718 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405DA6(_t146) != 0 && E00405DDA(_t146) == 0) {
						E00405D2F(_t146);
					}
					 *0x429218 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004043C7(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004043C7(_t167);
					E004043FC(_t166);
					_t138 = E00406834(7);
					if(_t138 == 0) {
						L53:
						return E0040442E(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x004048b8
0x004048be
0x004048c4
0x004048d1
0x004048df
0x004048e2
0x004048ea
0x004048f0
0x004048f0
0x004048fc
0x004048ff
0x0040496d
0x00404974
0x00404a4b
0x00404a52
0x00404a61
0x00404a61
0x00404a65
0x00404a6f
0x00404a7c
0x00404a7e
0x00404a7e
0x00404a8c
0x00404a93
0x00404a9a
0x00404a9d
0x00404ad9
0x00404adb
0x00404ae1
0x00404ae6
0x00404aea
0x00404aec
0x00404aec
0x00404b08
0x00000000
0x00404b0a
0x00404b0d
0x00404b1b
0x00404b21
0x00404b22
0x00404b25
0x00404b28
0x00000000
0x00404b28
0x00404a9f
0x00404aa1
0x00404aa5
0x00000000
0x00000000
0x00000000
0x00000000
0x00404aa7
0x00404aa7
0x00404ab4
0x00404ab9
0x00000000
0x00000000
0x00404abd
0x00404abf
0x00404abf
0x00404ac8
0x00404aca
0x00404acf
0x00404ad2
0x00404ad7
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ad7
0x00404b34
0x00404b3e
0x00404b41
0x00404b44
0x00404b4b
0x00404b4b
0x00404b4d
0x00404b4d
0x00404b52
0x00404b54
0x00404b5c
0x00404b63
0x00404b65
0x00404b70
0x00404b70
0x00404b65
0x00404b80
0x00404b8a
0x00404b92
0x00404bad
0x00404b94
0x00404b9d
0x00404b9d
0x00404b92
0x00404bb2
0x00404bb7
0x00404bbc
0x00404bc5
0x00404bc5
0x00404bce
0x00404bd0
0x00404bd0
0x00404bdc
0x00404be4
0x00404bee
0x00404bee
0x00404bf3
0x00000000
0x00404bf3
0x00404a9d
0x00404a54
0x00404a5b
0x00000000
0x00000000
0x00000000
0x00404a5b
0x0040497a
0x00404983
0x0040499d
0x004049a2
0x004049ac
0x004049b3
0x004049bf
0x004049c2
0x004049c5
0x004049cc
0x004049d4
0x004049d7
0x004049db
0x004049e2
0x004049ea
0x00404a44
0x004049ec
0x004049ed
0x004049f4
0x004049fe
0x00404a06
0x00404a13
0x00404a27
0x00404a2b
0x00404a2b
0x00404a27
0x00404a30
0x00404a3d
0x00404a3d
0x004049ea
0x00000000
0x004049a2
0x00404990
0x00000000
0x00000000
0x00404996
0x00000000
0x00404901
0x0040490e
0x00404917
0x00404924
0x00404924
0x0040492b
0x00404931
0x0040493a
0x0040493d
0x00404940
0x00404948
0x0040494b
0x0040494e
0x00404954
0x0040495b
0x00404962
0x00404bf9
0x00404c0b
0x00404968
0x0040496b
0x00000000
0x0040496b
0x00404962

APIs

GetDlgItem.USER32 ref: 00404907
SetWindowTextW.USER32(00000000,?), ref: 00404931
SHBrowseForFolderW.SHELL32(?), ref: 004049E2
CoTaskMemFree.OLE32(00000000), ref: 004049ED
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 00404A1F
lstrcatW.KERNEL32(?,Call), ref: 00404A2B
SetDlgItemTextW.USER32 ref: 00404A3D

Part of subcall function 00405AA4: GetDlgItemTextW.USER32 ref: 00405AB7

Part of subcall function 004066EE: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\XShSI2OXaC.exe",004034E8,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00406751
Part of subcall function 004066EE: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406760
Part of subcall function 004066EE: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\XShSI2OXaC.exe",004034E8,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00406765
Part of subcall function 004066EE: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\XShSI2OXaC.exe",004034E8,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00406778

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404B00
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404B1B

Part of subcall function 00404C74: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404D15
Part of subcall function 00404C74: wsprintfW.USER32 ref: 00404D1E
Part of subcall function 00404C74: SetDlgItemTextW.USER32 ref: 00404D31

Strings

(7B, xrefs: 004049B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren, xrefs: 00404A08
Call, xrefs: 00404A19, 00404A1E, 00404A29
A, xrefs: 004049DB

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren$Call
API String ID: 2624150263-1677722896
Opcode ID: 0252ed9a715354261ce1cbd26f8a82e542ffa2d05d4ed3813ca7ece7b5af81dc
Instruction ID: 7e89359670182c81d5fc0afff13f478913f2a5a11c1e0dfb2566146df388d748
Opcode Fuzzy Hash: 0252ed9a715354261ce1cbd26f8a82e542ffa2d05d4ed3813ca7ece7b5af81dc
Instruction Fuzzy Hash: 4EA161B1A00209ABDB119FA5CD85AAF77B8EF84314F10843BF601B62D1D77C99418F6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404586 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404586(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x4216f4 =  *0x4216f4 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E0040442E(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x4281e0;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E00404835(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x42a248, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x42a248, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x4216f4 != 0) {
						goto L27;
					} else {
						_t116 =  *0x422700 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004043E9(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404811();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x42921c - 4 + _t75 * 4);
				}
				_t76 =  *0x42a298 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404537;
				if(_t110 != 2) {
					_v8 = E004044FD;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E004043C7(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E004043C7(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004043E9( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004043FC(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x42a254 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x4216f4 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x4216f4 = 0;
				return 0;
			}

0x00404598
0x004046c5
0x00404722
0x00404726
0x004047f3
0x004047f5
0x004047f5
0x004047fb
0x004047fb
0x004047fe
0x00000000
0x00404805
0x00404734
0x0040473a
0x00404744
0x0040474f
0x00404752
0x00404755
0x00404760
0x00404763
0x0040476a
0x00404777
0x00404788
0x0040478e
0x00404796
0x004047a4
0x004047aa
0x004047aa
0x0040476a
0x004047b4
0x00000000
0x004047bf
0x004047c3
0x004047d3
0x004047d3
0x004047d9
0x004047e5
0x004047e5
0x00000000
0x004047e9
0x004047b4
0x004046d0
0x00000000
0x004046e2
0x004046e7
0x004046ed
0x00000000
0x00000000
0x00404716
0x00404718
0x0040471d
0x00000000
0x0040471d
0x004046d0
0x0040459e
0x004045a1
0x004045a6
0x004045b7
0x004045b7
0x004045bf
0x004045c2
0x004045c6
0x004045c9
0x004045cd
0x004045d0
0x004045d3
0x004045d6
0x004045dd
0x004045df
0x004045df
0x004045e9
0x004045f6
0x00404600
0x00404605
0x00404608
0x0040460d
0x00404624
0x0040462b
0x0040463e
0x00404641
0x00404655
0x0040465c
0x00404661
0x00404666
0x00404666
0x00404674
0x00404682
0x00404694
0x00404699
0x004046a9
0x004046ab
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404624
GetDlgItem.USER32 ref: 00404638
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404655
GetSysColor.USER32(?), ref: 00404666
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404674
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404682
lstrlenW.KERNEL32(?), ref: 00404687
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404694
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004046A9
GetDlgItem.USER32 ref: 00404702
SendMessageW.USER32(00000000), ref: 00404709
GetDlgItem.USER32 ref: 00404734
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404777
LoadCursorW.USER32(00000000,00007F02), ref: 00404785
SetCursor.USER32(00000000), ref: 00404788
LoadCursorW.USER32(00000000,00007F00), ref: 004047A1
SetCursor.USER32(00000000), ref: 004047A4
SendMessageW.USER32(00000111,00000001,00000000), ref: 004047D3
SendMessageW.USER32(00000010,00000000,00000000), ref: 004047E5

Strings

N, xrefs: 00404722
Call, xrefs: 00404763

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: fe6d88c84ce4a6866a8854ecfcd1079003fa0f268522a77675e0074e71bbee89
Instruction ID: f77f33f3611030bf7bd25e174036683ded81e7201e23494f0dcecd4f302afade
Opcode Fuzzy Hash: fe6d88c84ce4a6866a8854ecfcd1079003fa0f268522a77675e0074e71bbee89
Instruction Fuzzy Hash: 8A6184B5900209BFDB109F60DD85EAA7B69FB84314F00853AF705B76E0C7789951DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42a254;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x429240, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42a248;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8b567d9f270fbef820470e017d39f84f8bb96db322f3492e017c6be64606202e
Instruction ID: 87017e81dcb8f5ebc50a946e37e47e130d338b4c793663e9eeae85a37f05bdc9
Opcode Fuzzy Hash: 8b567d9f270fbef820470e017d39f84f8bb96db322f3492e017c6be64606202e
Instruction Fuzzy Hash: 02417971800249AFCF058F95DE459AF7BB9FF44310F04842AF991AA2A0C738E955DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004060A6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060A6(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x426dc8 = 0x55004e;
				 *0x426dcc = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x4275c8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4269c8, "%ls=%ls\r\n", 0x426dc8, 0x4275c8);
						_t53 = _t52 + 0x10;
						E0040647C(_t37, 0x400, 0x4275c8, 0x4275c8,  *((intOrPtr*)( *0x42a254 + 0x128)));
						_t12 = E00405F50(0x4275c8, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405FD3(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405EB5(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405EB5(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405F0B(_t24 + _t46, 0x4269c8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00406002(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405F50(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x426dc8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x004060a6
0x004060af
0x004060b6
0x004060c0
0x004060d4
0x004060fc
0x00406107
0x0040610b
0x0040612b
0x00406132
0x0040613c
0x00406149
0x0040614e
0x00406153
0x00406157
0x00406166
0x00406168
0x00406175
0x00406179
0x00406214
0x00000000
0x0040618f
0x0040619c
0x004061c0
0x004061c4
0x004061e3
0x004061e7
0x004061e7
0x004061e9
0x004061f2
0x004061fd
0x00406208
0x0040620e
0x00000000
0x0040620e
0x004061c6
0x004061c9
0x004061d4
0x004061d0
0x004061d2
0x004061d3
0x004061d3
0x004061db
0x004061dd
0x00000000
0x004061dd
0x004061a7
0x004061ad
0x00000000
0x004061ad
0x00406179
0x00406157
0x004060d6
0x004060e1
0x004060ea
0x004060ee
0x00000000
0x00000000
0x004060ee
0x0040621f

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406241,?,?), ref: 004060E1
GetShortPathNameW.KERNEL32 ref: 004060EA

Part of subcall function 00405EB5: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040619A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC5
Part of subcall function 00405EB5: lstrlenA.KERNEL32(00000000,?,00000000,0040619A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EF7

GetShortPathNameW.KERNEL32 ref: 00406107
wsprintfA.USER32 ref: 00406125
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00406160
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040616F
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004061A7
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 004061FD
GlobalFree.KERNEL32 ref: 0040620E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406215

Part of subcall function 00405F50: GetFileAttributesW.KERNELBASE(00000003,00402FE0,C:\Users\user\Desktop\XShSI2OXaC.exe,80000000,00000003), ref: 00405F54
Part of subcall function 00405F50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F76

Strings

%ls=%ls, xrefs: 0040611B
[Rename], xrefs: 0040618F, 004061A1

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 60dd5ea2b8f33da5605f18c3c5e138be2b7bc2f8ceaa26a2faba86cdb3134d33
Instruction ID: 33ca5311cd38375991bafdd118bf339a61483ebf944123bedf703d6834ebb59b
Opcode Fuzzy Hash: 60dd5ea2b8f33da5605f18c3c5e138be2b7bc2f8ceaa26a2faba86cdb3134d33
Instruction Fuzzy Hash: F73136302007157BC2207B619D48F6B3AACEF85704F15003EFA46FA2C2DA3CD9158ABC

Uniqueness

Uniqueness Score: -1.00%

Function 004066EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004066EE(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405DA6(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405D5C(L"*?|<>/\":", _t5))) == 0) {
							E00405F0B(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004066f0
0x004066f9
0x00406710
0x00406710
0x00406717
0x00406723
0x00406723
0x00406726
0x00406729
0x0040672e
0x00406730
0x00406739
0x0040673d
0x0040675a
0x00406762
0x00406762
0x00406767
0x00406769
0x0040676c
0x00406771
0x00406772
0x00406776
0x00406776
0x00406777
0x0040677e
0x00406780
0x00406787
0x00000000
0x00000000
0x0040678f
0x00406795
0x00000000
0x00000000
0x00000000
0x00406795
0x0040679a

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\XShSI2OXaC.exe",004034E8,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00406751
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406760
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\XShSI2OXaC.exe",004034E8,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00406765
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\XShSI2OXaC.exe",004034E8,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00406778

Strings

*?|<>/":, xrefs: 00406740
C:\Users\user\AppData\Local\Temp\, xrefs: 004066EF, 004066F4
"C:\Users\user\Desktop\XShSI2OXaC.exe", xrefs: 004066EE

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\XShSI2OXaC.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3842526770
Opcode ID: d2c792b21fb1c9a0f35e2ccc83d92ac659fb87b1516e82186fb6d0303eeafb41
Instruction ID: a059b87dc88a97331373638ea51a570c055a76a683b424159f29c72f88605938
Opcode Fuzzy Hash: d2c792b21fb1c9a0f35e2ccc83d92ac659fb87b1516e82186fb6d0303eeafb41
Instruction Fuzzy Hash: 6411AB1580061295DB303B588D84A7766F8EF957A8F56803FED85732C0E77C5C92C6BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040442E Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040442E(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x00404440
0x004044f6
0x00000000
0x004044f6
0x00404451
0x00404455
0x00000000
0x0040446f
0x0040446f
0x00404478
0x00000000
0x00000000
0x0040447a
0x00404486
0x00404489
0x00404489
0x0040448f
0x00404495
0x00404495
0x004044a1
0x004044a7
0x004044ae
0x004044b1
0x004044b4
0x004044b6
0x004044b6
0x004044be
0x004044c4
0x004044c4
0x004044ce
0x004044d3
0x004044d6
0x004044db
0x004044de
0x004044de
0x004044ee
0x004044ee
0x00000000
0x004044f1

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040444B
GetSysColor.USER32(00000000), ref: 00404489
SetTextColor.GDI32(?,00000000), ref: 00404495
SetBkMode.GDI32(?,?), ref: 004044A1
GetSysColor.USER32(?), ref: 004044B4
SetBkColor.GDI32(?,?), ref: 004044C4
DeleteObject.GDI32(?), ref: 004044DE
CreateBrushIndirect.GDI32(?), ref: 004044E8

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 617cf2913f18f97dd307dc7f6a378bb3eb3034db93ee5e35f7a0352d8b85e1af
Instruction ID: 60ff45c40e4ecddfbab08c3fa4b15e241a5859f7a85506874da9092032a3abca
Opcode Fuzzy Hash: 617cf2913f18f97dd307dc7f6a378bb3eb3034db93ee5e35f7a0352d8b85e1af
Instruction Fuzzy Hash: C32165715007049FC730DF68DD48B5BBBF8AF41710B058A3EEA96A22E0D738E944DB64

Uniqueness

Uniqueness Score: -1.00%

Function 004054C2 Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054C2(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x429224;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x42a314;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E0040647C(_t38, 0, 0x422708, 0x422708, _a4);
					}
					_t27 = lstrlenW(0x422708);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x429208, 0x422708);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x422708;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x422708[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x422708, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004054c8
0x004054d2
0x004054d7
0x004054dd
0x004054e8
0x004054eb
0x004054ee
0x004054f4
0x004054f4
0x004054fa
0x00405502
0x00405505
0x00405522
0x00405526
0x0040552f
0x0040552f
0x00405539
0x00405542
0x0040554e
0x00405555
0x00405559
0x0040555c
0x0040556f
0x0040557d
0x0040557d
0x00405581
0x00405583
0x00405586
0x00000000
0x00405586
0x00405507
0x0040550f
0x00405517
0x0040551d
0x00000000
0x0040551d
0x00405517
0x00405505
0x00405592

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000,?), ref: 004054FA
lstrlenW.KERNEL32(00402F75,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000), ref: 0040550A
lstrcatW.KERNEL32(00422708,00402F75), ref: 0040551D
SetWindowTextW.USER32(00422708,00422708), ref: 0040552F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405555
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040556F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040557D

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 9e0bdb6346b0f994b682a9d5b71920b92d826be4185ec099d35721c16329a7cb
Instruction ID: a18cbf73499bb1d2d8e5654cf5bea6f6aa35aabb0db4b10484b175f0a0467538
Opcode Fuzzy Hash: 9e0bdb6346b0f994b682a9d5b71920b92d826be4185ec099d35721c16329a7cb
Instruction Fuzzy Hash: EC219A75900518BBCB119FA5DD85EDFBFB9EF45314F10803AF944B22A4C7798A80CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402EFB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402EFB(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x420edc; // 0x0
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x420edc = 0;
					return _t15;
				}
				__eflags =  *0x420edc; // 0x0
				if(__eflags != 0) {
					return E00406870(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x42a250;
				if(_t6 >  *0x42a250) {
					__eflags =  *0x42a248;
					if( *0x42a248 == 0) {
						_t7 = CreateDialogParamW( *0x42a240, 0x6f, 0, E00402E60, 0);
						 *0x420edc = _t7;
						return ShowWindow(_t7, 5);
					}
					__eflags =  *0x42a314 & 0x00000001;
					if(( *0x42a314 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00402EDF());
						return E004054C2(0,  &_v132);
					}
				}
				return _t6;
			}

0x00402f0a
0x00402f0c
0x00402f13
0x00402f16
0x00402f16
0x00402f1c
0x00000000
0x00402f1c
0x00402f24
0x00402f2a
0x00000000
0x00402f2d
0x00402f34
0x00402f3a
0x00402f40
0x00402f42
0x00402f48
0x00402f86
0x00402f8f
0x00000000
0x00402f94
0x00402f4a
0x00402f51
0x00402f62
0x00000000
0x00402f70
0x00402f51
0x00402f9c

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402F16
GetTickCount.KERNEL32 ref: 00402F34
wsprintfW.USER32 ref: 00402F62

Part of subcall function 004054C2: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000,?), ref: 004054FA
Part of subcall function 004054C2: lstrlenW.KERNEL32(00402F75,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F75,00000000), ref: 0040550A
Part of subcall function 004054C2: lstrcatW.KERNEL32(00422708,00402F75), ref: 0040551D
Part of subcall function 004054C2: SetWindowTextW.USER32(00422708,00422708), ref: 0040552F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405555
Part of subcall function 004054C2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040556F
Part of subcall function 004054C2: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040557D

CreateDialogParamW.USER32 ref: 00402F86
ShowWindow.USER32(00000000,00000005), ref: 00402F94

Part of subcall function 00402EDF: MulDiv.KERNEL32(00000000,00000064,000028C8), ref: 00402EF4

Strings

... %d%%, xrefs: 00402F5C

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 4d71abfedea8216acf31a318e7d653059bec24c0b1581b37a2388d94480de2ff
Instruction ID: c835cab9cf95804a9e220c2b2a6f2bba79fc6a238bf24d18bb07405d6def7bbc
Opcode Fuzzy Hash: 4d71abfedea8216acf31a318e7d653059bec24c0b1581b37a2388d94480de2ff
Instruction Fuzzy Hash: 05013C70545226EBC621AB61EE0DB5A7AB8EB00785B50043BF841B11E1CAF84451DBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00404D82 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D82(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404d90
0x00404d9d
0x00404da3
0x00404de1
0x00404de1
0x00404df0
0x00404df7
0x00000000
0x00404df9
0x00404da5
0x00404db4
0x00404dbc
0x00404dbf
0x00404dd1
0x00404dd7
0x00404dde
0x00000000
0x00404dde
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D9D
GetMessagePos.USER32 ref: 00404DA5
ScreenToClient.USER32 ref: 00404DBF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404DD1
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404DF7

Strings

f, xrefs: 00404DD3

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 2fe71596f992367620cc841cd4a8b2234c7bbe1da4697501c89de4d2e6d6bd97
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: DA015E7190021CBADB00DB95DD85BFEBBBCAF95B11F10412BBA50B61D0C7B49A018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E1D(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402C8C(2);
				 *((intOrPtr*)(_t35 - 0xc)) = _t30;
				0x40cdd8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40cde8 = E00402C8C(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0xc)) = _t30;
				 *0x40cdef = 1;
				 *0x40cdec = _t15 & 0x00000001;
				 *0x40cded = _t15 & 0x00000002;
				 *0x40cdee = _t15 & 0x00000004;
				E0040647C(_t9, _t31, _t33, "Tahoma",  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdd8);
				_push(_t18);
				_push(_t33);
				E004063A1();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e1d
0x00401e28
0x00401e2a
0x00401e37
0x00401e4e
0x00401e53
0x00401e60
0x00401e65
0x00401e69
0x00401e74
0x00401e7b
0x00401e8d
0x00401e93
0x00401e98
0x00401ea2
0x004025ff
0x0040156d
0x00402ad8
0x00402b35
0x00402b41

APIs

GetDC.USER32(?), ref: 00401E20
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E3A
MulDiv.KERNEL32(00000000,00000000), ref: 00401E42
ReleaseDC.USER32 ref: 00401E53
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401EA2

Strings

Tahoma, xrefs: 00401E88

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: e820e343554ebd5cd910c3d597f4bcaada3dd5fa4f7a50b9ba833545992de9e5
Instruction ID: 563da1dfe58b65cf3b22a9de6ab01e1ef98925f3547e6c85557ca534958f4eab
Opcode Fuzzy Hash: e820e343554ebd5cd910c3d597f4bcaada3dd5fa4f7a50b9ba833545992de9e5
Instruction Fuzzy Hash: 41017171944240EFE701ABB4AE89ADA7FB4AF59301F10857EF181F71E2CA7800059F2C

Uniqueness

Uniqueness Score: -1.00%

Function 7379161D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E7379161D(char _a4, short* _a8) {
				_Unknown_base(*)()* _t7;
				void* _t10;
				int _t14;

				_t14 = WideCharToMultiByte(0, 0, _a8, 0xffffffff, 0, 0, 0, 0);
				_t10 = GlobalAlloc(0x40, _t14);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t10, _t14, 0, 0);
				_t3 =  &_a4; // 0x73792238
				_t7 = GetProcAddress( *_t3, _t10);
				GlobalFree(_t10);
				return _t7;
			}

0x73791637
0x73791643
0x73791650
0x73791653
0x73791657
0x73791660
0x7379166c

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,73792238,?,00000808), ref: 73791635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,73792238,?,00000808), ref: 7379163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,73792238,?,00000808), ref: 73791650
GetProcAddress.KERNEL32(8"ys,00000000), ref: 73791657
GlobalFree.KERNEL32 ref: 73791660

Strings

8"ys, xrefs: 73791653

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID: 8"ys
API String ID: 1148316912-417562597
Opcode ID: 75926f0ddb4b8b81070efc944b3aae78ceeed8a9957c60994ed45ce99e62723c
Instruction ID: 8e77a486c594ac4b92e734e898d877d80aab7fa96e1023c83b07f029518bf367
Opcode Fuzzy Hash: 75926f0ddb4b8b81070efc944b3aae78ceeed8a9957c60994ed45ce99e62723c
Instruction Fuzzy Hash: 88F012731061397BD62067AB8C4DD9B7EACDF8B2F5B120351F61CA119095654C02D7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00402E60 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402E60(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402EDF();
					_t19 = L"unpacking data: %d%%";
					if( *0x42a254 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402e70
0x00402e7e
0x00402e84
0x00402e84
0x00402e92
0x00402e94
0x00402ea0
0x00402ea5
0x00402ea7
0x00402ea7
0x00402eb2
0x00402ec2
0x00402ed4
0x00402ed4
0x00402edc

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E7E
wsprintfW.USER32 ref: 00402EB2
SetWindowTextW.USER32(?,?), ref: 00402EC2
SetDlgItemTextW.USER32 ref: 00402ED4

Strings

verifying installer: %d%%, xrefs: 00402EA7, 00402EB0
unpacking data: %d%%, xrefs: 00402EA0

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 843da2e1ab39bb900caeff8d4fcb020499a158afa25eee152688bc568757e746
Instruction ID: 13740b25b881a7b28418816370c4751ccd6b2486f1be249ad99f14e28c2114ec
Opcode Fuzzy Hash: 843da2e1ab39bb900caeff8d4fcb020499a158afa25eee152688bc568757e746
Instruction Fuzzy Hash: 27F0367054020DABDF249F50DD49BEA3769EB40308F00843AFA46B51D0DBBD59558F99

Uniqueness

Uniqueness Score: -1.00%

Function 737925B5 Relevance: 9.1, APIs: 6, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E737925B5() {
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t27;
				signed int _t39;
				void* _t40;
				void* _t43;
				intOrPtr _t44;
				void* _t45;

				_t40 = E7379121B();
				_t24 =  *((intOrPtr*)(_t45 + 0x18));
				_t44 =  *((intOrPtr*)(_t24 + 0x1014));
				_t43 = (_t44 + 0x81 << 5) + _t24;
				do {
					if( *((intOrPtr*)(_t43 - 4)) >= 0) {
					}
					_t39 =  *(_t43 - 8) & 0x000000ff;
					if(_t39 <= 7) {
						switch( *((intOrPtr*)(_t39 * 4 +  &M737926E4))) {
							case 0:
								 *_t40 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									 *(__esp + 0x10) = __ecx;
									__ecx =  *(0x7379407c + __edx * 4);
									__edx =  *(__esp + 0x10);
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x7379409c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E73791470(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__ecx =  *0x7379506c;
								__edx = __ecx - 1;
								__eax = MultiByteToWideChar(__ebx, __ebx,  *__eax, __ecx, __edi, __edx);
								__eax =  *0x7379506c;
								 *((short*)(__edi + __eax * 2 - 2)) = __bx;
								goto L17;
							case 4:
								__eax = lstrcpynW(__edi,  *__eax,  *0x7379506c);
								goto L17;
							case 5:
								_push( *0x7379506c);
								_push(__edi);
								_push( *__eax);
								" {xv@uxv"();
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfW(__edi, 0x73795000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t26 =  *(_t43 + 0x14);
					if(_t26 != 0 && ( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x18)))) != 2 ||  *((intOrPtr*)(_t43 - 4)) > 0)) {
						GlobalFree(_t26);
					}
					_t27 =  *((intOrPtr*)(_t43 + 0xc));
					if(_t27 != 0) {
						if(_t27 != 0xffffffff) {
							if(_t27 > 0) {
								E737912E1(_t27 - 1, _t40);
								goto L26;
							}
						} else {
							E73791272(_t40);
							L26:
						}
					}
					_t44 = _t44 - 1;
					_t43 = _t43 - 0x20;
				} while (_t44 >= 0);
				return GlobalFree(_t40);
			}

0x737925bf
0x737925c1
0x737925c5
0x737925d4
0x737925d8
0x737925dd
0x737925dd
0x737925e5
0x737925ec
0x737925f2
0x00000000
0x737925f9
0x00000000
0x00000000
0x73792601
0x73792605
0x73792608
0x7379260c
0x73792613
0x73792617
0x7379261d
0x7379261f
0x73792621
0x73792621
0x73792628
0x00000000
0x00000000
0x73792631
0x00000000
0x00000000
0x73792638
0x7379263e
0x73792648
0x7379264e
0x73792653
0x00000000
0x00000000
0x73792674
0x00000000
0x00000000
0x7379265a
0x73792660
0x73792661
0x73792663
0x00000000
0x00000000
0x7379267c
0x7379267e
0x73792684
0x7379268a
0x7379268a
0x00000000
0x00000000
0x737925f2
0x7379268d
0x7379268d
0x73792692
0x737926a3
0x737926a3
0x737926a9
0x737926ae
0x737926b3
0x737926bf
0x737926c4
0x00000000
0x737926c9
0x737926b5
0x737926b6
0x737926ca
0x737926ca
0x737926b3
0x737926cb
0x737926cc
0x737926cf
0x737926e3

APIs

Part of subcall function 7379121B: GlobalAlloc.KERNELBASE(00000040,?,7379123B,?,737912DF,00000019,737911BE,-000000A0), ref: 73791225

GlobalFree.KERNEL32 ref: 737926A3
GlobalFree.KERNEL32 ref: 737926D8

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 0e72a5cf518fce40426790ec8fd10d1fde7c36afa560672cb73926556d3a9041
Instruction ID: 5849059c24923ac146cb8c28d2f7c65495e88d8433fa2a85630746fa0106a801
Opcode Fuzzy Hash: 0e72a5cf518fce40426790ec8fd10d1fde7c36afa560672cb73926556d3a9041
Instruction Fuzzy Hash: 0D31053220410EEFE716BF69ED98F2A77BAFB853003264368F10597A50C7356815DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040291A Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040291A(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0x38)) = 0xfffffd66;
				_t50 = E00402CAE(0xfffffff0);
				 *(_t56 - 0x40) = _t23;
				if(E00405DA6(_t50) == 0) {
					E00402CAE(0xffffffed);
				}
				E00405F2B(_t50);
				_t26 = E00405F50(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x42a258;
					 *(_t56 - 0x44) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E004034C5(_t45);
						E004034AF(_t49,  *(_t56 - 0x44));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x28));
						 *(_t56 - 0xc) = _t54;
						if(_t54 != _t45) {
							E0040323E(_t47,  *((intOrPtr*)(_t56 - 0x2c)), _t45, _t54,  *(_t56 - 0x28));
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x3c) =  *_t54;
								E00405F0B( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x3c);
							}
							GlobalFree( *(_t56 - 0xc));
						}
						E00406002( *(_t56 + 8), _t49,  *(_t56 - 0x44));
						GlobalFree(_t49);
						 *((intOrPtr*)(_t56 - 0x38)) = E0040323E(_t47, 0xffffffff,  *(_t56 + 8), _t45, _t45);
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0x38)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileW( *(_t56 - 0x40));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x0040291a
0x0040291c
0x00402928
0x0040292b
0x00402935
0x00402939
0x00402939
0x0040293f
0x0040294c
0x00402954
0x00402957
0x0040295d
0x0040296b
0x00402970
0x00402974
0x00402977
0x00402980
0x0040298c
0x00402990
0x00402993
0x0040299d
0x004029bc
0x004029a4
0x004029a9
0x004029b1
0x004029b4
0x004029b9
0x004029b9
0x004029c3
0x004029c3
0x004029d0
0x004029d6
0x004029e8
0x004029e8
0x004029ee
0x004029ee
0x004029f9
0x004029fa
0x004029fe
0x00402a02
0x00402a08
0x00402a08
0x00402a0f
0x004022b8
0x00402b35
0x00402b41

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040296E
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040298A
GlobalFree.KERNEL32 ref: 004029C3
GlobalFree.KERNEL32 ref: 004029D6
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 004029EE
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A02

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 5d2775d7237395a92c21ec3b9765a4c863ba3c1c0c11509ba5b781c2f0d32a2c
Instruction ID: bb498fdb6e8d1bcc6e38580ca1e4abc9c75004d791eb641cb782f8609a3c88db
Opcode Fuzzy Hash: 5d2775d7237395a92c21ec3b9765a4c863ba3c1c0c11509ba5b781c2f0d32a2c
Instruction Fuzzy Hash: D921BFB1800114BBDF216FA5CE49DAE7E79EF05324F10023AF560762E0CB794D418B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404C74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404C74(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E0040647C(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E0040647C(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E0040647C(_t44, _t50, 0x423728, 0x423728, _a8);
				wsprintfW(_t34 + lstrlenW(0x423728) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x429218, _a4, 0x423728);
			}

0x00404c7d
0x00404c82
0x00404c8a
0x00404c8b
0x00404c98
0x00404ca0
0x00404ca1
0x00404ca3
0x00404ca5
0x00404ca7
0x00404caa
0x00404caa
0x00404cb1
0x00404cb7
0x00404cb7
0x00404cbe
0x00404cc5
0x00404cc8
0x00404ccb
0x00404ccb
0x00404ccf
0x00404cdf
0x00404ce1
0x00404ce4
0x00404c8d
0x00404c8d
0x00404c94
0x00404c94
0x00404cec
0x00404cf7
0x00404d0d
0x00404d1e
0x00404d3a

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404D15
wsprintfW.USER32 ref: 00404D1E
SetDlgItemTextW.USER32 ref: 00404D31

Strings

(7B, xrefs: 00404D07
%u.%u%s%s, xrefs: 00404CFF

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: d2d92cc70018d04a3e155d666f77893a3f92d4a5c7d97b4e3db99e4214ef2a85
Instruction ID: 8d19f012da4c23d02ed4c3568591774b1a036c156f841992b9f05284911b46ab
Opcode Fuzzy Hash: d2d92cc70018d04a3e155d666f77893a3f92d4a5c7d97b4e3db99e4214ef2a85
Instruction Fuzzy Hash: E611EB736041287BEB00A5AD9C85E9F369CDB85374F164237FA65F31D1D979CC2182E8

Uniqueness

Uniqueness Score: -1.00%

Function 00402605 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402605(int __ebx, void* __edx, intOrPtr* __esi) {
				signed int _t14;
				int _t17;
				int _t24;
				signed int _t29;
				intOrPtr* _t32;
				void* _t34;
				void* _t35;
				void* _t38;
				signed int _t40;

				_t32 = __esi;
				_t24 = __ebx;
				_t14 =  *(_t35 - 0x28);
				_t38 = __edx - 0x38;
				 *(_t35 - 0xc) = _t14;
				_t27 = 0 | _t38 == 0x00000000;
				_t29 = _t38 == 0;
				if(_t14 == __ebx) {
					if(__edx != 0x38) {
						_t17 = lstrlenW(E00402CAE(0x11)) + _t16;
					} else {
						E00402CAE(0x21);
						WideCharToMultiByte(__ebx, __ebx, "C:\Users\hardz\AppData\Local\Temp\nszA331.tmp", 0xffffffff, "C:\Users\hardz\AppData\Local\Temp\nszA331.tmp\System.dll", 0x400, __ebx, __ebx);
						_t17 = lstrlenA("C:\Users\hardz\AppData\Local\Temp\nszA331.tmp\System.dll");
					}
				} else {
					E00402C8C(1);
					 *0x40add8 = __ax;
					 *((intOrPtr*)(__ebp - 0x44)) = __edx;
				}
				 *(_t35 + 8) = _t17;
				if( *_t32 == _t24) {
					L13:
					 *((intOrPtr*)(_t35 - 4)) = 1;
				} else {
					_t34 = E004063BA(_t27, _t32);
					if((_t29 |  *(_t35 - 0xc)) != 0 ||  *((intOrPtr*)(_t35 - 0x24)) == _t24 || E00406031(_t34, _t34) >= 0) {
						_t14 = E00406002(_t34, "C:\Users\hardz\AppData\Local\Temp\nszA331.tmp\System.dll",  *(_t35 + 8));
						_t40 = _t14;
						if(_t40 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00402605
0x00402605
0x00402605
0x0040260a
0x0040260d
0x00402610
0x00402615
0x00402617
0x00402637
0x00402675
0x00402639
0x0040263b
0x00402655
0x00402660
0x00402660
0x00402619
0x0040261b
0x00402620
0x0040262e
0x00402631
0x0040267a
0x0040267d
0x004028f8
0x004028f8
0x00402683
0x0040268c
0x0040268e
0x004026ad
0x004015b4
0x004015b6
0x00000000
0x004015bc
0x00000000
0x00000000
0x00000000
0x0040268e
0x00402b35
0x00402b41

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nszA331.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll,00000400,?,?,00000021), ref: 00402655
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nszA331.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll,00000400,?,?,00000021), ref: 00402660

Strings

C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll, xrefs: 00402620, 00402647, 0040265B, 004026A7
C:\Users\user\AppData\Local\Temp\nszA331.tmp, xrefs: 0040264E

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszA331.tmp$C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll
API String ID: 3109718747-3471683321
Opcode ID: 5da445a73574f1f955a696b72bbfb25a725dd32a521a8fcdcc125b1f6e153919
Instruction ID: 82442bfd1103f6118e2136646844fd252bae6c618f8c19246e343ba35bcb843f
Opcode Fuzzy Hash: 5da445a73574f1f955a696b72bbfb25a725dd32a521a8fcdcc125b1f6e153919
Instruction Fuzzy Hash: F0112B72641304BADB00AFB18F49A9E7765DF1035DF21443BF002B22C1CAFD8981976E

Uniqueness

Uniqueness Score: -1.00%

Function 737918D9 Relevance: 7.7, APIs: 5, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E737918D9(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				void* _v8;
				signed int _v12;
				signed int _v20;
				signed int _v24;
				char _v76;
				void _t45;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				signed int _t60;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				signed int _t76;
				void* _t80;
				signed int _t82;
				signed int _t84;
				signed int _t86;
				signed int _t89;
				void* _t100;

				_t84 = __edx;
				 *0x7379506c = _a8;
				_t76 = 0;
				 *0x73795070 = _a16;
				_v12 = 0;
				_v8 = E73791243();
				_t89 = E73791311(_t42);
				_t86 = _t84;
				_t80 = E73791243();
				_a8 = _t80;
				_t45 =  *_t80;
				if(_t45 != 0x7e && _t45 != 0x21) {
					_a16 = E73791243();
					_t76 = E73791311(_t73);
					_v12 = _t84;
					GlobalFree(_a16);
					_t80 = _a8;
				}
				_t46 =  *_t80 & 0x0000ffff;
				_t100 = _t46 - 0x2f;
				if(_t100 > 0) {
					_t47 = _t46 - 0x3c;
					__eflags = _t47;
					if(_t47 == 0) {
						__eflags =  *((short*)(_t80 + 2)) - 0x3c;
						if( *((short*)(_t80 + 2)) != 0x3c) {
							__eflags = _t86 - _v12;
							if(__eflags > 0) {
								L56:
								_t48 = 0;
								__eflags = 0;
								L57:
								asm("cdq");
								L58:
								_t89 = _t48;
								_t86 = _t84;
								L59:
								E73791470(_t84, _t89, _t86,  &_v76);
								E73791272( &_v76);
								GlobalFree(_v8);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L49:
								__eflags = 0;
								L50:
								_t48 = 1;
								goto L57;
							}
							__eflags = _t89 - _t76;
							if(_t89 < _t76) {
								goto L49;
							}
							goto L56;
						}
						_t84 = _t86;
						_t48 = E73792FB0(_t89, _t76, _t84);
						goto L58;
					}
					_t57 = _t47 - 1;
					__eflags = _t57;
					if(_t57 == 0) {
						__eflags = _t89 - _t76;
						if(_t89 != _t76) {
							goto L56;
						}
						__eflags = _t86 - _v12;
						if(_t86 != _v12) {
							goto L56;
						}
						goto L49;
					}
					_t58 = _t57 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags =  *((short*)(_t80 + 2)) - 0x3e;
						if( *((short*)(_t80 + 2)) != 0x3e) {
							__eflags = _t86 - _v12;
							if(__eflags < 0) {
								goto L56;
							}
							if(__eflags > 0) {
								goto L49;
							}
							__eflags = _t89 - _t76;
							if(_t89 <= _t76) {
								goto L56;
							}
							goto L49;
						}
						__eflags =  *((short*)(_t80 + 4)) - 0x3e;
						_t84 = _t86;
						_t48 = _t89;
						_t82 = _t76;
						if( *((short*)(_t80 + 4)) != 0x3e) {
							_t48 = E73792FD0(_t48, _t82, _t84);
						} else {
							L73793000();
						}
						goto L58;
					}
					_t59 = _t58 - 0x20;
					__eflags = _t59;
					if(_t59 == 0) {
						_t89 = _t89 ^ _t76;
						_t86 = _t86 ^ _v12;
						goto L59;
					}
					_t60 = _t59 - 0x1e;
					__eflags = _t60;
					if(_t60 == 0) {
						__eflags =  *((short*)(_t80 + 2)) - 0x7c;
						if( *((short*)(_t80 + 2)) != 0x7c) {
							_t89 = _t89 | _t76;
							_t86 = _t86 | _v12;
							goto L59;
						}
						__eflags = _t89 | _t86;
						if((_t89 | _t86) != 0) {
							goto L49;
						}
						__eflags = _t76 | _v12;
						if((_t76 | _v12) != 0) {
							goto L49;
						}
						goto L56;
					}
					__eflags = _t60 == 0;
					if(_t60 == 0) {
						_t89 =  !_t89;
						_t86 =  !_t86;
					}
					goto L59;
				}
				if(_t100 == 0) {
					L21:
					__eflags = _t76 | _v12;
					if((_t76 | _v12) != 0) {
						_v24 = E73792E40(_t89, _t86, _t76, _v12);
						_v20 = _t84;
						_t48 = E73792EF0(_t89, _t86, _t76, _v12);
						_t80 = _a8;
					} else {
						_v24 = _v24 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_t48 = _t89;
						_t84 = _t86;
					}
					__eflags =  *_t80 - 0x2f;
					if( *_t80 != 0x2f) {
						goto L58;
					} else {
						_t89 = _v24;
						_t86 = _v20;
						goto L59;
					}
				}
				_t66 = _t46 - 0x21;
				if(_t66 == 0) {
					_t48 = 0;
					__eflags = _t89 | _t86;
					if((_t89 | _t86) != 0) {
						goto L57;
					}
					goto L50;
				}
				_t67 = _t66 - 4;
				if(_t67 == 0) {
					goto L21;
				}
				_t68 = _t67 - 1;
				if(_t68 == 0) {
					__eflags =  *((short*)(_t80 + 2)) - 0x26;
					if( *((short*)(_t80 + 2)) != 0x26) {
						_t89 = _t89 & _t76;
						_t86 = _t86 & _v12;
						goto L59;
					}
					__eflags = _t89 | _t86;
					if((_t89 | _t86) == 0) {
						goto L56;
					}
					__eflags = _t76 | _v12;
					if((_t76 | _v12) == 0) {
						goto L56;
					}
					goto L49;
				}
				_t69 = _t68 - 4;
				if(_t69 == 0) {
					_t48 = E73792E00(_t89, _t86, _t76, _v12);
					goto L58;
				} else {
					_t70 = _t69 - 1;
					if(_t70 == 0) {
						_t89 = _t89 + _t76;
						asm("adc edi, [ebp-0x8]");
					} else {
						if(_t70 == 0) {
							_t89 = _t89 - _t76;
							asm("sbb edi, [ebp-0x8]");
						}
					}
					goto L59;
				}
			}

0x737918d9
0x737918e3
0x737918ec
0x737918ef
0x737918f4
0x737918fd
0x73791906
0x73791908
0x7379190f
0x73791911
0x73791914
0x7379191b
0x73791929
0x73791932
0x73791937
0x7379193a
0x73791940
0x73791940
0x73791943
0x73791946
0x73791949
0x73791a11
0x73791a11
0x73791a14
0x73791a94
0x73791a99
0x73791aa8
0x73791aab
0x73791ab3
0x73791ab3
0x73791ab3
0x73791ab5
0x73791ab5
0x73791ab6
0x73791ab6
0x73791ab8
0x73791aba
0x73791ac0
0x73791ac9
0x73791ada
0x73791ae5
0x73791ae5
0x73791aad
0x73791a8f
0x73791a8f
0x73791a91
0x73791a91
0x00000000
0x73791a91
0x73791aaf
0x73791ab1
0x00000000
0x00000000
0x00000000
0x73791ab1
0x73791a9d
0x73791aa1
0x00000000
0x73791aa1
0x73791a16
0x73791a16
0x73791a17
0x73791a86
0x73791a88
0x00000000
0x00000000
0x73791a8a
0x73791a8d
0x00000000
0x00000000
0x00000000
0x73791a8d
0x73791a19
0x73791a19
0x73791a1a
0x73791a57
0x73791a5c
0x73791a79
0x73791a7c
0x00000000
0x00000000
0x73791a7e
0x00000000
0x00000000
0x73791a80
0x73791a82
0x00000000
0x00000000
0x00000000
0x73791a84
0x73791a5e
0x73791a63
0x73791a65
0x73791a67
0x73791a69
0x73791a72
0x73791a6b
0x73791a6b
0x73791a6b
0x00000000
0x73791a69
0x73791a1c
0x73791a1c
0x73791a1f
0x73791a50
0x73791a52
0x00000000
0x73791a52
0x73791a21
0x73791a21
0x73791a24
0x73791a37
0x73791a3c
0x73791a49
0x73791a4b
0x00000000
0x73791a4b
0x73791a3e
0x73791a40
0x00000000
0x00000000
0x73791a42
0x73791a45
0x00000000
0x00000000
0x00000000
0x73791a47
0x73791a27
0x73791a28
0x73791a2e
0x73791a30
0x73791a30
0x00000000
0x73791a28
0x7379194f
0x737919c8
0x737919ca
0x737919cd
0x737919eb
0x737919ee
0x737919f4
0x737919f9
0x737919cf
0x737919cf
0x737919d3
0x737919d7
0x737919d9
0x737919d9
0x737919fc
0x73791a00
0x00000000
0x73791a06
0x73791a06
0x73791a09
0x00000000
0x73791a09
0x73791a00
0x73791951
0x73791954
0x737919b9
0x737919bb
0x737919bd
0x00000000
0x00000000
0x00000000
0x737919c3
0x73791956
0x73791959
0x00000000
0x00000000
0x7379195b
0x7379195c
0x73791992
0x73791997
0x737919af
0x737919b1
0x00000000
0x737919b1
0x73791999
0x7379199b
0x00000000
0x00000000
0x737919a1
0x737919a4
0x00000000
0x00000000
0x00000000
0x737919aa
0x7379195e
0x73791961
0x73791988
0x00000000
0x73791963
0x73791963
0x73791964
0x73791978
0x7379197a
0x73791966
0x73791968
0x7379196e
0x73791970
0x73791970
0x73791968
0x00000000
0x73791964

APIs

GlobalFree.KERNEL32 ref: 7379193A
GlobalFree.KERNEL32 ref: 73791ADA
GlobalFree.KERNEL32 ref: 73791ADF

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 27615a84c311ea05e8f90ccb13f77d409eecd014496dce67be5259867319c1e0
Instruction ID: c4ad0476de4c65ff019d10ac51b337b51252cfbcfac058a77ff76195af445b48
Opcode Fuzzy Hash: 27615a84c311ea05e8f90ccb13f77d409eecd014496dce67be5259867319c1e0
Instruction Fuzzy Hash: EC510732E401599FFB02DFA4B9C47ADBBBAEB44310F15435AD407A3284D6709EA1879D

Uniqueness

Uniqueness Score: -1.00%

Function 737923E0 Relevance: 7.6, APIs: 5, Instructions: 135
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E737923E0(void* __edx) {
				void* _t37;
				signed int _t38;
				void* _t39;
				void* _t41;
				signed char* _t42;
				signed char* _t51;
				void* _t52;
				void* _t54;

				 *(_t54 + 0x10) = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + 0x1014)) > 0x00000000;
				while(1) {
					_t9 =  *((intOrPtr*)(_t54 + 0x18)) + 0x1018; // 0x1018
					_t51 = ( *(_t54 + 0x10) << 5) + _t9;
					_t52 = _t51[0x18];
					if(_t52 == 0) {
						goto L9;
					}
					_t41 = 0x1a;
					if(_t52 == _t41) {
						goto L9;
					}
					if(_t52 != 0xffffffff) {
						if(_t52 <= 0 || _t52 > 0x19) {
							_t51[0x18] = _t41;
							goto L12;
						} else {
							_t37 = E737912BA(_t52 - 1);
							L10:
							goto L11;
						}
					} else {
						_t37 = E73791243();
						L11:
						_t52 = _t37;
						L12:
						_t13 =  &(_t51[8]); // 0x1020
						_t42 = _t13;
						if(_t51[4] >= 0) {
						}
						_t38 =  *_t51 & 0x000000ff;
						_t51[0x1c] = 0;
						if(_t38 > 7) {
							L27:
							_t39 = GlobalFree(_t52);
							if( *(_t54 + 0x10) == 0) {
								return _t39;
							}
							if( *(_t54 + 0x10) !=  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x18)) + 0x1014))) {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) + 1;
							} else {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t38 * 4 +  &M73792558))) {
								case 0:
									 *_t42 = 0;
									goto L27;
								case 1:
									__eax = E73791311(__ebp);
									goto L21;
								case 2:
									 *__edi = E73791311(__ebp);
									__edi[1] = __edx;
									goto L27;
								case 3:
									__eax = GlobalAlloc(0x40,  *0x7379506c);
									 *(__esi + 0x1c) = __eax;
									__edx = 0;
									 *__edi = __eax;
									__eax = WideCharToMultiByte(0, 0, __ebp,  *0x7379506c, __eax,  *0x7379506c, 0, 0);
									goto L27;
								case 4:
									__eax = E7379122C(__ebp);
									 *(__esi + 0x1c) = __eax;
									L21:
									 *__edi = __eax;
									goto L27;
								case 5:
									__eax = GlobalAlloc(0x40, 0x10);
									_push(__eax);
									 *(__esi + 0x1c) = __eax;
									_push(__ebp);
									 *__edi = __eax;
									__imp__CLSIDFromString();
									goto L27;
								case 6:
									if( *__ebp != __cx) {
										__eax = E73791311(__ebp);
										 *__ebx = __eax;
									}
									goto L27;
								case 7:
									 *(__esi + 0x18) =  *(__esi + 0x18) - 1;
									( *(__esi + 0x18) - 1) *  *0x7379506c =  *0x73795074 + ( *(__esi + 0x18) - 1) *  *0x7379506c * 2 + 0x18;
									 *__ebx =  *0x73795074 + ( *(__esi + 0x18) - 1) *  *0x7379506c * 2 + 0x18;
									asm("cdq");
									__eax = E73791470(__edx,  *0x73795074 + ( *(__esi + 0x18) - 1) *  *0x7379506c * 2 + 0x18, __edx,  *0x73795074 + ( *(__esi + 0x18) - 1) *  *0x7379506c * 2);
									goto L27;
							}
						}
					}
					L9:
					_t37 = E7379122C(0x73795044);
					goto L10;
				}
			}

0x737923f4
0x737923f8
0x73792403
0x73792403
0x7379240a
0x7379240f
0x00000000
0x00000000
0x73792413
0x73792416
0x00000000
0x00000000
0x7379241b
0x73792426
0x73792436
0x00000000
0x7379242d
0x7379242f
0x73792445
0x00000000
0x73792445
0x7379241d
0x7379241d
0x73792446
0x73792446
0x73792448
0x7379244c
0x7379244c
0x7379244f
0x7379244f
0x73792457
0x7379245f
0x73792462
0x73792521
0x73792522
0x7379252d
0x73792557
0x73792557
0x7379253d
0x73792549
0x7379253f
0x7379253f
0x7379253f
0x00000000
0x73792468
0x73792468
0x00000000
0x7379246f
0x00000000
0x00000000
0x73792477
0x00000000
0x00000000
0x73792485
0x73792487
0x00000000
0x00000000
0x737924a8
0x737924ae
0x737924b1
0x737924b3
0x737924c3
0x00000000
0x00000000
0x73792490
0x73792495
0x73792498
0x73792499
0x00000000
0x00000000
0x737924cf
0x737924d5
0x737924d6
0x737924d9
0x737924da
0x737924dc
0x00000000
0x00000000
0x737924e8
0x737924eb
0x737924f7
0x737924f9
0x00000000
0x00000000
0x73792505
0x73792511
0x73792514
0x73792516
0x73792519
0x00000000
0x00000000
0x73792468
0x73792462
0x7379243b
0x73792440
0x00000000
0x73792440

APIs

GlobalFree.KERNEL32 ref: 73792522

Part of subcall function 7379122C: lstrcpynW.KERNEL32(00000000,?,737912DF,00000019,737911BE,-000000A0), ref: 7379123C

GlobalAlloc.KERNEL32(00000040), ref: 737924A8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 737924C3

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 6af0e6a8e8143dca454c85aaa0b8da8b9542e765e6dfee9a8d3480446f5187c7
Instruction ID: 87d1c13706356db95291f5dc4ddb66237da6c8672aad50a1f740ca474917e438
Opcode Fuzzy Hash: 6af0e6a8e8143dca454c85aaa0b8da8b9542e765e6dfee9a8d3480446f5187c7
Instruction Fuzzy Hash: 7641CAB110830EDFF715FF65A844B6677B8FB48310B124B5DE44ACB191DB34A845CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401D5D Relevance: 7.6, APIs: 5, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00401D5D(intOrPtr __edx) {
				struct HWND__* _t25;
				WCHAR* _t31;
				void* _t41;
				void* _t45;
				signed int _t47;
				intOrPtr _t49;
				int _t51;
				signed int _t54;
				void* _t58;

				_t49 = __edx;
				if(( *(_t58 - 0x27) & 0x00000001) == 0) {
					_t25 = GetDlgItem( *(_t58 - 8),  *(_t58 - 0x2c));
				} else {
					_t25 = E00402C8C(1);
					 *((intOrPtr*)(_t58 - 0xc)) = _t49;
				}
				_t47 =  *(_t58 - 0x28);
				 *(_t58 + 8) = _t25;
				 *(_t58 - 0x40) = _t47 >> 0x1f;
				_t51 = _t47 & 0x00000003;
				_t54 = _t47 & 0x00000004;
				 *(_t58 - 0x38) = _t47 >> 0x0000001e & 0x00000001;
				if((_t47 & 0x00010000) == 0) {
					_t31 =  *(_t58 - 0x30) & 0x0000ffff;
				} else {
					_t31 = E00402CAE(_t45);
				}
				 *(_t58 - 0x44) = _t31;
				GetClientRect( *(_t58 + 8), _t58 - 0x60);
				asm("sbb esi, esi");
				_t41 = SendMessageW( *(_t58 + 8), 0x172, _t51, LoadImageW( ~_t54 &  *0x42a240,  *(_t58 - 0x44), _t51,  *(_t58 - 0x58) *  *(_t58 - 0x40),  *(_t58 - 0x54) *  *(_t58 - 0x38),  *(_t58 - 0x28) & 0x0000fef0));
				if(_t41 != _t45 && _t51 == _t45) {
					DeleteObject(_t41);
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x00401d5d
0x00401d61
0x00401d76
0x00401d63
0x00401d65
0x00401d6b
0x00401d6b
0x00401d7c
0x00401d7f
0x00401d89
0x00401d90
0x00401d96
0x00401da2
0x00401da5
0x00401daf
0x00401da7
0x00401da8
0x00401da8
0x00401db3
0x00401dbd
0x00401de2
0x00401dfb
0x00401e03
0x00401e12
0x00401e12
0x00402b35
0x00402b41

APIs

GetDlgItem.USER32 ref: 00401D76
GetClientRect.USER32 ref: 00401DBD
LoadImageW.USER32 ref: 00401DEB
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401DFB
DeleteObject.GDI32(00000000), ref: 00401E12

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1ebecd6b7b11c499b97bc7962164f94d257403e711a5273e801ee6dcb1ba2236
Instruction ID: 319bc69a392d56ca196752b11b626d5c8e2c13f683487c41bb51ebd40d43f874
Opcode Fuzzy Hash: 1ebecd6b7b11c499b97bc7962164f94d257403e711a5273e801ee6dcb1ba2236
Instruction Fuzzy Hash: A5215E72904118AFCB14DF98DE44ADE7BB5FB58310F14403AF945F62A0CA78AD81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C1F(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402C8C(3);
				 *((intOrPtr*)(_t64 - 0xc)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402C8C(4);
				 *((intOrPtr*)(_t64 - 0xc)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402CAE(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402CAE(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402CAE();
					_t32 = E00402CAE();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402C8C();
					 *((intOrPtr*)(_t64 - 0xc)) = _t57;
					_t41 = E00402C8C(2);
					 *((intOrPtr*)(_t64 - 0xc)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t61, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t61, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E004063A1();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c1f
0x00401c21
0x00401c28
0x00401c2b
0x00401c2e
0x00401c38
0x00401c3c
0x00401c3f
0x00401c48
0x00401c48
0x00401c4b
0x00401c4f
0x00401c58
0x00401c58
0x00401c5b
0x00401c5f
0x00401c61
0x00401cb6
0x00401cb8
0x00401cc3
0x00401ccd
0x00401cd0
0x00401cd0
0x00401cd9
0x00000000
0x00401c63
0x00401c6a
0x00401c6c
0x00401c6f
0x00401c75
0x00401c7c
0x00401c7f
0x00401ca7
0x00401cdf
0x00401cdf
0x00401c81
0x00401c8f
0x00401c97
0x00401c9a
0x00401c9a
0x00401c7f
0x00401ce2
0x00401ce5
0x00401ceb
0x00402ad8
0x00402ad8
0x00402b35
0x00402b41

APIs

SendMessageTimeoutW.USER32 ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: aa9a4d95e2442e59943ec52f516733bb42c37c5d9e04e0d2f8d1262469273864
Instruction ID: b91665197ed86a8540d75c30144da1e0c5bc85e0a2d8510104f1e6a9600272bb
Opcode Fuzzy Hash: aa9a4d95e2442e59943ec52f516733bb42c37c5d9e04e0d2f8d1262469273864
Instruction Fuzzy Hash: 08216F71948209AFEF05AFB5DA46AAE7BB5EB44304F10803EF501B61D1D6788981DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405D2F(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405d30
0x00405d3d
0x00405d3e
0x00405d49
0x00405d51
0x00405d51
0x00405d59

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00405D35
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74D0FAA0,00403757,?,00000006,00000008,0000000A), ref: 00405D3F
lstrcatW.KERNEL32(?,0040A014), ref: 00405D51

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D2F

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3916508600
Opcode ID: 379c811fc38e70bd3bf90ac20cf7210f4f650877ceb0036fcb769218933868e7
Instruction ID: 3f9ccb5ceccb61962b878f8907ed118f79d41d62f3287210b61a1bd46d7e0c29
Opcode Fuzzy Hash: 379c811fc38e70bd3bf90ac20cf7210f4f650877ceb0036fcb769218933868e7
Instruction Fuzzy Hash: 76D05E61101920AAC1116B448E04CDB62AC9E46344342402BF241B20A1C77C5D5186FD

Uniqueness

Uniqueness Score: -1.00%

Function 00402DB1 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402DB1(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				short _v532;
				void* _t19;
				signed int _t25;
				intOrPtr* _t27;
				signed int _t32;
				signed int _t33;
				signed int _t34;

				_t33 = _a12;
				_t34 = _t33 & 0x00000300;
				_t32 = _t33 & 0x00000001;
				_t19 = E004062C7(__eflags, _a4, _a8, _t34 | 0x00000008,  &_v8);
				if(_t19 == 0) {
					while(RegEnumKeyW(_v8, 0,  &_v532, 0x105) == 0) {
						__eflags = _t32;
						if(__eflags != 0) {
							RegCloseKey(_v8);
							return 0x3eb;
						}
						_t25 = E00402DB1(__eflags, _v8,  &_v532, _a12);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406834(3);
					if(_t27 == 0) {
						return RegDeleteKeyW(_a4, _a8);
					}
					return  *_t27(_a4, _a8, _t34, 0);
				}
				return _t19;
			}

0x00402dbc
0x00402dc5
0x00402dce
0x00402dda
0x00402de1
0x00402e05
0x00402deb
0x00402ded
0x00402e40
0x00000000
0x00402e46
0x00402dfc
0x00402e01
0x00402e03
0x00000000
0x00000000
0x00402e03
0x00402e1f
0x00402e27
0x00402e2e
0x00000000
0x00402e53
0x00000000
0x00402e39
0x00402e5d

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402E16
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E1F
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E40

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: c2769473e9eb0fce4e6d4a1730257adbaffd015730e4956b1c253950ebd0dba4
Instruction ID: 43b9865839ecfe477f961128639fbd406686ed4329b6720844914574d4f4c1c3
Opcode Fuzzy Hash: c2769473e9eb0fce4e6d4a1730257adbaffd015730e4956b1c253950ebd0dba4
Instruction Fuzzy Hash: 4B119A32580109FBDF02AB90CE09FEE7B69AF04350F100036BA04B11E0D7B5DE21AB98

Uniqueness

Uniqueness Score: -1.00%

Function 00403AAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403AAB() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x4216ec;
				_t3 = E00403A90(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x4216ec =  *0x4216ec & 0x00000000;
				return _t3;
			}

0x00403aac
0x00403ab4
0x00403abb
0x00403abe
0x00403abe
0x00403ac0
0x00403ac5
0x00403acc
0x00403ad2
0x00403ad6
0x00403ad7
0x00403adf

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74D0F560,00403A82,74D0FAA0,00403881,00000006,?,00000006,00000008,0000000A), ref: 00403AC5
GlobalFree.KERNEL32 ref: 00403ACC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403ABD

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3916508600
Opcode ID: 7867e8fad3feb3a5182918b3214914300007393fc34869fd11e5bcdaf906e820
Instruction ID: 827a5aa7686bd34af50f9ba25e080651c747212f2107990a7f43cc454bfadc00
Opcode Fuzzy Hash: 7867e8fad3feb3a5182918b3214914300007393fc34869fd11e5bcdaf906e820
Instruction Fuzzy Hash: 1DE012336011205BC6629F95FE44F6E776DAF58B22F0A027BE9C17B26087745C528FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405D7B(WCHAR* _a4) {
				WCHAR* _t5;
				WCHAR* _t7;

				_t7 = _a4;
				_t5 =  &(_t7[lstrlenW(_t7)]);
				while( *_t5 != 0x5c) {
					_push(_t5);
					_push(_t7);
					_t5 = CharPrevW();
					if(_t5 > _t7) {
						continue;
					}
					break;
				}
				 *_t5 =  *_t5 & 0x00000000;
				return  &(_t5[1]);
			}

0x00405d7c
0x00405d86
0x00405d89
0x00405d8f
0x00405d90
0x00405d91
0x00405d99
0x00000000
0x00000000
0x00000000
0x00405d99
0x00405d9b
0x00405da3

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00403009,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\XShSI2OXaC.exe,C:\Users\user\Desktop\XShSI2OXaC.exe,80000000,00000003), ref: 00405D81
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00403009,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\XShSI2OXaC.exe,C:\Users\user\Desktop\XShSI2OXaC.exe,80000000,00000003), ref: 00405D91

Strings

C:\Users\user\Desktop, xrefs: 00405D7B

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1669384263
Opcode ID: c9a842665e1486112945812634b4df4faac3e7ac78b5c200c8c7ef2726e25284
Instruction ID: cdd1f407a26f241909e864c078a8edffbfd7eef3610524d69b7b83e7df1227e9
Opcode Fuzzy Hash: c9a842665e1486112945812634b4df4faac3e7ac78b5c200c8c7ef2726e25284
Instruction Fuzzy Hash: 90D05EB24119209AD3126704DD04DAF63ACEF11304746846BE880A6161D7785C8186AC

Uniqueness

Uniqueness Score: -1.00%

Function 737910E1 Relevance: 5.1, APIs: 4, Instructions: 104
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E737910E1(signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v0;
				void* _t17;
				signed int _t19;
				void* _t20;
				void* _t24;
				void* _t26;
				void* _t30;
				void* _t36;
				void* _t38;
				void* _t39;
				signed int _t41;
				void* _t42;
				void* _t51;
				void* _t52;
				signed short* _t54;
				void* _t56;
				void* _t59;
				void* _t61;

				 *0x7379506c = _a8;
				 *0x73795070 = _a16;
				 *0x73795074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x73795048, E737915B1, _t51, _t56);
				_t41 =  *0x7379506c +  *0x7379506c * 4 << 3;
				_t17 = E73791243();
				_v0 = _t17;
				_t52 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_t17);
				} else {
					do {
						_t19 =  *_t52 & 0x0000ffff;
						_t42 = 2;
						_t54 = _t52 + _t42;
						_t61 = _t19 - 0x6c;
						if(_t61 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t52 = _t54 + _t42;
								_t24 = E73791272(E737912BA(( *_t54 & 0x0000ffff) - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t26 = _t20 - _t42;
							if(_t26 == 0) {
								L10:
								_t52 =  &(_t54[1]);
								_t24 = E737912E1(( *_t54 & 0x0000ffff) - 0x30, E73791243());
								goto L13;
							}
							L7:
							if(_t26 == 1) {
								_t30 = GlobalAlloc(0x40, _t41 + 4);
								 *_t30 =  *0x73795040;
								 *0x73795040 = _t30;
								E73791563(_t30 + 4,  *0x73795074, _t41);
								_t59 = _t59 + 0xc;
							}
							goto L14;
						}
						if(_t61 == 0) {
							L17:
							_t33 =  *0x73795040;
							if( *0x73795040 != 0) {
								E73791563( *0x73795074, _t33 + 4, _t41);
								_t59 = _t59 + 0xc;
								_t36 =  *0x73795040;
								GlobalFree(_t36);
								 *0x73795040 =  *_t36;
							}
							goto L14;
						}
						_t38 = _t19 - 0x4c;
						if(_t38 == 0) {
							goto L17;
						}
						_t39 = _t38 - 4;
						if(_t39 == 0) {
							 *_t54 =  *_t54 + 0xa;
							goto L12;
						}
						_t26 = _t39 - _t42;
						if(_t26 == 0) {
							 *_t54 =  *_t54 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t52 != 0);
					_t17 = _v0;
					goto L16;
				}
			}

0x737910e6
0x737910f0
0x737910ff
0x7379110e
0x73791119
0x7379111c
0x7379112b
0x7379112f
0x73791131
0x737911d8
0x737911de
0x73791137
0x73791138
0x73791138
0x7379113d
0x7379113e
0x73791140
0x73791143
0x7379120d
0x73791210
0x737911b0
0x737911b6
0x737911bf
0x737911c4
0x737911c7
0x00000000
0x737911c7
0x73791212
0x73791214
0x73791196
0x7379119d
0x737911a5
0x00000000
0x737911a5
0x73791161
0x73791162
0x7379116a
0x73791177
0x7379117f
0x73791188
0x7379118d
0x7379118d
0x00000000
0x73791162
0x73791149
0x737911df
0x737911df
0x737911e6
0x737911f3
0x737911f8
0x737911fb
0x73791203
0x73791205
0x73791205
0x00000000
0x737911e6
0x7379114f
0x73791152
0x00000000
0x00000000
0x73791158
0x7379115b
0x737911ac
0x00000000
0x737911ac
0x7379115d
0x7379115f
0x73791192
0x00000000
0x73791192
0x00000000
0x737911c9
0x737911c9
0x737911d3
0x00000000
0x737911d7

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7379116A
GlobalFree.KERNEL32 ref: 737911C7
GlobalFree.KERNEL32 ref: 737911D9
GlobalFree.KERNEL32 ref: 73791203

Memory Dump Source

Source File: 00000000.00000002.777575013.0000000073791000.00000020.00000001.01000000.00000004.sdmp, Offset: 73790000, based on PE: true

Associated: 00000000.00000002.777565361.0000000073790000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777586035.0000000073794000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.777596027.0000000073796000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73790000_XShSI2OXaC.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 17491060942222e895f7bedd730d79cdff60da369f25c83aac14a4e83839274d
Instruction ID: dfdde6898bd0c09b68865a80e126e98c72ba775149ab2f8ae1ab431ac3852e39
Opcode Fuzzy Hash: 17491060942222e895f7bedd730d79cdff60da369f25c83aac14a4e83839274d
Instruction Fuzzy Hash: D531C8B254021AAFF300EF79E945B3977F8EB052207550319E84AEB254E738D822C768

Uniqueness

Uniqueness Score: -1.00%

Function 00405EB5 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EB5(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405ec5
0x00405ec7
0x00405eca
0x00405ef6
0x00405ecf
0x00405ed8
0x00405edd
0x00405ee8
0x00405eeb
0x00405f07
0x00405eed
0x00405ef4
0x00000000
0x00405ef4
0x00405f00
0x00405f04
0x00405f04
0x00405efe
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040619A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC5
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,0040619A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EDD
CharNextA.USER32(00000000,?,00000000,0040619A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EEE
lstrlenA.KERNEL32(00000000,?,00000000,0040619A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EF7

Memory Dump Source

Source File: 00000000.00000002.775473965.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.775457869.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775489403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775512373.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775664893.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775708492.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775744130.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775802759.0000000000450000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775831153.0000000000462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.775866734.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XShSI2OXaC.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: ab447cb61f58b6bcef3caf0db86bd497d8d87142a4839b1629914f91ab2dc9e7
Instruction ID: dbee6a8f58d2e2d1767b404294421e9e903371520217b283108b10f7101d33ef
Opcode Fuzzy Hash: ab447cb61f58b6bcef3caf0db86bd497d8d87142a4839b1629914f91ab2dc9e7
Instruction Fuzzy Hash: CCF0C231105514EFC7029BA4CD0099FBBA8DF05250B2540B9E840F7211DA34EF01AB98

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XShSI2OXaC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\hale4r.lnk

C:\Users\user\AppData\Local\Temp\nszA331.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Contentness\Filialbestyrerens\Talkability\Platybrachycephalous\Plugin_Status.ini

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Contentness\Filialbestyrerens\Talkability\Platybrachycephalous\vfslog.c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Coronoid.Ano

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen\view-more-horizontal-symbolic.symbolic.png

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
XShSI2OXaC.exe

Function 0040350D Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Function 73791B5F Relevance: 20.1, APIs: 13, Instructions: 597
stringlibrarymemoryCOMMONCrypto

Function 00405B6C Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00406B64 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 0040679D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 00402171 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Function 004028D5 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Function 00404E34 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 487
windowmemoryCOMMON

Function 00403EEE Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403B40 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402F9D Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Function 0040647C Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004067C4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405F7F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 73791777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00402451 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Function 00405E37 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Function 00405436 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Function 00406328 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Function 00405A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Function 00406F99 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 0040719A Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 00406EB0 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 004069B5 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406E03 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406F21 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 00406E6D Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 00403346 Relevance: 4.6, APIs: 3, Instructions: 101
COMMON

Function 0040209F Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Function 00402565 Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Function 0040323E Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Function 004024F1 Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Function 004023FB Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Function 00406834 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 00405F50 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405F2B Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Function 00405A0E Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 73792AF8 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON